Across the Kill Chain: AI Agents as the Enterprise Red Team's New Front Door

Desktop AI agent applications such as Claude Code, OpenAI Codex, Cursor, GitHub Copilot and Google Gemini/Antigravity CLI have rapidly embedded themselves into enterprise workflows, CI/CD pipelines and cloud-connected build environments. Security teams treat them as productivity tools. Red teams and threat actors see something different: a new class of enterprise attack surface that spans every stage of the kill chain.

This Briefing takes a red team operator's perspective on what happens when AI agents become standard infrastructure. Drawing from original vulnerability research across six products and five vendors, including CVE-2026-25725, indirect code injection leading to a full remote code execution and findings that prompted Anthropic to issue emergency migration notices to all enterprise customers, we will demonstrate how these new agentic workflows create previously unavailable critical attack paths through modern enterprises.

We will present real-world attack scenarios that chain discovered vulnerabilities into full enterprise compromise operations: poisoned repositories that achieve code execution the moment a developer opens a project folder, cross-user privilege escalation through system-wide configuration paths that AI tools trust blindly, sandbox escapes that turn the agent's own isolation features against itself, credential theft that weaponizes the AI model as an unwitting exfiltration engine through insecure communications, and cloud identity takeover through OAuth tokens exposed inside sandboxed environments. We then show how these techniques extend beyond individual workstations into CI/CD pipelines where AI agents run with service account privileges, transforming a single prompt injection into build infrastructure compromise.

This Briefing maps AI agents onto the enterprise kill chain initial access, execution, persistence, privilege escalation, credential theft, lateral movement and equips red teamers with practical, field-tested techniques. For defenders, we provide detection strategies and architectural guidance to harden the environments where developers and AI agents now operate side by side.