The Anatomy of a Modern Agentic Attack

01 · Evidence standard: what the sources prove

A support assistant reads a ticket. Triage turns it into a summary. A diagnostic tool runs under a workload identity. Somewhere along that path, an untrusted user's statement becomes an instruction executed with somebody else's authority. The dangerous event is not the sentence. It is the authorization boundary that accepted it.

KAOS doctrine: model output is not system action. Every real action crosses an execution, identity and authorization boundary.

“Agentic attack” covers two problems: an adversary using an agent to accelerate conventional intrusions, and an adversary manipulating a legitimate agentic application's inputs, memory, delegation or tools. They can combine, but evidence for one does not automatically prove the other.

A reported campaign—not a universal benchmark

In November 2025, Anthropic reported an AI-orchestrated espionage campaign against roughly thirty targets, with a small number of successful compromises. It attributed the activity to a Chinese state-sponsored actor and estimated AI performed 80–90% of the campaign with intermittent human decisions. It also reported fabricated credentials and overstated findings. These are provider observations, not independently reproduced measurements for every agent. Its corrected tempo description is thousands of requests overall, often multiple per second. Anthropic report and correction.

That supports investigating tool-enabled operations. It does not establish that high token input, fast bursts or MCP connections identify an attacker. Legitimate indexers can produce all three; malicious workflows can proceed slowly. The following is a synthetic K8SEC assessment scenario, not an undocumented reconstruction of that campaign.

02 · Execution architecture: expand the boundary map

Agents may use planning loops, fixed workflows, event-driven orchestration or delegated agents. Do not assume every product implements ReAct. Do not request hidden chain-of-thought as security evidence: capture the observable input, declared tool call, policy decision, executor identity, target effect and persistence.

03 · A conditional chain: support ticket to infrastructure action

Starting position: a low-privilege customer can create a ticket in an isolated test tenant. Support retrieves it, hands a summary to triage and requests an allowlisted diagnostic. The intended grant is “read this tenant's diagnostic summary.” The attempted deviation is another tenant's result or a more privileged action.

No production secrets or third-party targets are needed. Each transition below is conditional. Stop the finding at the first independently enforced denial.

The origin is application input. Impact may remain in the application, reach a container process or cross into cluster authorization. Host and cloud access require additional routes. No arrow automatically means cluster-admin.

04 · MCP, RAG and delegation: enforce the real contract

Remote MCP is not merely stdio over the internet

For HTTP-based MCP, validate tokens for the intended resource and enforce the tool's operation and object permissions. Preserve session ownership and per-client/user consent. Do not accept a downstream token as a shortcut or forward an incoming credential to another audience. Transport authorization does not implement your tenant checks automatically. Versioned MCP authorization specification.

OAuth discovery is also an outbound-fetch surface: validate destinations, redirects and resolved addresses under an explicit egress policy. Session IDs do not replace authentication. Local stdio servers have a separate process and credential boundary. MCP security guidance.

RAG integrity has four distinct controls

Runner hardening is more than shell=False

Use fixed executable mappings and allowlisted structured arguments. Avoid shell interpolation, but also reject dangerous flags, unapproved paths and unsafe executable selection. Canonicalize paths, constrain time/output and network access, and remove unnecessary credentials. A read-only filesystem does not prevent data reads or network abuse.

05 · Measure proposals and effects separately

Record model/provider version, tool schema hash, policy revision, prompt/template and dataset revisions, sampling settings, session state, call budget and timeouts. Test a normal task, an adversarial variant and a corrected-control variant while preserving allowed functionality. Keep credentials and private content out of the dataset.

Report aborted, timed-out and instrumentation-failed trials separately. Show raw counts, repeated trials and uncertainty, not only a success percentage. Repeating one chosen example does not establish broad coverage. Retain negative outcomes rather than cherry-picking impressive screenshots.

A reproducible offline exercise

Implementation note: this exercise tests an evidence correlator with synthetic records. It does not run a live model, execute MCP calls or demonstrate exploitation. Predetermined fixtures validate logic, not model susceptibility.

Download the correlator · JavaScript module · v1.0.0 and the synthetic trace · JSON · v1.0.0 into one directory. Node.js 22+ is sufficient; no credentials or network are needed.

bashnode --input-type=module <<'JS'
import {readFile} from "node:fs/promises";
import {correlate} from "./agent-evidence-v1.mjs";
const events=JSON.parse(await readFile("agent-evidence-fixture-v1.json","utf8"));
for(const row of correlate(events)) console.log(row.run_id+": "+row.signal);
JS

expected synthetic outputsynthetic-run-01: denied-no-observed-effect
synthetic-run-02: effect-after-denial

Both runs reuse a call ID; correlation includes run and call to avoid joining unrelated sessions. A denied proposal without an observed effect is distinct from one followed by a target-side effect. Fixtures cover missing records, duplicate stages, malformed fields, actor/resource changes, reversed timestamps and slow activity.

Here subject is a normalized effective principal from trusted telemetry, not a model-provided identity. Real systems should retain initiating user, delegator and executor separately and join them through delegation records. A subject change is a review signal; legitimate delegation is one possible explanation.

06 · Build an evidence chain the model cannot invent

Capture request/run/call IDs, authenticated subject, tenant, canonical resource, policy decision/version, executor reference, timestamps and sanitized results. Independently collect target actions and authorization outcomes. Protect exports from the investigated workload, synchronize clocks and preserve integrity metadata. Hashes only help when the expected hash is trusted.

A metadata-only Kubernetes triage query

Use an authorized JSON-lines audit export with Metadata-level coverage of Secrets, pod exec and RBAC. Do not enable Secret body logging to support this filter. A denied API call is a denied attempt; a successful exec connection still needs runtime evidence of the command. Kubernetes audit reference.

bashjq -c '
  select(.stage == "ResponseComplete" or .stage == "ResponseStarted")
  | select((.user.username // "") | startswith("system:serviceaccount:"))
  | select(.objectRef.resource == "secrets"
      or .objectRef.subresource == "exec"
      or .objectRef.apiGroup == "rbac.authorization.k8s.io")
  | {auditID,time:.requestReceivedTimestamp,actor:.user.username,verb,
     resource:.objectRef.resource,subresource:.objectRef.subresource,
     namespace:.objectRef.namespace,name:.objectRef.name,
     status:.responseStatus.code}
' audit.jsonl

The correlator trusts producers; it does not authenticate logs or determine business scope. Missing stages remain gaps. Duplicates stop evaluation and must be deduplicated by trusted event IDs. Reversed timestamps are flagged, not treated as causal proof. Production systems need explicit delegation mappings, bounded retention, replay handling and tamper-resistant storage.

MITRE ATT&CK: use T1552.001 — Credentials In Files only for evidenced credential-file access; T1609 — Container Administration Command for actual container administration; T1078 — Valid Accounts for demonstrated credential use. Prompt injection alone does not prove these downstream behaviors.

07 · Break the path without breaking the allowed workflow

Contain the narrowest proven route: suspend the affected tool/identity, restrict its destination and preserve evidence before cleanup. Record the prior configuration and approved rollback or roll-forward plan. Do not disable a production controller from one anomaly. Rotate established credential exposures from a trusted administration channel; patching an input path does not invalidate copied tokens.

Permanent controls belong in the API, tool, job consumer, memory store and workload identity. Projected token audience, expiry and object binding affect usability. A token-shaped string is not an authorization result. ServiceAccount administration.

Read-only authority review

These checks assess the current identity, not the agent's. The namespace is an assessment example, not a public target. Use approved administrative impersonation separately if authorized; never extract production tokens as a shortcut.

bashkubectl auth can-i create pods/exec -n kaos-review
kubectl auth can-i get secrets -n kaos-review
kubectl auth can-i create pods -n kaos-review
kubectl auth can-i bind clusterroles.rbac.authorization.k8s.io
kubectl auth can-i escalate clusterroles.rbac.authorization.k8s.io

This checklist is browser-only and resets on reload; it is not an assessment result.

08 · Final word: follow authority, not the story

Primary sources and verification trail

Campaign observations are attributed to Anthropic; protocol and Kubernetes claims link to official sources above. Reviewed September 16, 2026. The conditional scenario, metrics and synthetic trace are K8SEC analysis. Reference JavaScript has fixture tests; shell examples receive syntax validation. No live-model benchmark or real compromise is claimed. Offensive validation belongs only in explicitly authorized isolated environments.