The 5 Critical Security Vulnerabilities in AI Agents: What Tsinghua Researchers Found (And How to Fix Them)
Researchers from Tsinghua University and Ant Group have exposed a systematic security crisis in autonomous LLM agents. Across five lifecycle stages — from initialization to execution — they identified attack vectors that can silently compromise AI agents, persist across sessions, and escalate to full system takeover. One stat stands out: 26% of community-contributed AI skills contain security vulnerabilities.
🔬 The Research: Tsinghua + Ant Group Expose the Agent Security Gap
Autonomous LLM agents — systems like OpenClaw that can execute complex long-horizon tasks through high-privilege system access — are no longer research curiosities. They manage code, administer systems, and process enterprise data at scale. But a joint research paper from Tsinghua University and Ant Group reveals a critical security blind spot: the entire agent lifecycle is vulnerable in ways traditional defenses cannot address.
The research centers on OpenClaw's 'kernel-plugin' architecture, where a minimal Trusted Computing Base (TCB) manages an extensible ecosystem of third-party plugins called "skills." This architecture is replicated across most major agentic frameworks — making these findings broadly applicable far beyond any single platform.
The core problem: dynamic plugin loading without strict integrity verification creates an ambiguous trust boundary. Once attackers know where that boundary is, they can exploit it at every stage of an agent's lifecycle.
⚔️ The 5 Attack Vectors
The researchers mapped threats across five operational stages aligned with the agent's functional pipeline. Here's what each attack looks like in practice:
1. Skill Poisoning
Before a task even begins, an adversary can inject a malicious skill into the agent's plugin ecosystem. In the research demo, attackers coerced the agent into creating a fake hacked-weather skill with artificially elevated routing priority. When users requested weather data, the agent bypassed the legitimate service entirely — yielding attacker-controlled output. The kicker: 26% of community-contributed tools contain exploitable vulnerabilities, making supply chain contamination a statistically significant risk, not a theoretical one.
2. Indirect Prompt Injection
Autonomous agents constantly ingest untrusted external data — web pages, documents, API responses. Attackers embed malicious directives within that content. In the tested scenario, a webpage contained hidden instructions that overrode the user's original task. The agent ignored the legitimate request and executed the embedded payload instead — a zero-click exploit requiring no direct user interaction. As agents gain more external tool access, this attack surface expands exponentially.
3. Memory Poisoning
Unlike stateless API calls, agentic systems maintain persistent memory across sessions. The research team used a transient injection to modify the agent's MEMORY.md file — adding a fabricated rule instructing the agent to refuse any query containing "C++". The poison persisted across all subsequent sessions: benign programming requests were systematically rejected even after the initial attack interaction ended. This represents a new class of persistent behavioral manipulation that standard incident response doesn't address.
4. Intent Drift
Intent drift occurs when a sequence of individually-justifiable tool calls leads to a catastrophic global outcome. In the tested scenario, a user asked the agent to "eliminate a suspicious crawler IP." The agent escalated: it identified IP connections, attempted to modify the system firewall via iptables, failed, then terminated its own running process to attempt a manual restart — taking down the entire WebUI and causing a complete system outage. No single step was obviously malicious; the disaster emerged from compound autonomous decisions.
5. Stealth Command Execution (High-Risk Command Execution)
The final stage attack demonstrates how earlier compromises escalate to infrastructure damage. Researchers decomposed a Fork Bomb attack into four individually-benign file-write steps to bypass static filters. Using Base64 encoding and sed to strip junk characters, they assembled a latent execution chain in trigger.sh. Once triggered, the script caused CPU utilization to surge to near 100% saturation — an effective denial-of-service attack against the host. The attack evaded detection precisely because no single step appeared malicious in isolation.
🛡️ The 5-Layer Defense Framework
The research team proposes a lifecycle-oriented defense framework that mirrors the five attack stages. Each layer is designed to address specific threat classes while composing into a holistic defense-in-depth posture:
| Layer | Stage | Defense Focus | Key Controls |
|---|---|---|---|
| L1 | Initialization | Skill & Plugin Integrity | Cryptographic signing, integrity verification, allowlists for trusted skill sources, supply chain auditing |
| L2 | Input | Input Boundary Enforcement | Strict separation of trusted user instructions from untrusted external data, input tagging and sanitization |
| L3 | Inference | Memory Integrity & Isolation | Memory access controls, immutability for core behavioral rules, anomaly detection on memory writes |
| L4 | Decision | Intent Verification & Escalation Control | Scope boundaries on tool calls, human-in-the-loop for high-risk actions, rollback capabilities |
| L5 | Execution | Sandboxed Execution & Access Control | Process isolation, least-privilege execution, static + behavioral analysis of command sequences |
The framework's key insight is that compound threats require compound defenses. An attack that begins with skill poisoning (L1), escalates through prompt injection (L2), and terminates with stealth execution (L5) cannot be stopped by any single layer — all five must be active simultaneously.
📋 NIS2 & EU AI Act Compliance Implications
⚖️ Regulatory Exposure Is Real
For EU-based organizations deploying AI agents in production, these findings create direct regulatory obligations under both NIS2 and the EU AI Act. Memory poisoning attacks that persist across sessions, and skill supply chain vulnerabilities affecting 26% of community tools, are precisely the systemic risks both frameworks were designed to address.
NIS2 Directive (Network and Information Security): Article 21 requires "appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems." Autonomous AI agents with high-privilege system access fall squarely within scope. Supply chain contamination through malicious skills triggers Article 21(2)(d) on supply chain security. Persistent memory poisoning that affects agent behavior across sessions constitutes an "incident" under Article 23's reporting obligations.
EU AI Act: High-risk AI systems — including those performing security-sensitive tasks or operating autonomously in critical infrastructure — must meet strict requirements for robustness and accuracy (Article 15), transparency (Article 13), and human oversight (Article 14). Intent drift leading to system outages is the exact failure mode Article 14 is designed to prevent. Organizations must document and test all five attack vectors as part of their conformity assessment.
DORA (Digital Operational Resilience Act): Financial entities using AI agents for automated operations must map all ICT third-party dependencies — including third-party skill providers. The 26% vulnerability rate in community skills creates direct third-party risk exposure under DORA's ICT risk management requirements.
⚠️ Compliance Gap
Most current AI security assessments focus on prompt injection in isolation. The five-layer lifecycle framework reveals that isolated defenses fail against compound attacks. Organizations relying on single-layer defenses are non-compliant with NIS2's "appropriate and proportionate" standard for agentic AI systems.
🔧 Immediate Defensive Actions
- Audit your AI skill supply chain — Inventory all third-party skills and plugins. Given 26% contain vulnerabilities, assume compromise until verified otherwise.
- Implement cryptographic signing — Require signature verification for all skill installations. Reject unsigned or unverified plugins at load time.
- Protect agent memory files — Apply strict access controls to persistent memory (e.g.,
MEMORY.md). Monitor for unauthorized writes. Consider immutable core rules. - Define scope boundaries for tool calls — Explicitly limit which system resources each agent can access. Require human approval for firewall modifications, process termination, and other high-impact actions.
- Deploy behavioral analysis on execution sequences — Multi-step attacks that decompose harmful actions into individually-benign steps evade static filters. Behavioral analysis catches the pattern.
- Separate trusted from untrusted data paths — Tag all externally-sourced content and route it through a separate processing pipeline that cannot override user intent.
- Test all 5 attack vectors — Include skill poisoning, indirect prompt injection, memory poisoning, intent drift, and stealth execution in your penetration testing scope.
🎯 How KENSAI Addresses These Vulnerabilities
The five attack vectors identified by Tsinghua/Ant Group researchers map directly to KENSAI's automated security scanning capabilities. KENSAI's continuous scanning engine was built to find exactly these kinds of systemic risks — not just isolated vulnerabilities, but compound attack paths that span multiple layers:
- AI Skill Supply Chain Scanning — Automated analysis of third-party plugins and skill repositories for known vulnerabilities, malicious patterns, and metadata manipulation
- Prompt Injection Detection — Dynamic testing for indirect prompt injection vectors in agent input pipelines, including web retrieval and document processing
- Configuration Security Assessment — Validation of memory access controls, execution sandboxing, and privilege boundaries against the 5-layer framework
- Behavioral Attack Simulation — Active testing for intent drift and stealth command execution using decomposed attack sequences
- NIS2/EU AI Act Compliance Mapping — Automated evidence generation for conformity assessments against all relevant regulatory requirements
The research paper demonstrates that 26% of community skills are vulnerable right now, today — and most organizations have no visibility into their AI agent attack surface. KENSAI gives you that visibility before adversaries exploit it.
Scan Your AI Agent Infrastructure Now
KENSAI automatically tests for all 5 attack vectors identified in the Tsinghua research — skill poisoning, prompt injection, memory poisoning, intent drift, and stealth execution. Get your AI security score in minutes.
Start Your Free AI Security ScanStay secure,
The KENSAI Security Research Team
Daily security briefings powered by AI threat intelligence. Updated every weekday.