Elicitation is Old-School Social Engineering with a New Target
Elicitation is old-school social engineering with a new target: your AI agents.
Shaun Archer
7/28/20264 min read
Elicitation is old-school social engineering with a new target: your AI agents
Social engineering has always relied on the same trick: get someone to do something they shouldn't, usually by asking nicely, or asking the right way. Click this link. Read out that one-time code. Just this once, ignore the policy. What's changed is who's on the other end of the conversation. Increasingly, it's not a person at all — it's an AI agent. And agents, it turns out, are every bit as talkable-into-things as the rest of us. There's a name for the technique now: elicitation.
So what is elicitation, exactly?
Elicitation is a conversation, not a hack. It's the process of getting an LLM or an agentic system to give up information or exercise capabilities that are meant to stay behind a safeguard — whether that safeguard is a policy, a design choice, or just the assumption that nobody would think to ask. That makes it a different animal to a jailbreak. A jailbreak is a blunt attempt to override a model's safety training in one go. Elicitation is slower and altogether more patient: framing a request as adjacent to something benign, building context over several turns, letting the conversation drift until the agent talks itself somewhere it would have refused to go if asked outright.
Against agentic systems specifically, this works uncomfortably well. Researchers have shown agents can be fully compromised through identity spoofing and social engineering alone, no code and no exploit required, just natural language — leading to sensitive data disclosure, unauthorised actions, and in some cases the agent's own governance controls being turned off from the inside. One of the most common patterns is almost embarrassingly simple: ask the agent to "help debug an authentication issue," and an agent that's trying to be helpful will happily print out the environment variables — hardcoded API keys and all — right there in the chat. Some researchers expect fully autonomous social engineering campaigns — reconnaissance, targeting, credential harvesting, exploitation — running start to finish without a human attacker anywhere in the loop before the year is out.
The bit that gets overlooked: this is an identity problem, not a wording problem
When elicitation gets discussed, it's usually framed as a prompt-engineering or AI-safety issue — something for the model team to patch with better guardrails. That misses what the attacker is actually after. Nobody wants the words in the transcript. They want what's behind them. Any agent that can debug a system, hit an API, or query a database is doing so with real credentials attached — it's a non-human identity (NHI), with its own keys, tokens and permissions, whether anyone thought of it that way or not. Elicitation is just the method for persuading that identity to hand its access to somebody who has no business having it.
If agent identities were rare, tightly scoped and closely watched, this would be a manageable nuisance. They're not, on any of those three counts. A few figures worth bearing in mind:
Non-human identities already outnumber human ones by around 45 to 1 across the average enterprise, and by 144 to 1 in cloud-native environments specifically — a ratio that's grown 56% in just a year.
Agent framework downloads are outstripping agent security tooling 83 to 1 on PyPI, a gap that widened by 41% in just the first five months of this year.
Ninety-two percent of organisations say their existing IAM tooling simply can't manage AI agent identities, and over 16% admit they aren't even tracking when new AI-related identities get created in the first place. And despite all that, only 22% of security teams treat AI agents as identities in their own right rather than folding them into existing service-account categories — even though a compromised agent credential's blast radius is nothing like a static service account's.
Older NHIs — service accounts, static API keys — were at least predictable. Fixed permissions, fixed lifecycle, auditable even when nobody actually bothered auditing them. Agentic identities don't play by those rules. An agent picks up permissions dynamically at runtime, spins up sub-agents, calls out to external tools, writes and runs its own code, and chains actions across systems that nobody explicitly signed off on. Identity governance, as most organisations practise it, was built for the predictable kind. It has no real answer for the dynamic kind — and elicitation is exactly the technique that exploits that blind spot. Don't bother attacking the infrastructure. Talk to the agent, and let its own access do the rest.
The real vulnerability is the governance lag
Every one of those figures is uncomfortable, but the one that matters most isn't a ratio — it's the gap between what organisations say and what they've actually done about it. Ninety-two percent agree that governing AI agents is critical to enterprise security. Just 44% have put any policy in place to do it. That gap is precisely where elicitation attacks live: agents with real, often over-generous access, nobody enforcing least privilege or rotating credentials or scoping permissions to a session, and nobody watching the conversation itself for the patterns that give elicitation away.
Closing that gap means treating agents as identities first and chat interfaces a distant second. A few places to start:
Get the inventory right before anything else. You can't govern what you haven't catalogued, so every agent, service account and token in the environment needs discovering and classifying before any policy gets written.
Scope access to the job at hand, not to whatever's convenient. An agent that can dump every environment variable while "debugging" was over-provisioned long before anybody tried to elicit anything from it. Least-privilege, time-bound, workflow-scoped access limits what a successful attempt can actually reach.
Watch the conversation, not just the credential. Unusual tool calls, odd data access, unexpected delegation to sub-agents — these are the tells that a static credential audit will never surface, because the compromise happens in language, not in a leaked key.
Give agent identities a lifecycle, the way you'd give a leaving employee one. Ephemeral and dynamically provisioned doesn't mean exempt from offboarding: credentials should expire, sub-agent permissions should get revoked, and access tied to a finished task shouldn't quietly linger.
Elicitation works because it's cheap, hard to pin down, and aimed at a target that most organisations haven't yet decided is theirs to govern. No amount of prompt filtering fixes that on its own. What actually closes the gap is doing the less glamorous work: bringing identity and access management up to speed with the fastest-growing population of identities most enterprises now have...