KEY POINTSTrend Micro and PwC Consulting publish joint report on cyber risks and governance for AI agentsTrendAI runs 2,600 tests using 200 attack prompts across 13 AI models from four vendorsReport links stored prompt injection risk to AI agent architecture and outlines AI-CAL governance framework
Trend Micro and PwC Consulting release a joint report on AI agent cybersecurity risks. Note: Japanese text in the original image from press release has been translated into English by our editorial team.
Trend Micro
Trend Micro and PwC Consulting released a joint report on July 17 showing that certain cyber attacks against AI agents can succeed across multiple large language models, underscoring what the companies described as a structural risk in agent-based AI systems.
The report, titled “The Age of Autonomous AI: Cyber Risks and Practical Governance for AI Agents,” combines PwC Consulting’s analysis of risk, controls and implementation roadmaps for Japanese companies with TrendAI’s validation that cyber attacks can be executed in a testing environment for AI agents linked to business systems, the company said. According to the report, TrendAI’s empirical research is presented in Chapter 5, while PwC Consulting’s risk structure analysis, control framework and practical guidance span Chapters 1 to 4 and 6 to 7.
Trend Micro’s enterprise-focused TrendAI brand built a proof-of-concept environment modeled on realistic corporate systems and tested whether attacks on AI agents could be carried out. It ran 2,600 parallel tests using 200 automatically generated attack prompts against 13 AI models from four vendors: Anthropic, OpenAI, Google and DeepSeek. It confirmed that attacks succeeded on models from multiple vendors.
According to the release, the findings indicate that stored prompt injection is not tied to a specific model or vendor but stems from the architecture of AI agents. In such attacks, malicious instructions are embedded in legitimate business data and later executed when an AI agent reads that data.
In one demonstration scenario, an AI agent that read and classified support tickets submitted through a public web form was targeted by embedding malicious instructions in the ticket text. In another, an identity-verification system using uploaded passport images was attacked by disguising malicious instructions inside a passport image as an “AUDIT NOTE.” In the test environment, the AI agent was misdirected into calling database tools in sequence and succeeded in exfiltrating confidential information including authentication tokens, as well as obtaining other customers’ passport data such as names, passport numbers, dates of birth, expiration dates and nationality, the company said.
The company said the scenarios were demonstrations in a verification environment and did not involve attacks on real-world systems.
The report argues that current language models have an inherent architectural property in which they cannot strictly distinguish between data and instructions. As AI agents autonomously chain together multiple tool calls, the impact of a prompt injection attack can spread from an initial input to information theft or data tampering.
As a result, the report says the core countermeasures lie less in switching AI models than in system design and operational controls, including enforcing least-privilege access, restricting tool calls, and improving observability and controllability.
PwC Consulting organized risks using what it calls five levels of AI-agent autonomy, from L1 to L5, and five functional domains. It also proposed an “AI Control Assurance Level,” or AI-CAL, framework intended to help executives and security teams discuss the control maturity of AI agents using a common framework. The report groups priority actions for Japanese companies into three areas: establishing access governance, building foundations for observability and control, and institutionalizing AI-CAL assessment processes.
AI agents, which can interpret inputs and trigger software tools with limited human intervention, are being adopted more widely in customer support, internal operations and identity verification. Their use has also expanded concern over prompt injection and tool abuse, particularly when agents connect directly to databases, workflow systems or external applications.