Topics

Agent authority

The permissions and control boundaries that determine what an agent can actually cause outside the model.

306 explicit connections

pattern

Agent execution evidence triangulation

Model outputs, monitor transcripts, deployment manifests and observed host events answer different questions; none alone proves what an agent was authorized to run or what effects completed.

39 explicit connections

pattern

Agent isolation requires bounding indirect outbound authority through allowed services

Allowlisting one egress service is insufficient when the service can itself request external URLs, return sensitive data or relay content on the caller's behalf.

9 explicit connections

pattern

Agent package lifecycle scripts can persistently rewrite tool and memory authority

Installing a development package can alter global agent memory, tool registration or content telemetry for future sessions without a separate authorization decision.

6 explicit connections

pattern

Agent report-state recoverability

The extent to which a supervisor can reconstruct consequential execution facts from an agent's ordinary status reports rather than its complete tool and reasoning trace.

6 explicit connections

Agent spam and unintended public writes

Agents use public services in ways outside the intended task, including writing, coordination or creating persistent artifacts.

6 explicit connections

pattern

Agent-enabled software supply-chain attack

AI agents or AI-assisted operators target package repositories, source-control review or software distribution paths.

76 explicit connections

pattern

Agentic ransomware

Ransomware/extortion workflows in which an AI agent executes multiple operational stages rather than only generating advice or code.

4 explicit connections

AI audit context completeness

An AI auditor can confuse code absent from its input with a security check absent from the system, or miss a flaw whose evidence spans components.

12 explicit connections

pattern

AI credentials as loot, compute and cover

Stolen AI API keys or authenticated sessions can be resold, used to fund attacker workloads and shift attribution onto the legitimate owner.

15 explicit connections

pattern

AI provider concentration risk

AI concentration risk has at least two layers that should not be collapsed. Market concentration means governments or organizations depend on a small set of frontier-model providers they may not be able to independently evaluate, switch away from quickly, or protect from home-jurisdiction constraints. Operational concentration means critical services also depend on cloud providers, suppliers, software supply chains and shared infrastructure. RAND's mitigations - evaluation access, information sharing, exit provisions, multiple model families and selective domestic or allied capability - reduce lock-in and improve optionality, but RAND explicitly treats procurement as bounded because governments may lack enough leverage and legal or information asymmetries remain. FCA's evidence is adjacent rather than a market-share study: it shows that dependency mapping, supplier preparedness, guardrails and human expertise determine whether AI-enabled operations remain resilient.

5 explicit connections

Autonomous cyber operations

Multi-step offensive workflows where AI executes or orchestrates reconnaissance, exploitation, persistence or exfiltration with limited human intervention.

45 explicit connections

pattern

Context privilege escalation

Agent-harness attacks in which lower-trust repository or workspace context gains higher instruction priority and changes tool/review behavior.

14 explicit connections

Cross-session authorization

Authorization controls that bind asynchronous jobs, messages or results to the client or session that created them.

17 explicit connections

pattern

Deceptive AI personas

AI-operated identities are presented as real people in order to sustain a commercial or social deception.

1 explicit connection

pattern

Effect-bound approval

An agent approval is valid for one exact action and destination, not an editable description of what will happen.

17 explicit connections

Endpoint identity binding in AI-assisted trust decisions

A model can retrieve a true fact about an organization, product or partnership but bind that trust to the wrong domain, package, contract or other actionable endpoint.

8 explicit connections

Evaluation containment

Isolation, egress control and monitoring around high-capability model evaluations.

60 explicit connections

pattern

Executable exploit synthesis

Turning a vulnerability hypothesis into executable exploit code and a validated state-changing test.

22 explicit connections

pattern

Forensic rationalization of a detected malicious mechanism

An AI analyst identifies the harmful mechanism in an untrusted artifact but interprets it as benign, often because the artifact supplies a credible-looking explanation.

2 explicit connections