Feeding the Monster: The New Cybersecurity Threat Hiding in Your Data Lakes

Organizations are dumping millions of internal documents, customer emails, and operational logs into massive enterprise data lakes, creating a rich knowledge base for automation.

Because AI systems need vast quantities of information in order to learn and perform tasks, the data lake functions as a “digital stomach”, constantly digesting corporate data to feed the needs of the enterprise. 

Security strategies for data lake environments focus heavily on data loss prevention and strict perimeter controls.

As a result, data lakes are often seen as highly secure internal vaults. Teams operate under the assumption that information inside the corporate boundary is inherently trustworthy, and that any threat must come from an outsider trying to break in and steal the information.

However, the deep trust surrounding the security of stored data creates unseen vulnerabilities across a given enterprise. Attackers currently are exploiting a vector, known as indirect prompt injection attacks, allowing adversaries to hijack autonomous workflows by turning trusted data repositories against themselves. 

How Are Attackers Leveraging Indirect Prompt Injection? 

The exploit relies on the insertion of simple, plain-text commands into routine external files, like customer service tickets, partner profiles, or public vendor resumes. Once the organization pulls the files into the enterprise data lake, the hidden text sits in the repository, stealthily operating as a silent logic bomb waiting to explode. 

The moment that an AI agent queries the data lake to gather context required to complete a business task, the exploit triggers. As the system reads the corrupted data to answer a query, it can’t separate the safe background information from the malicious execution instructions. Consequently, the AI processes the exploit as a legitimate command, executing the hidden instructions while simultaneously overriding its own internal engineering parameters.

Example: The Manus Vulnerability (September 2026)

In September 2026, researchers at Salt Labs exposed a vulnerability in Manus, a fast-growing agentic AI platform. By sending a Manus user a routine email containing hidden payload instructions, the researchers weaponized the agent during a simple context-retrieval task.

The hidden instructions relied on an obscure JavaScript obfuscation technique to evade Manus's security filters. Once Manus processed the email text, the payload executed, opening remote code execution capabilities and establishing a reverse shell inside the user's environment.

From there, the exploit harvested authentication tokens and API keys for every third-party application connected to the account, including Gmail, Dropbox, and GitHub.

Because the attack traveled through a routine email-processing workflow, it slipped past standard security filters and extracted the user's access keys without triggering a single alarm.

How Can Organizations Protect AI Agents From Poisoned Data Lake Exploits?

When a compromised AI agent reads a poisoned file within the data lake, it utilizes legitimate, pre-authorized system permissions to interact with internal databases and APIs. Because such interactions occur within normal operational parameters, traditional tooling renders the entire event as benign.

Standard security information and event management (SIEM) systems and data warehouses are designed to track deterministic, code-based execution paths, flag known malware signatures, or identify unauthorized user logins. But relying on static, post-incident data-at-rest auditing creates a temporal lag.

By the time that a corrupted file is ingested, indexed, and eventually flagged by a scheduled security scan or manual threat hunt, an autonomous agent operating at machine speed may have already executed hundreds of unauthorized actions.

If the enterprise data lake is treated as a passive, trusted vault rather than a dynamic and potentially hostile input channel, security teams will remain unable to stop automated, prompt injection attacks as they unfold.

Establishing real-time defense against machine-speed prompt injection attacks requires continuous inspection of the active communications passing between autonomous agents, corporate data fabrics, and large language models.

Rather than attempting to pre-screen petabytes of incoming unstructured text for every possible variation of natural language manipulation, security infrastructure must map micro-deviations in system behavior at line rate across the entire communication fabric.

ExtraHop utilizes real-time network telemetry and decryption to detect behavioral anomalies caused by poisoned data lake files. Network observability resolves visibility gaps that traditional database logs miss by monitoring active communications before data reaches passive security warehouses.

When a poisoned data lake file triggers an operational hijack, ExtraHop’s cloud-scale machine learning identifies the behavioral anomaly and live network telemetry provides the immediate, high-fidelity intelligence required to trigger automated orchestration playbooks, enabling security teams to isolate compromised agents. 

For more on how threat actors are exploiting poisoned repositories and other AI infrastructure blind spots, read 3 Ways Threat Actors Are Exploiting AI Infrastructure.