A healthcare AI pipeline uses a data retrieval agent (queries patient records) that returns results to an analysis agent over an internal HTTP connection without TLS — justified as "internal traffic." A network-level attacker who had gained access to the cloud VPC through a misconfigured security group had set up a passive listener on the subnet the agents shared.

For three weeks, every patient query result — including names, diagnoses, medication lists, and appointment history — was readable in plaintext as it transited between the retrieval agent and the analysis agent. The patients, the healthcare provider, and both agents were entirely unaware. No agent was compromised. No message was tampered with. The attack was purely passive: eavesdropping on a channel the system designers believed was "internal" and therefore safe.

The regulatory consequence: Under HIPAA, the PHI exposure was a reportable breach — regardless of whether the attacker actively exploited the data. Transmitting protected health information over an unencrypted internal channel is a compliance violation independent of the security outcome.

A content moderation pipeline uses an AWS SQS queue: a classification agent publishes tasks, and moderation agents consume them. A Lambda function deployed by a developer for testing was granted full SQS permissions on the queue — and was never cleaned up after the test ended.

An attacker who compromised the test Lambda's IAM credentials used them to publish messages directly to the moderation queue: {"action": "approve_content", "content_id": "batch_12345", "override_reason": "expedited review"}. The moderation agents consumed these tasks identically to legitimate ones. Hundreds of pieces of content that would have been flagged were approved without actual review.

The access control failure: The queue had no mechanism to verify that messages came only from the authorized classification agent. Any entity with SQS SendMessage permission on the queue could inject tasks. The fix requires both removing overpermissioned credentials and adding queue-level access policy restrictions.