As AI agents become integrated into SOC and Incident Response workflows, they introduce new attack surfaces that adversaries actively exploit. This session examines how AI‑powered security agents are compromised through plugin poisoning, SIEM integration manipulation, and model output corruption—converting defensive automation into attack infrastructure. It presents strategies for detecting compromised AI systems and outlines resilient architectural patterns that preserve operational integrity under active agent exploitation.
