Remote Access Trojan Techniques Adapted for AI Agent Channels
Attackers are reusing classical malware tactics against AI agents as new targets for compromise.
AI agents don't sit around waiting for instructions. They read email, browse the web, call internal APIs, and chain together multi-step plans with almost no human checking each move, which the 2025 AI Agent Index treats as the defining trait of the category rather than a side effect. That architecture needs write access and tool-calling by design, not by accident, so the attack surface ships with the product. Adoption backs this up: more than 70% of enterprise AI deployments were expected to involve multi-agent or action-based systems by mid-2025, and G2's Enterprise AI Agents Report found 57% of companies already running agents in production. Every access model built for humans, scoped sessions, manual review, a person who gets suspicious, assumes a human is on the other end. Agents break that assumption by acting continuously, at machine speed, across systems a human would never touch in one sitting, and that mismatch is exactly the gap remote access trojans were built to exploit.
Mapping the classical RAT playbook onto AI agent channels
RATs never went away. Recorded Future's H1 2026 malware data has them leading Insikt Group's reporting, with AsyncRAT topping the list of submitted malware families by unique hashes and C2 configs. What's changed is the target. The five things a RAT does, get in, stick around, phone home, spread, and steal, now have direct equivalents inside an agent pipeline: prompt injection replaces phishing as the way in, agent memory and self-modifying workflows replace registry keys for persistence, agent channels and MCP connections replace beaconing infrastructure, credential inheritance across tools replaces network pivoting, and agent-native outputs like image URLs or API calls replace the file copied to a removable storage drive.
Recorded Future's H1 2026 data frames most of this activity as "AIM3 Levels 1 to 3," meaning attackers are bolting AI onto existing malware and intrusion workflows rather than running fully autonomous campaigns end to end. The agent channel is the next rung on that ladder. In May 2026, CISA and the NSA, joined by cybersecurity agencies from Australia, Canada, New Zealand, and the UK, put out joint guidance categorizing the specific risks autonomous agents introduce inside corporate networks. Governments don't coordinate paperwork across five countries over a hypothetical.
The distinction that matters here: static malware runs a script. Goal-driven intrusions backed by one model pivot. They can try another route, poke at an unlocked cloud bucket, and keep going instead of dying at the first locked door. Trend Micro's H1 2026 APT Report documents exactly that behavior: a threat actor deployed an agent that scanned a target network, harvested credentials, and moved laterally on its own. And 88% of organizations reported a confirmed or suspected AI agent security incident in the prior year, which puts this well past the theoretical stage.
Prompt injection as the new phishing: how initial access works against agents
Indirect prompt injection does for agents what a phishing email does for humans, except the agent doesn't get a gut feeling that something's off. Instructions get buried in a webpage, an email, a database entry, anything the agent reads as part of its normal job, and the agent can't reliably tell attacker text from legitimate text once it's in context.
The EchoLeak attack on Microsoft 365 Copilot in mid-2025 is the case study everyone points to, and for good reason: it's the first documented zero-click vulnerability to pull data out of Copilot without the victim doing anything. An attacker sent an ordinary email. Nobody opened it. Copilot read it anyway during background processing, and a completely unrelated query from the user later on triggered the leak. The agent built an external image link with confidential data stuffed into the URL, the user's browser fetched the image through a Microsoft Teams proxy, and that request ultimately reached infrastructure the attacker had positioned to receive it. Notably, the injection also slipped past Microsoft's input and output filtering, not just the agent's own judgment, showing the failure is at the platform level, not just the model.
The kill chains are getting longer too. Attacks against LLM applications that once wrapped up in two or three stages are now routinely hitting four or more: zero attacks reached that depth in 2023, seven did in 2024, and fifteen did across 2025 and into 2026. Newer variants have moved beyond text, using techniques that manipulate agent behavior in ways invisible to a human reviewer and most automated filters. None of this requires the developer or the user to do anything wrong. The content arrives through channels the agent is supposed to read.
The Supabase incident from 2025 shows how this plays out in a real dev workflow. An attacker buried a malicious instruction inside a support ticket. Researchers demonstrated that the instruction could ride along a trusted MCP channel connecting an IDE to the Supabase database and execute.
Agent channels and MCP servers repurposed as C2 infrastructure
When the agent is the relay, its traffic looks exactly like its traffic. No attacker infrastructure to fingerprint, no weird binary on disk, no odd port lighting up a firewall log. The agent making a call to a legitimate service is indistinguishable from an agent that's been told to make that call by someone who shouldn't be giving it orders.
Google's Jules coding agent had unrestricted outbound internet access between May and June 2025, and a prompt injection used that access to download and run attacker instructions and maintain a foothold on the remote environment Jules runs on. All of it happened inside what looked like a normal coding assistance session. CSA Research reported that Google classified the finding as an "abuse risk" and closed the report without a public statement on the fix.
Check Point Research went a step further, showing that Grok and Microsoft Copilot could be turned into C2 relays with no API keys, no authenticated account, and minimal attacker infrastructure. The agent's own browsing feature served as the delivery mechanism. Trend Micro's H1 2026 APT Report separately documented actors using stealthy covert channels for command-and-control traffic, with some pairing that approach with a bring-your-own-vulnerable-driver rootkit to blind EDR at the kernel level.
LAMEHUG, flagged by CERT-UA, folds an LLM hosted on Hugging Face directly into the malware, generating reconnaissance and data-theft commands on the fly instead of shipping them pre-written. It exfiltrates over SFTP and HTTPS POST, and some variants encode their prompts in a text-based encoding scheme and rotate exfiltration endpoints, trading a fixed playbook for something closer to an improv routine. BLUERABBIT, a backdoor linked to a nation-state actor and first spotted in March 2026, routes tasking through RabbitMQ, keeps state in Redis, and exfiltrates through MinIO's S3-compatible storage. It also carries file encryption with a.candy extension and two separate disk-wiping modules, which is a strange combination of cute and catastrophic.
MCP servers cause a lot of this, and they're in roughly the same shape exposed RDP and SMB were a decade ago. A scan of popular MCP servers in early 2025 found 43% had command-injection flaws, with a good chunk with additional exposure from other common vulnerability classes. By 2026, researchers had documented a substantial number of MCP servers running with neither client authentication nor traffic encryption. The NSA published formal MCP security design guidance that same year; this only happens once a problem has stopped being theoretical.
Agentjacking and tool poisoning: how persistence and lateral movement adapt to agent pipelines
Tenet Security's June 2026 disclosure on "agentjacking" is the closest thing to a modern RAT install, minus the RAT and minus the install. It hijacks coding agents, Claude Code, Cursor, OpenAI Codex among them, into running attacker-controlled commands directly on a developer's machine. No phishing email, no malware dropped, and at the time of disclosure, no security tool anywhere in the stack that caught it. Tenet confirmed it against 2,388 organizations, from Fortune 100 companies down to individual developers, with an 85% success rate across every agent configuration tested.
A crafted payload gets injected into Sentry error events, the coding agent reads that event back as trusted system output, and interprets it as legitimate steps for fixing a bug. It executes the attacker's code because the agent believes it's doing its job. Standard security controls caught nothing, because the attack never uses anything but the developer's own legitimate credentials and normal command channels. No malicious binary, no threshold crossed, no anomaly for a perimeter tool to flag. Sentry was notified June 3, 2026, responded the same day, and declined to fix the root cause, calling it "technically not defensible" since the DSN in question is meant to be public.
Black Hat USA 2026 brought a second one: "PleaseFix," a zero-click hijack technique that works against Claude in Chrome, Gemini in Chrome, Perplexity's Comet, ChatGPT Atlas, and Copilot Edge. The same root issue runs through every example above. These agents pull from email, webpages, and other sources mid-task without a reliable way to tell trusted content from untrusted content, so an attacker who plants instructions in any of it can turn the agent against its own user, reaching accounts and services with the user's own permissions.
Tool poisoning is MCP's version of DLL hijacking. Instead of tampering with what a tool returns, the attacker tampers with the tool's description, the metadata an agent reads to decide which tool to call. Poison the description and the agent's decision-making is compromised before a single tool ever runs. The supply-chain version of this showed up in the ClawHavoc campaign, analyzed by Antiy CERT in 2026, which found 1,184 malicious skills sitting in ClawHub. A related vulnerability, CVE-2026-25253, scored 8.8 on CVSS and allowed one-click remote code execution in OpenClaw. It's a poisoned package registry, just for agent skills instead of npm packages, and the developer installing it has no more reason to distrust it than anyone trusts a normal library.
Persistence gets stranger once memory enters the picture. Agents that build up episodic memory or reusable skill libraries create storage an attacker can quietly modify. This gives an attacker persistence without ever touching the underlying filesystem. Research on self-evolving agents, systems like one such agent framework that rewrite their own source code, adds a genuinely new failure mode: a compromised self-modification loop that pushes attacker logic into every future version of the agent. And in multi-agent pipelines, lateral movement follows trust relationships rather than network topology. A compromised subagent can pass bad instructions up to its orchestrator or sideways to a peer, because the whole system runs on the assumption that output from another agent counts as "trusted system output." One compromised agent in a finance or engineering pipeline can touch more in a single pass than any one human session normally would.
Exfiltration through agent-native channels: why data leaves without crossing a threshold
EchoLeak is still the cleanest example of what exfiltration looks like when the agent does the work. Confidential data rode out in a URL parameter, and the user's own browser carried it, just by fetching an image the way it fetches images all day long. No file moved. No strange outbound connection lit up. No DLP rule had anything to catch, because nothing about the request looked like data leaving.
LAMEHUG's habit of switching between SSH, HTTPS POST, and Base64-encoded prompts hitting different endpoints shows the same principle from another angle: exfiltration built to be flexible, so the attacker changes the route without touching the malware itself. BLUERABBIT leaning on MinIO's S3-compatible storage points at the same underlying weakness. Cloud-native data movement looks exactly like legitimate agent activity whenever the agent already has sanctioned cloud access, which, increasingly, it does.
Conventional DLP tools were built to catch files leaving through recognizable channels, and none of that applies here. The data doesn't leave as a file, it leaves as a parameter, a URL, an API response body, or text sitting in a draft. The channel carrying it out is the agent's own authorized output path, not some rogue connection. The credentials involved belong to an authenticated session, so no authentication alert fires. And because the agent can exfiltrate a little at a time across dozens of routine, unremarkable operations, no volume threshold ever trips. Every control built to catch a smash-and-grab is watching for the wrong shape of crime.
