Shane Wilson's Blog

So how exactly do AI agents expand the cybersecurity attack surface?

I started my research with the usual suspects- blogs, youtubes, and provider whitepapers.  Having a long history developing the latter as part of marketing efforts, I sensed I was being steered to solutions versus gaining pure-play education.  

So I set out on a journey one afternoon to derive some signal from less subjective sources.  I was tipped off to an intriguing source:

CVEs (Common Vulnerabilities and Exposures) are standardized identifiers for publicly known cybersecurity flaws in software or hardware systems. The data is sourced from the National Vulnerability Database (NVD), which is maintained by the U.S. government and aggregates disclosures from vendors, researchers, and security teams worldwide. Each CVE includes a unique ID, a description of the vulnerability, its severity score (CVSS), and relevant metadata like affected products and publication date.

Here’s a walk-through of my research.  My intention was to find a sort of compass heading to dive deeper on cyber security startups that may play a part in the post-agentic cybersecurity landscape.  Translation: I’m just looking for some signal in this noise, not necessarily a true deep-research set.  Throughout the process, I used google colab and ChatGPT and I recognize there are probably some really dumb elements to my approach but I think I served my purpose decently.

To start, I pulled CVEs from January 1, 2022 to July 13, 2025.  This is meant to reflect the “post-Chat GPT” era.  From there, I looked for CVEs that included any of the below agent-relevant tools and topics.  

This returned 3,329 CVEs since 2022, with the below frequency distribution.  It’s clear “command injection” is problem that warrants deeper research.

We can also so that in aggregate, these CVEs tended to be of Critical or High severity:

After pulling these, I asked ChatGPT to provide some thematic synthesis to guide my further research.  

Thematic Trends Emerging from CVEs Related to Agentic Systems

1. Command Injection & Input Sanitization Failures (CVE Count: 2769, Severity 8.22)

This happens when a system blindly follows instructions without checking if they’re safe.

In agentic workflows, tools often take automated actions based on user or AI input. If that input isn’t properly filtered, attackers can sneak in harmful commands—like telling the system to delete files or give up access.

It’s like a smart assistant doing whatever it’s told—even if the command is dangerous.

• Trend: Repeated vulnerabilities exploit weak or absent validation of user inputs—especially in endpoints used for agentic decision-making or autonomous tool execution.
  
• Why It Matters: Agentic workflows often involve tools issuing commands or making decisions based on user, system, or LLM-generated input. If those commands aren’t sanitized, adversaries can inject malicious payloads.
  
• Example: CVE-2021-31854 (McAfee Agent) shows how even security-focused tooling can be vulnerable to injected commands from higher-layer automation.
  

2. Unrestricted File Uploads & Code Execution (CVE Count: 448, Severity 8.57)

This happens when a system lets anyone upload files without checking if they’re safe.

In agentic workflows, tools often upload or download files as part of their tasks. If a system accepts these files without strict rules, an attacker can upload something malicious—like a hidden program that takes control.

It’s like letting someone drop off a USB drive into your server room without scanning it first.

• Trend: Vulnerabilities like CVE-2025-34100 involve endpoints that allow autonomous agents or user-side tools to upload files without sufficient restriction.
  
• Why It Matters: Agents often generate or consume files—like logs, configs, or model outputs. Unrestricted upload endpoints become high-value targets for remote code execution (RCE).
  

3. Authentication Bypass and Broken Authorization (CVE Count: 65, Severity 6.68)

This means attackers can access parts of a system they shouldn’t—like skipping the login or using someone else’s permissions.

In agentic workflows, where tools are constantly making requests or taking actions, if access controls aren’t set up properly, attackers can trick the system into treating them like trusted agents or users.

It’s like walking through an unlocked back door into a building and pretending to be staff.

• Trend: CVEs like CVE-2025-6675 show frequent improper access control—e.g., over agent control panels, internal APIs, or plug-in modules.
  
• Why It Matters: Agents frequently automate multi-step processes across systems. If one component lacks proper isolation or gating, the agent can be hijacked or spoofed—escalating privileges across workflows.
  

4. Exposure via Developer Tools and Debug Modes (CVE Count: 111, Severity 6.125)

These are vulnerabilities caused by leaving behind test tools or debug settings in live systems—like open admin panels, extra logging, or hardcoded credentials.

In agentic systems, where developers rapidly plug components together, these leftover tools can give attackers easy entry points.

It’s like leaving the keys in the door after finishing construction—convenient during setup, but dangerous if left open.

• Trend: Several vulnerabilities arise from misconfigured agent frameworks or tools left in debug mode during deployment (e.g., open admin endpoints).
  
• Why It Matters: Developers building agentic systems often plug tools together quickly, leaving behind configuration gaps—such as overly permissive default settings or hardcoded credentials.
   

5. Cross-Site Scripting (XSS) and CSRF in Web-Based Agent Interfaces (CVE Count: 90, Severity 6.55)

These are attacks that exploit agent dashboards or control panels built for the web. XSS lets attackers run their own code in the browser; CSRF tricks users into triggering actions without knowing it.

For agentic systems, this means attackers can silently hijack workflows, impersonate users, or insert malicious instructions—just by exploiting the interface meant to control the agent.

Why It Matters: These interfaces may be used to visualize, edit, or trigger agent workflows. If compromised, they enable attackers to hijack user sessions or implant malicious scripts that manipulate agent behavior.

Trend: Agent interfaces built on web platforms like WordPress, WooCommerce, or admin panels often contain XSS and CSRF vulnerabilities.