F5 Labs AI security model insights: When AI agents expose data without an attacker

Malcolm HeathPrincipal Cybersecurity Threat Researcher | F5

Louise ScullySr. Mgr., PMM, AI Security & Threat Intelligence | F5

AI agents are designed to complete tasks autonomously, often identifying ways to achieve an objective that their operators may not have anticipated. Recent incidents reveal how agents working to complete assignments can unexpectedly expose critical data or trigger unwanted workflows.

These incidents do not necessarily involve malicious behavior or compromised models. Risks can emerge when agents pursue legitimate objectives but operate without adequate controls governing what they can access, execute or share. As a result, sensitive data can be exposed to the public and potentially to malicious actors, without an attacker ever being involved.

Two examples of this type of risk are explored in the October AI Security Insights report from F5 Labs. This monthly report examines model resilience through the F5 Labs AI security leaderboards, alongside emerging threats, vulnerabilities and security incidents affecting AI systems. It also examines emerging AI security threats and incidents, including two cases this month where agents pursuing legitimate tasks exposed sensitive information without an external attacker. These incidents highlight how security risks can arise not only from model vulnerabilities, but also from agent behavior and the controls governing their actions.

Heed the law of unintended consequences

One of those incidents, the recent PixelLeak exposure, highlights the risks of autonomous agent behavior when appropriate security controls are not enforced. AI coding agents are commonly tasked with attaching before-and-after screenshots of developer work to pull requests. But no one expected them to do it by publishing the proprietary and potentially sensitive images to public GitHub repositories.

Agents use a command-line interface (CLI) instead of the browser interface humans use to access the image hosting service. Without a command-line way to add images to private pull requests, the agents reasoned that to avoid broken links for reviewers, they had to create public repositories instead. Some developers also used gitshot, an open-source screenshot publishing tool associated with public repository creation. According to the research, approximately one-third of affected organizations had developers using the tool.

More than 13,000 internal screenshots and recordings were exposed across over 900 public GitHub repositories, affecting more than 300 organizations. Within a week, more than a dozen agents at one software vendor had encoded this workaround as a reusable skill. The broader security issue is that agents were able to publish potentially sensitive material to public repositories outside normal corporate oversight. With 93% of affected repositories located in personal accounts, the findings highlight the importance of enforcing controls over where agents can publish data, rather than relying solely on intended workflows or developer instructions.

Another reported incident in October raised concerns about data exposure within shared AI agent environments. According to a self-reported account, a Grok-powered personal assistance agent published information about its owner’s personal finances to a work Slack channel that included the agent’s owner. The Grok bot was expected to perform a read-only audit of the owner’s bank accounts, analyze expenditures, and report the results monthly. Crucially, the agent had no Slack connection; it was expected to send the audit to its owner by other means.

Instead, the owner’s finances appeared in his company’s Slack channel for two hours, as if he had posted the information himself, until a colleague flagged it. Although the reported incident remains unverified, it highlights a credible security concern: agent-level permissions may not provide sufficient isolation when multiple agents share credentials, sessions or integrations within the same environment.

The finance bot lacked Slack access, but a different bot on the same account did have access, and all a user’s bots share resources. Indeed, SpaceXAI's documentation explicitly warns against using separate bots as a security boundary. The reported incident raises questions about whether agent-specific permissions offer sufficient protection in shared environments. Where agents can access common credentials, sessions, or resources, organizations need to assess whether effective isolation and authorization controls are enforced.

Expect risks without adversaries

These incidents illustrate an important distinction: a model’s resistance to adversarial attacks does not establish the security of every application or agent built around it. Model resilience is an important consideration, but security also depends on the permissions, integrations and controls governing the deployed AI system.

F5 Labs’ Comprehensive AI Security Index (CASI) measures model resistance to adversarial attacks, including prompt injection and jailbreaks. The Agentic Resistance Score (ARS) evaluates resilience against complex, multi-step agentic attacks. Both provide valuable evidence of adversarial resilience, but neither is intended to assess every permission, integration or execution control surrounding a deployed agent.

That distinction matters because agents operate within a wider system of connectors, credentials, shared resources and permissions. The October research illustrates how weaknesses in those surrounding controls can lead to unintended disclosures without an attacker. It also identifies other cases, including GitSpawn and the GitLab AI Gateway vulnerability, where attackers could exploit trust or execution boundaries that were not enforced when needed. The common lesson is that security boundaries must be effective regardless of whether a risky action originates from an agent pursuing a legitimate task or from an attacker exploiting a weakness.

For CISOs, the implication is to assess more than the model. Threat modeling should cover the full agent architecture, including identity, authorization, tool access, shared environments and the consequences of autonomous actions. Detection approaches focused primarily on malicious intrusions may also miss harmful actions carried out by otherwise authorized agents. Strong model-level adversarial resilience is valuable, but it cannot substitute for enforcing and monitoring what deployed agents may access, execute or disclose.

Protect your organization from non-adversarial risks

These findings show why organizations cannot rely solely on an agent's intended behavior or a model's security score. CISOs cannot anticipate every action an autonomous agent may take, but they can reduce the impact of unexpected behavior by setting and validating enforceable boundaries. Five areas deserve attention:

1. Expand your definition of AI security. Evaluate model resilience alongside the security of the wider AI system, including agent identity, authorization, isolation, access to resources, and execution environments. These are distinct but complementary security assessments.
2. Consider the whole AI infrastructure. Include AI gateways, template engines, and agent orchestration services in asset inventories, vulnerability management, patching processes and privileged-access reviews. October's GitLab AI Gateway finding shows why these components must be treated as security-critical infrastructure.
3. Enforce technical boundaries. Prompt instructions and agent-specific settings are not substitutes for effective isolation and authorization, especially where agents share resources. Restrict where agents can publish artifacts, review reusable agent-created skills, and monitor what agent actions actually produce.
4. Verify controls before execution. Check that trust and approval controls operate before potentially dangerous actions can occur. In the October GitSpawn finding, repository configuration could trigger code execution during agent startup, before relevant trust checks, without a model tool call. Review startup behavior, developer endpoint permissions, and software supply-chain paths, accordingly.
5. Reassess models and agent environments as they change. October's CASI results show variation even within one family: GPT-6 Luna scored 93.52, Astra 89.62, and Sol 88.22. Model variants therefore warrant individual security evaluation. Reassess agent permissions, integrations, and infrastructure after material changes, too. Adversarial testing, including F5 AI Red Team, can help identify weaknesses but must be complemented by checks of the operational controls governing agent actions.

October's findings reinforce a practical lesson for CISOs: model resilience, agent behavior, and the controls surrounding an AI deployment need to be assessed together. A strong adversarial-resilience score does not eliminate risks arising from permissions, integrations or infrastructure.

Read the October F5 Labs AI Security Insights report to understand the latest CASI and ARS results, emerging attack techniques and analysis of AI-system vulnerabilities.

Discover how the F5 AI Security Platform can help protect your organization. Also, be sure to read last month’s F5 Labs threat intelligence insights blog, which focused on the variety of security metrics CISOs need to assess both before and after model deployment.

About the Authors

Malcolm HeathPrincipal Cybersecurity Threat Researcher | F5

Malcolm Heath is the Principal Threat Researcher with F5 Labs. His career has included incident response, program management, penetration testing, code auditing, vulnerability research, and exploit development at companies both very large and very small. Prior to joining F5 Labs, he was a Senior Security Engineer with the F5 SIRT.

More blogs by Malcolm Heath

Louise ScullySr. Mgr., PMM, AI Security & Threat Intelligence | F5

Louise Scully is a Senior Manager in Product Marketing for AI Security and Threat Intelligence at F5. Her career has spanned product marketing, product management, go-to-market strategy, communications, thought leadership, and category development across AI security and enterprise technology. Prior to joining F5, Louise led marketing at both CalypsoAI and Artomatix, helping bring AI technology and research to market.

More blogs by Louise Scully