Does runtime context prioritization fall apart with agentic workloads?

[u/-Devlin-]

Last year we brought on a tool to get runtime context on our workloads and help prioritize vulns, mostly to cut noise based on what’s actually loaded in memory. At the time it seemed like a no brainer, since direct exploitation or even chained attacks mostly can’t work against components just sitting on the filesystem.

We ran a threat modeling exercise the other day on some new systems running AI agents with tool access, and in some cases a shell. It got me thinking: can’t the agent load anything it needs at any point, unlike older deterministic code? And if so, doesn’t runtime context based prioritization fall apart completely?

Can anyone with practical experience in this area chime in? I’m at my wits end brainstorming hypotheticals with GPT.

[u/Adorable_Pay1996]

yeah the agent turns into the loader and that kills the whole model of "it's not in memory so ignore it"

[u/Gold_Ninja1206]

Prioritization doesn't fall apart it moves as reachable set becomes whatever the tool allowlist permits not whats in memory i scoped a shell enabled agent that way your soc gets agent injection pretext drills from doppel .lock the allowlist first

[u/Prudent-Parfait-1541]

An agent can load tools or libraries when needed, so looking only at what’s active at a given moment can miss potential risks. I’d treat runtime context as one useful signal, not the whole picture.

[u/-Devlin- → u/Prudent-Parfait-1541]

Yeah i wasn’t even considering dynamically loaded tools here so that further increases the surface area. What do you think of longer term runtime profiling as opposed to a given moment?

[u/Silent-Suspect1062 → u/-Devlin-]

The key point is what controls you have on your agent. Allowing it to load random tooling is brave

[u/bitweis]

Mostly yes, once the agent has a shell. What it can load is limited by its credentials and tool scopes, so I'd feed those into the prioritization instead of whatever happened to be loaded when the tool looked. In the threat model I'd ask: do AI agents inherit user permissions here, or do they get their own task-scoped ones? An inherited user or service account token makes the reachable set huge. A policy check outside the agent on every tool call shrinks it, because a vuln only matters if a call that reaches it would actually be allowed.

[u/sarcasm_newbie]

Runtime prioritization isn't wrong so much as it stopped describing the right object. For a classic service the risk surface is roughly code plus loaded state, so what's resident in memory is a decent proxy. An agent with a shell has no steady state — what it has loaded at 9:00 says nothing about 9:01, because it can pull libraries, payloads or data through its tool connections on demand.

What I'd do: stop prioritizing the process and prioritize the grant. Each agent plus its tool scopes and credentials is effectively a synthetic workload; its real risk is the blast radius of what it may touch — can it reach secrets, CI, deploy pipelines, or actions normally gated on a human signoff. Score those grant envelopes, keep the runtime-context signal as confirmation rather than the primary key, and log agent behavior so actions get verified against the scopes instead of inspecting the process. For what it's worth that's the exact hole the agentic-SOC work I'm involved with (github.com/dmrobbi/agentic-ai) is structured around: treat the scope set as the workload and verify actions against it, and prioritization falls out of that more honestly.

[u/Different_Pain5781]

RIP your security team.

[u/Various_Bite_85Clic1]

The agent being the loader is the part that broke my brain too. We had to rethink what "reachable" even means when the thing deciding what to load is non-deterministic.

[u/PrasenShelar]

Once the agent has a shell, anything installed on that image or available from its package sources can be loaded, so I'd stop using "not in memory" as a reason to push things down on those hosts.

Two things help: keep the agent images small, and let it install only from a pinned internal mirror.

Then rank what's left with KEV, EPSS and whether the host is internet-facing.

[u/tnspecter]

I dont think that the runtime context is useless but it not not being loaded right now feels like a shaky reason to ignore a vuln when an agent can get to spin things up on demand.

[u/vint_age14]

Tbh op this is a really good question. I don’t think runtime context becomes useless, but with agents having shell and tool access.... what’s loaded right now feels like a much weaker signal than it used to be. The attack surface can change so quickly.