← Research

AI-Agentic Threat Landscape — curated brief

2026-10-22 · research note · 6 min read

Date: 2026-10-22 · Status: first-pass research baseline for the lab's research agenda. All claims link primary sources; items marked (unverified) lack a primary source and are excluded from detection content until confirmed.

1. The Poppy Personal Agent Protocol (new attack surface)

Announced 2026-10-06 by Sierra + Meta. An open draft standard for how a personal AI agent discovers, authenticates to, and transacts with businesses on a user's behalf — the identity/consent/session layer around A2A commerce. MCP (tools) and Google's A2A (agent messaging) sit underneath; rival protocol PACT (Decagon + Instinct, same-day) is built directly on A2A + OAuth 2.0.

• Spec (draft 0.2): https://personalagentprotocol.org/docs/spec · repo: https://github.com/personal-agent-protocol/personal-agent-protocol
• Detection artifacts standardized by the spec: /.well-known/poppy.json discovery, short-lived JWT Session Tokens with poppy:read/poppy:write scopes, DPoP proofs (ES256), A2A conversation legs with human-vs-agent speaker declarations, OpenAPI 3.1 + MCP interfaces.
• Live controversy: Mediated Sign-In (§4.7) has the agent transmit the user's own credentials; OAuth spec author Aaron Parecki filed issue #35 (2026-10-21) to remove it as an RFC 9700 violation. Spec §9 (added 2026-10-16) threat-models cross-company indirect prompt injection and token exfiltration from model context.
• Adoption reality: 45+ named partners vs. 5 valid poppy.json files in an Oct 19 scan of 24,577 domains (independent tracker poppy.md). First-mover detection research opportunity.

2. Agentic attack teams — documented operations

3. Autonomous offense — commercial & benchmark milestones

• XBOW: first AI atop HackerOne's US leaderboard (2025-06, ~1,060 reports); $120M Series C at $1B+ (2026-03). https://xbow.com/blog/series-b
• RunSybil (OpenAI's first security hire): $40M (Khosla, 2026-03). DARPA AIxCC: $4M winner at DEF CON 33; finalist CRSs open-sourced.
• Research frontier: UIUC HPTSA — teams of agents exploit real zero-days (arXiv:2406.01637, EACL 2026); Stanford/CMU/GraySwan ARTEMIS beat 9/10 professional pentesters at ~$18/hr (arXiv:2512.09882, ICLR 2026); UIUC one-day exploitation at ~$8.80/CVE (arXiv:2404.08144).

4. Detection gap — what exists vs. what doesn't

Exists: ATR (Agent Threat Rules) — 823 rules, adopted by Microsoft/Cisco/PyRIT; Splunk's five AI analytic stories (Bedrock anti-forensics, Ollama, local LLM frameworks); Elastic GenAI rule family; Microsoft Defender AI-agent detections (preview). MITRE ATLAS v2026.09: 16 tactics/120 techniques, agentic IDs AML.T0053/T0086/T0110.x, autonomous-attacker set AML.T0116–T0124, mitigations M0024 AI Telemetry Logging and M0039 AI Honeypots.

Doesn't exist (our niche):

• Sigma-native AI-agent rules — SigmaHQ has effectively none (verified 2026-10-22).
• Detections for CSA-proposed techniques AML.T0090–T0095: A2A lateral movement (T0090), MCP server compromise (T0095), orchestrator hijacking (T0092), delegation-chain credential relay (T0093), cross-session memory persistence (T0094), tool-chain poisoning (T0091). https://labs.cloudsecurityalliance.org/agentic/csa-research-note-atlas-agentic-gap-analysis-20260327/
• Any A2A/Poppy honeypot or interaction dataset (SSH and Ollama honeypots exist: Palisade Research arXiv:2410.13919; DTU Ollure arXiv:2609.29757; cerebral-work/mcp-honeypot).
• Honest FP-rate measurement (ATR publicly retracted its own flawed FP metrics — the evaluation infrastructure is immature).

Credible gap statements: CSA (2026-04) — 92% lack visibility into AI agent identities, 95% doubt they could detect a compromised agent. Unit 42 — defenses "weren't built for machine-speed attacks." arXiv 2609.35659 — no LLM observability platform addresses security auditing.

5. Lab-relevant tooling (benign adversary & eval)

HackingBuddyGPT (MIT, range adversary), NVIDIA garak, Microsoft PyRIT, Dreadnode AIRTBench, Strix, ARTEMIS scaffold; benchmarks Cybench, CVE-Bench, AgentDojo, BountyBench, AutoPenBench; sandbox canon https://github.com/bureado/awesome-agent-runtime-security.

6. Open questions to re-verify (2026-11)

• Poppy draft 0.3: fate of Mediated Sign-In (issue #35); reference implementation release.
• POPPI-as-offensive-project: no public evidence; if a source surfaces, reassess scope.
• Sysdig "JADEPUFFER" fully-autonomous ransomware and Unit 42 "<10 h, 50+ techniques" case — single low-quality aggregator (unverified).
• GPT-6 Astra / Mythos 5 capability claims from secondary blogs (unverified).

7. Addendum 2026-10-23 — Project Black: EDR bypass with local AI

Source: projectblack.io/blog/bypassing-edr-with-local-ai — authorized pentest lab research (AU).

• Technique: commercial models (Claude Opus 5 / 4.8 / Sonnet 5) refuse LSASS-dumper requests even from a Cyber Verification Program-approved account. An open-weight model (DeepSeek v4 Flash) complied but produced detected code. An uncensored Qwen 3.8 27B (community guardrail-removed finetune, self-hosted on a 2×RTX 4090 rig) iteratively produced a fully undetected LSASS dump tool against two commercial EDRs with minimal human input.
• AI-applied evasion edits: less-suspicious process spawning, reduced access masks, randomized sleeps during minidump build, changed output path/naming, scrubbed embedded strings.
• Detection implications: per-generation polymorphism kills signature/tool-hash detection; behavior remains OS-constrained (LSASS access, minidump write, cloning APIs) so behavioral rules survive AI authoring. Endpoint signal worth adding to the catalog: local inference server present on the endpoint (new Sigma rules win_local_llm_inference_server / linux_local_llm_inference_server) — Splunk shipped an equivalent story in May 2026, Sigma-native content was missing.
• Lab relevance: validates the local-model adversary tier (phase 1) — commercial APIs gate even authorized emulation; self-hosted open-weight models do not. Also a cautionary supply-chain note: community "uncensored" weights must be treated as untrusted artifacts (verify base-model provenance, safetensors-only, hash-pin, detonate-tier scan) before the lab runs them.