The audit passed. AES-256 on the vector store. TLS on every API call. The security team signed off. But the inference pipeline was never on the checklist.
The vulnerability is architectural: agentic AI creates a third exposure state — data in use across the inference pipeline (retrieval, embedding, tool execution, and memory) — that standard encryption cannot reach. No established audit framework yet governs that layer.
At-rest encryption protects the storage layer. In-transit encryption protects the network layer. Both terminate at the same boundary: query time — exactly when the data is most exposed.
To run a query against a vector database, the index must be decrypted. Retrieved context — the patient record, the contract clause, the deal value — enters compute memory as plaintext. It stays plaintext through tokenization, embedding, retrieval, tool dispatch, and action execution. Every security layer downstream from decryption is operating on data that is already exposed.
The enterprise response has been to apply familiar controls to an unfamiliar architecture and call it secure. The CISO who signed off on AES-256 for the vector database and TLS for API calls covered the perimeter. The inference pipeline inside it went unaddressed.
"The CISO who signed off on AES-256 for the vector database and TLS for API calls covered the perimeter. The inference pipeline inside it went unaddressed."
A traditional AI application has a bounded exposure window, one discrete, human-gated transaction. The plaintext moment is short and local.
Agentic AI extends that window across an entire execution chain. An agent holds credentials, reads from vector stores, writes to memory, hands off context to other agents, and executes actions — without human review at each step. The plaintext state is not a moment. It spans the execution chain.
Nearly half (48%) of cybersecurity professionals ranked agentic AI as their top attack vector heading into 2026, above deepfake threats and passwordless authentication risks, according to a January 2026 Dark Reading poll of its readers. The concern is structural: agents operate with elevated permissions across multi-step execution chains without human review at intermediate points. A compromise that would affect one record in a traditional application can traverse an entire agent's permission scope before any alert fires.
Just over half (53%) of organizations now report an established strategy guiding general AI deployment, per Okta's AI Agents at Work 2026 report. Active security governance lags: barely a third apply equivalent security controls to AI agents as they do to human identities, and only 10% have a well-developed strategy for managing non-human identities. Legacy IAM systems were not built to provision task-scoped credentials for autonomous non-human identities, and standard encryption was not designed to govern data in use. Both control planes are running behind the deployment curve.
"The plaintext state is not a moment. It spans the execution chain."
The governance gap compounds a data integrity problem that precedes agentic AI — explored in AI Bias Is a Data Integrity Problem. Treat It Like One.
The OWASP GenAI Security Project published the OWASP Top 10 for Agentic Applications 2026 on December 9, 2025 — peer-reviewed and built from real incidents. The framework marks a deliberate shift from securing isolated request-response interactions to securing autonomous decision-making across multi-step execution chains.
ASI03 — Identity and Privilege Abuse: By default, agents run on borrowed credentials: a human's token, a shared service account, or a long-lived API key with scopes that have not been reviewed since setup. When an agent retrieves data, those credentials authenticate the request. When the agent is hijacked, the attacker inherits every permission the agent holds. Per-agent identity with short-lived, task-scoped credentials strictly bounds the blast radius.
ASI04 — Agentic Supply Chain Vulnerabilities: Agentic workflows load tools, prompt templates, and agent components dynamically at runtime. A compromised upstream component (a poisoned extension, a tampered prompt library, a malicious MCP server) operates inside the trust boundary indistinguishable from authorized execution. The encrypted storage layer never flags it. The network layer never sees it. The compromise executes entirely in plaintext inside the inference pipeline.
ASI06 — Memory and Context Poisoning: Session context, retrieval indexes, and long-term memory stores shape all future agent behavior. None function as native trust boundaries. An attacker who plants malicious content in an agent's retrieval corpus does not need to breach the encrypted disk. The poisoned payload is decrypted on query like any legitimate record, entering compute memory through the standard plaintext pipeline. It is indistinguishable to the agent and invisible to standard audit logs.
Each attack pattern has a documented real-world precedent in the OWASP framework's official exploits tracker.
Both attacks bypassed the enterprise cryptographic perimeter. They weaponized the plaintext inference pipeline — an execution layer that at-rest and in-transit controls were never designed to reach.
Compliance failure in enterprise AI is rarely an absence of encryption — it is an execution blind spot. AES-256 and TLS function as designed, but neither extends into compute memory during inference. The first failure is cryptographic scope. The second failure is a control void: no established audit framework yet governs the execution pipeline where data-in-use lives.
A healthcare AI agent that decrypts patient records during inference, routes that context through an external model API, and writes retrieved data to a shared memory store will clear every at-rest and in-transit audit checkpoint and still fail a HIPAA Security Rule review on access control and audit-logging requirements. The same architecture pattern applies across financial services (GLBA, SOX), legal, and any sector operating under data residency requirements.
The question that defines a modern security audit goes beyond whether data is encrypted to whether encryption governance extends into the inference pipeline — across retrieval, embedding, tool execution, and memory — or stops at the boundaries regulators drew before production agentic deployments existed.
"The question that defines a modern security audit goes beyond whether data is encrypted to whether encryption governance extends into the inference pipeline — or stops at the boundaries regulators drew before production agentic deployments existed."
Hardware-based confidential computing — AWS Nitro Enclaves, Azure Confidential VMs, Intel TDX — is the enterprise standard for protecting data in use at the infrastructure layer. These platforms use Trusted Execution Environments (TEEs) to encrypt memory during processing, ensuring that not even the cloud provider or a compromised host admin can access the plaintext data. Hardware isolation at that boundary makes confidential computing worth evaluating for regulated workloads handling ePHI or financial data.
Scope is an architectural limitation specific to agentic systems. A TEE secures the compute boundary of a single enclave, but agentic workflows cross that boundary repeatedly — context passed between agents, tool outputs routed across services, memory written to external stores. Each handoff is an exit from the protected environment.
The OWASP framework points toward five controls that address what at-rest and in-transit encryption leave uncovered. None replace AES-256, TLS, or hardware enclaves. Each governs the execution layer those controls cannot reach.
Per-agent identity with short-lived credentials: Every agent requires a dedicated non-human identity — not a borrowed human token or shared service account. Credentials issued just-in-time and scoped to the current task expire automatically, strictly bounding the blast radius by time and privilege scope.
Scoped retrieval architecture: The vector database is an active attack surface, not passive storage. Vector similarity search requires plaintext access to compute distances — the exposure is inherent to how the matching process works. Mitigation relies on constraining the agent's search scope:
Treat vector store access as a privileged operation, not a passive storage tier.
Validated memory writes: Treat anything written to persistent memory as potentially adversarial input. Long-term memory stores require strict semantic sanitization and boundary enforcement — legacy input validation does not catch poisoned context masquerading as legitimate agent memory.
Behavioral monitoring with automated circuit breakers: Behavioral baselines for each agent make anomalous retrieval and tool use detectable before damage compounds. Because agentic execution outpaces human intervention, detection must trigger automated circuit breakers — and those controls are only effective if tested under realistic conditions before an incident requires them.
Cryptographic tenant isolation: In multi-tenant deployments, row-level filtering is a logical boundary, not a security boundary. A single misconfiguration exposes adjacent namespaces. True cryptographic isolation pairs per-tenant key custody with dedicated compute contexts—ensuring decrypted data never occupies shared inference memory, and a localized compromise never propagates.
Three questions belong on every AI deployment security review that are not on most of them now:
Standard audits cover the storage layer and the network layer. The inference layer — where agentic AI actually operates on sensitive data — operates in a governance void. That governance void is where the next category of enterprise AI breach will originate.
At-rest and in-transit encryption remain necessary. For organizations running multi-agent workflows, they are no longer sufficient. The perimeter ends where inference begins.
Practitioners ignore marketing copy, but they read architectural reality. Agile Marketing LLC helps B2B cybersecurity vendors translate their technical advantages into practitioner-grade content. Let's build your next campaign.
.png){kind=icon}
