For more than a decade, defenders have watched attacker tradecraft evolve from noisy malware to stealthy techniques that blend into normal enterprise activity. “Living off the Land” (LotL) attacks, which abuse legitimate system tools like PowerShell, WMI, and Active Directory, became the gold standard for stealth.
Now, a new phase is emerging.
Security researchers are beginning to observe a shift toward “Living off the AI”—a tradecraft in which attackers compromise, manipulate, or hijack internal enterprise AI agents and use them as infrastructure for lateral movement, reconnaissance, and data access. Rather than dropping binaries or abusing OS utilities, attackers are abusing AI orchestration layers and agent-to-agent communication, particularly those built on the Model Context Protocol (MCP).
This marks a fundamental change in how trust, automation, and access control failures are exploited.
From Living off the Land to Living off the AI
Traditional LotL attacks succeed because defenders trust system tools. PowerShell is allowed. WMI is expected. Service accounts are everywhere.
Enterprise AI agents now enjoy the same level of implicit trust—but with far broader reach.
Modern AI agents are often granted:
- Access to internal APIs and databases
- Permission to call other agents
- Contextual memory of past tasks
- Credentials to act “on behalf of” users or systems
In many organizations, AI agents are becoming privileged digital employees—but without the decades of security hardening applied to human identities or OS-level tooling.
Attackers have noticed.
Why AI Agents Are an Ideal Target
Unlike traditional applications, AI agents are designed to be:
- Autonomous – They decide what actions to take
- Context-aware – They retain and share state
- Composable – They call other agents and tools
- Trusted by default – Their outputs are rarely questioned
When an attacker gains control over an AI agent, they don’t just get code execution—they get decision execution.
Instead of issuing commands, the attacker influences intent.
The Role of the Model Context Protocol (MCP)
MCP is increasingly used as the connective tissue between AI agents, tools, and data sources. It standardizes how:
- Context is shared between agents
- Capabilities are advertised and invoked
- State persists across workflows
From a defender’s perspective, MCP is powerful infrastructure.
From an attacker’s perspective, MCP is a lateral movement highway.
Once an attacker compromises a single agent—via prompt injection, poisoned memory, insecure plugin, or leaked credentials—they can:
- Enumerate other available agents
- Discover exposed tools and data sources
- Pivot by issuing MCP calls that appear legitimate
- Chain agent-to-agent actions without touching the OS
No malware. No suspicious processes. No abnormal network traffic.
Just “AI doing AI things.”
How Living off the AI Attacks Work
A typical attack chain looks like this:
1. Initial Agent Compromise
Attackers gain influence over an AI agent through:
- Prompt injection via user input
- Poisoned documents or tickets
- Overly permissive system prompts
- Misconfigured MCP endpoints
- Shared or long-lived agent credentials
The agent continues operating normally—but with altered behavior.
2. Capability Discovery
Using MCP introspection or natural language queries, the attacker learns:
- What tools the agent can access
- Which other agents it can invoke
- What data sources are available
This reconnaissance is invisible to traditional EDR.
3. Lateral Movement via MCP
The compromised agent calls other agents:
- “Summarize last quarter’s financials”
- “Pull logs from the HR system”
- “Check cloud permissions for anomalies”
Each request looks legitimate. Each action is authorized.
4. Data Access or Impact
The attacker exfiltrates data, manipulates decisions, or quietly sets up persistence—often by embedding instructions in shared agent memory or workflows.
Why Detection Is So Hard
Living off the AI attacks bypass many core security controls:
- No new binaries → EDR stays silent
- No credential dumping → IAM alerts don’t fire
- No anomalous APIs → Traffic matches normal AI usage
- No obvious attacker intent → Requests look helpful, not malicious
Security teams often lack visibility into:
- Agent-to-agent communication
- Contextual memory changes
- Prompt evolution over time
- MCP capability graphs
In many environments, AI agents are effectively black boxes with root access.
Defensive Strategies That Actually Help
Defending against Living off the AI requires treating AI agents as first-class security principals, not helpful scripts.
Key controls include:
Agent Identity and Least Privilege
- Assign unique identities to each agent
- Scope MCP permissions narrowly
- Eliminate shared agent credentials
Context and Memory Integrity
- Monitor for unauthorized context changes
- Implement signed or immutable system prompts
- Separate user input from agent instructions
MCP Visibility and Logging
- Log all MCP calls with intent metadata
- Detect unusual agent-to-agent invocation patterns
- Baseline “normal” agent behavior
Human-in-the-Loop for High-Risk Actions
- Require approval for sensitive data access
- Enforce policy checks before agent tool execution
Red Team Your AI
If you haven’t tried to attack your own agents, someone else eventually will.
The Bigger Picture
“Living off the AI” isn’t just another attacker technique—it’s a reflection of how enterprises are changing.
As organizations delegate more decisions to AI systems, attackers will follow the trust. Where authority exists, abuse is inevitable.
The lesson from LotL still applies: The most dangerous attacks don’t break in. They blend in.
AI agents are no longer just productivity tools. They are infrastructure. And infrastructure must be defended accordingly.
