When I ask IT executives and security leads how they’ve secured their agentic AI deployments, the answer is almost always the same checklist: AES-256 on the vector store, TLS on every API call. But the inference pipeline was never on the checklist.
The vulnerability is architectural: agentic AI creates a third exposure state, data in use across the inference pipeline (retrieval, embedding, tool execution, and memory), that standard encryption cannot reach. No established audit framework yet governs that layer.
At-rest encryption protects the storage layer. In-transit encryption protects the network layer. Both terminate at the same boundary: query time — exactly when the data is most exposed.
To run a query against a vector database, the index must be decrypted. Retrieved context — the patient record, the contract clause, the deal value — enters compute memory as plaintext. It stays plaintext through tokenization, embedding, retrieval, tool dispatch, and action execution. Every security layer downstream from decryption is operating on data that is already exposed.
The enterprise response has been to apply familiar controls to an unfamiliar architecture and call it secure. The CISO who signed off on AES-256 for the vector database and TLS for API calls covered the perimeter. The inference pipeline inside it went unaddressed.
"The CISO who signed off on AES-256 for the vector database and TLS for API calls covered the perimeter. The inference pipeline inside it went unaddressed."
A traditional AI application has a bounded exposure window, one discrete, human-gated transaction. The plaintext moment is short and local.
Agentic AI extends that window across an entire execution chain. An agent holds credentials, reads from vector stores, writes to memory, hands off context to other agents, and executes actions — without human review at each step. The plaintext state is not a moment. It spans the execution chain.
Nearly half (48%) of cybersecurity professionals ranked agentic AI as their top attack vector heading into 2026, above deepfake threats and passwordless elimination and passkey adoption, according to a January 2026 Dark Reading poll of its readers. The concern is structural: agents operate with elevated permissions across multi-step execution chains without human review at intermediate points. A compromise that would affect one record in a traditional application can traverse an entire agent's permission scope before any alert fires.
Just over half (53%) of organizations now report an established strategy guiding general AI deployment, per Okta's AI Agents at Work 2026 report. Active security governance lags: barely a third apply equivalent security controls to AI agents as they do to human identities, and only 10% have a well-developed strategy for managing non-human identities. Legacy IAM systems were not built to provision task-scoped credentials for autonomous non-human identities, and standard encryption was not designed to govern data in use. Both control planes are running behind the deployment curve.
"The plaintext state is not a moment. It spans the execution chain."
The governance gap compounds a data integrity problem that precedes agentic AI — explored in the Agile Marketing blog AI Bias Is a Data Integrity Problem. Treat It Like One.
The OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications 2026 on December 9, 2025 — peer-reviewed and built from real incidents. The framework marks a deliberate shift from securing isolated request-response interactions to securing autonomous decision-making across multi-step execution chains.
ASI03 — Identity and Privilege Abuse: By default, agents run on borrowed credentials: a human's token, a shared service account, or a long-lived API key with scopes that have not been reviewed since setup. When an agent retrieves data, those credentials authenticate the request. When the agent is hijacked, the attacker inherits every permission the agent holds. Per-agent identity with short-lived, task-scoped credentials strictly bounds the blast radius.
ASI04 — Agentic Supply Chain Vulnerabilities: Agentic workflows load tools, prompt templates, and agent components dynamically at runtime. A compromised upstream component (poisoned extension, tampered prompt library, malicious MCP server) operates inside the trust boundary indistinguishable from authorized execution. The encrypted storage layer never flags it. The network layer never sees it. The compromise executes entirely in plaintext inside the inference pipeline.
ASI06 — Memory and Context Poisoning: Session context, retrieval indexes, and long-term memory stores shape all future agent behavior. None function as native trust boundaries. An attacker who plants malicious content in an agent's retrieval corpus does not need to breach the encrypted disk. The poisoned payload is decrypted on query like any legitimate record, entering compute memory through the standard plaintext pipeline. It is indistinguishable to the agent and invisible to standard audit logs.
Each attack pattern has a documented real-world precedent in the OWASP framework's official exploits tracker.
Both attacks bypassed the enterprise cryptographic perimeter. They weaponized the plaintext inference pipeline — an execution layer that at-rest and in-transit controls were never designed to reach.
Compliance failure in enterprise AI is rarely an absence of encryption — it is an execution blind spot. AES-256 and TLS function as designed, but neither extends into compute memory during inference. The first failure is cryptographic scope. The second failure is a control void: no established audit framework yet governs the execution pipeline where data-in-use lives.
"The question that defines a modern security audit goes beyond whether data is encrypted to whether encryption governance extends into the inference pipeline — or stops at the boundaries regulators drew before production agentic deployments existed."
A healthcare AI agent that decrypts patient records during inference, routes that context through an external model API, and writes retrieved data to a shared memory store will clear every at-rest and in-transit audit checkpoint and still fail a HIPAA Security Rule under 45 CFR § 164.312(a)(1) (access control) and § 164.312(b) (audit controls).
The question that defines a modern security audit goes beyond whether data is encrypted to whether encryption governance extends into the inference pipeline — across retrieval, embedding, tool execution, and memory — or stops at the boundaries regulators drew before production agentic deployments existed.
Hardware-based confidential computing — AWS Nitro Enclaves, Azure Confidential VMs, Intel TDX — is the enterprise standard for protecting data in use at the infrastructure layer. These platforms use Trusted Execution Environments (TEEs) to encrypt memory during processing, ensuring that not even the cloud provider or a compromised host admin can access the plaintext data. Hardware isolation at that boundary makes confidential computing worth evaluating for regulated workloads handling ePHI or financial data.
Scope is an architectural limitation specific to agentic systems. A TEE secures the compute boundary of a single enclave, but agentic workflows cross that boundary repeatedly — context passed between agents, tool outputs routed across services, memory written to external stores. Each handoff is an exit from the protected environment.
The OWASP framework points toward five controls that address what at-rest and in-transit encryption leave uncovered. None replace AES-256, TLS, or hardware enclaves. Each governs the execution layer those controls cannot reach.
Per-agent identity with short-lived credentials: Every agent requires a dedicated non-human identity — not a borrowed human token or shared service account. Credentials issued just-in-time via SPIFFE/SPIRE, AWS IAM Roles Anywhere, or Azure Managed Identity — scoped to the current task and expiring within minutes — strictly bound the blast radius by time and privilege scope. No agent inherits ambient credentials from a prior session or a human identity's token
Scoped retrieval architecture: The vector database is an active attack surface, not passive storage. Vector similarity search requires plaintext access to compute distances — the exposure is inherent to how the matching process works. Mitigation relies on constraining the agent's search scope:
Treat vector store access as a privileged operation, not a passive storage tier.
Validated memory writes: Treat anything written to persistent memory as untrusted input until proven otherwise. Implement schema-enforced write validation at the memory layer — rejecting entries that exceed defined semantic boundaries, contain instruction-pattern signatures, or originate from unverified tool outputs.
Legacy string sanitization does not catch poisoned context; the check must operate at the semantic and structural level before the write commits. Separate read and write permissions per agent role — an agent that retrieves from memory should not hold write access to the same store unless explicitly scoped.
Behavioral monitoring with automated circuit breakers: Because agentic execution outpaces human intervention, detection must trigger automated circuit breakers with predefined thresholds — anomalous retrieval volume, out-of-scope tool calls, credential usage outside the provisioned task window. Circuit breakers must be tested against red-team scenarios before production deployment; a control that has never fired under adversarial conditions provides no assurance it will fire correctly during an incident.
Cryptographic tenant isolation: In multi-tenant deployments, row-level filtering is a logical boundary, not a security boundary. A single misconfiguration exposes adjacent namespaces. True cryptographic isolation pairs per-tenant AWS KMS customer-managed keys (CMKs) — or equivalent per-tenant key material in Azure Key Vault or GCP Cloud KMS — with dedicated compute contexts at the inference layer. Envelope encryption at the retrieval boundary ensures each tenant's decrypted data never occupies shared inference memory. A localized compromise stays localized.
Three questions belong on every AI deployment security review that are not on most of them now:
Standard audits cover the storage layer and the network layer. The inference layer — where agentic AI actually operates on sensitive data — operates in a governance void. That governance void is where the next category of enterprise AI breach will originate.
At-rest and in-transit encryption remain necessary. For organizations running multi-agent workflows, they are no longer sufficient. The perimeter ends where inference begins.
Practitioners ignore marketing copy, but they read architectural reality. Agile Marketing LLC helps B2B cybersecurity vendors translate their technical advantages into practitioner-grade content.
.png){kind=icon}
