Program

Generative attack

One adversary, one estate, one night. Every surface the agent reads — alert bodies, tool manifests, follow-up prompts — is machine-generated against you. The path walks the five phases of that shift in order and ends with the whole thing played and graded.

The shift, phase by phase

1. 1 · The queue turns hostile

   Alert volume triples. The bodies are well-written, internally consistent, and several of them address the agent directly with next steps.

   Treat every alert body as untrusted content. Confirm the agent's context boundary holds when the text tells it what to do.

   • ag-alert-injection
   • ag-memory-contamination
   • a-210

   ATT&CK: T1566 · T1204.002 · T1059

2. 2 · A helpful new tool appears

   A tool the catalog has not seen before advertises itself as an internal enrichment helper, with a description written to make the agent prefer it.

   Refuse to let catalog membership imply trust. Pin the manifest, check provenance, and keep unknown tools out of the automated path.

   • ag-tool-poisoning
   • ag-namespace-squat
   • ag-registry-integrity
   • mcp-f2-harden-poisoned

   ATT&CK: T1195.002 · T1554

3. 3 · One token, every door

   The agent's calls start reaching further than the case it was working — a different tenant's record, then an egress path that resolves somewhere it should not.

   Audience-scope the token, keep tenancy checks server-side, and stop the agent's network boundary being decided by DNS.

   • ag-token-audience
   • ag-confused-deputy
   • ag-cross-tenant-state
   • ag-discovery-ssrf
   • ag-dns-rebinding

   ATT&CK: T1528 · T1550.001

4. 4 · The approval that would cost the estate

   Under queue pressure the agent proposes a site-wide containment action, framed as routine and pre-justified.

   Hold it. Approve routine work, refuse the action with blast radius, and make the ceiling a policy rather than a decision you re-take every time.

   • ag-blast-radius
   • ag-cost-exhaustion
   • ag-elicitation-abuse
   • ag-data-exfiltration

   ATT&CK: T1489 · T1531

5. 5 · The morning after

   The incident review asks which tool produced each claim in the agent's write-up, and whether anything it learned tonight should be trusted tomorrow.

   Produce lineage for every assertion and quarantine the memory the hostile shift wrote. An unexplainable claim is a failed shift.

   • ag-lineage-gap
   • ag-shadow-discovery
   • mcp-f3-adversarial-runner

   ATT&CK: T1070 · T1562.008

Progression path

1. 1 · The queue turns hostile

   Generated alert bodies that read like operator instructions, and the memory they leave behind. Content the agent reads is not instruction.

   • ag-alert-injectionThe alert that gives orders40 min
   • ag-memory-contaminationThe note that outlives the shift40 min
   • a-210Prompt injection in an alert body40 min

2. 2 · A helpful new tool appears

   The catalog is a supply chain. Descriptions, names and builds are all attacker-writable, and membership is not provenance.

   • ag-tool-poisoningThe helpful new tool35 min
   • ag-namespace-squatTwo servers, one name35 min
   • ag-registry-integritySame entry, different build35 min
   • mcp-f2-harden-poisonedRewrite the poisoned manifest35 min

3. 3 · One token, every door

   Who the agent is when it calls a tool, whose data it can reach, and where its egress actually resolves.

   • ag-token-audienceOne token, every door40 min
   • ag-confused-deputyOne credential, three agents35 min
   • ag-cross-tenant-stateThe case one number down35 min
   • ag-discovery-ssrfThe well-known redirect40 min
   • ag-dns-rebindingThe header says it is us40 min

4. 4 · The approval that would cost the estate

   Blast radius, spend and elicitation: make the ceiling a policy instead of a decision you re-take under pressure.

   • ag-blast-radiusContain the site35 min
   • ag-cost-exhaustionFourteen lookups a minute30 min
   • ag-elicitation-abuseSession expired30 min
   • ag-data-exfiltrationThe brief that took the credentials with it35 min

5. 5 · The morning after

   Lineage for every claim, quarantine for the memory the hostile shift wrote, and the adversarial suite run end to end.

   • ag-lineage-gapWhich tool said that?35 min
   • ag-shadow-discoveryNobody filed a ticket for it35 min
   • mcp-f3-adversarial-runnerSurvive the whole suite45 min

6. 6 · The whole shift, graded

   All five phases at once at Northwind Logistics, played headlessly and graded phase by phase.

   • ag-l20-full-shiftThe whole shift, both chairs75 min

7. 7 · Enterprise scale

   Unlocked once the five phases are proven: the monitoring that keeps proving autonomy between shifts, the review that changes a control, and an independent assurance pass.

   • cmp-201Continuous control monitoring, honestly45 min
   • ir-301The review that changes something60 min
   • dr-405Northwind assurance pass90 min

NICE mapping

Work roles: Defensive Cybersecurity · Incident Response · Threat Analysis

• cap.ai-security AI and agent security
• cap.incident-triage Incident triage
• cap.response-automation Response automation
• cap.control-assurance Control assurance
• cap.evidence-handling Evidence handling
• cap.threat-hunting Threat hunting
• cap.detection-engineering Detection engineering
• cap.audit-evidence Audit and control evidence
• cap.risk-governance Risk and policy governance