Finding 01
Planner commitment + tool-result feedback loop
The planner locks a high-level goal after an early benign tool call. Subsequent tool outputs are interpreted exclusively through that locked goal, allowing an attacker to drive privileged actions that never appear in any single user message.
Remediation
- —Introduce goal re-validation against current policy and user intent at every planner step.
- —Maintain an explicit "goal provenance" record that can be audited and forcibly reset.
- —Reject tool results that would expand the original goal beyond a narrow, pre-approved delta.
Finding 02
Memory summarizer omission of revocation events
The long-term memory compressor discards "permission revoked" markers as low-salience. Previously granted elevated tools remain usable in later sessions even after the live policy store has revoked them.
Remediation
- —Treat revocation and permission-change events as high-priority, non-compressible facts.
- —Force a policy re-evaluation against the live identity service before any elevated tool is re-invoked.
- —Add an explicit "revocation watermark" to every memory summary.
Finding 03
Cross-tool state hand-off via temporary artifacts
A sandboxed code tool writes short-lived credentials or paths into a shared scratch location. A later unconstrained retrieval or browser tool silently re-uses those artifacts because the planner treats all prior tool outputs as trusted context.
Remediation
- —Isolate scratch namespaces per tool invocation and per session.
- —Prohibit automatic promotion of tool-generated paths or secrets into the planner's working set.
- —Require explicit, policy-checked hand-off of any inter-tool state.
Finding 04
RAG embedding drift under adversarial pressure
Repeated queries that nudge the retrieval distribution toward a neighbouring tenant's document cluster gradually shift top-k results across the tenant boundary without any individual query appearing anomalous.
Remediation
- —Enforce hard tenant filters at both embedding and ranking stages (not only post-retrieval).
- —Monitor embedding-space drift metrics per tenant and alert on sustained movement toward foreign clusters.
- —Periodically re-index with tenant-specific orthogonalisation or namespace separation.
Finding 05
Permission boundary collapse through intermediate analysis tools
Low-privilege summarisation or schema-inspection tools return structured metadata that the planner later treats as authorisation tokens for higher-privilege write tools.
Remediation
- —Strip or cryptographically bind any "capability-like" metadata returned by low-privilege tools.
- —Require a fresh, explicit authorisation decision for every privilege transition.
- —Maintain a strict separation between "observation" and "authorisation" data types inside the planner.
Finding 06
Session-isolation failure under concurrent memory compaction
When two tenants trigger simultaneous long-context compaction, the shared vector-store write path can interleave summary vectors, causing one tenant's later retrieval to surface fragments of another's conversation.
Remediation
- —Serialise or strongly isolate compaction writes per tenant.
- —Use tenant-prefixed keys and transactional writes for all memory mutations.
- —Add post-compaction integrity checks that verify no foreign vectors were introduced.
Finding 07
Tool-output instruction smuggling past output filters
Carefully crafted tool responses embed natural-language directives phrased as "observations." These survive post-tool sanitisation and are later promoted by the planner into the next action plan.
Remediation
- —Apply a second, planner-aware filter that distinguishes observational content from directive content.
- —Require tool outputs to be strictly typed and reject free-form natural language that contains imperative constructions.
- —Log and rate-limit any tool output that influences subsequent planning.
Finding 08
Sandbox path canonicalization mismatch
The code-execution sandbox and a subsequent file-system tool resolve the same relative paths differently, enabling directory escape only when both tools are invoked in sequence.
Remediation
- —Enforce a single, shared path-canonicalisation library across all tools.
- —Resolve and re-validate every path against the original sandbox root before any follow-on tool executes.
- —Prefer capability-based file handles over string paths for inter-tool references.
Finding 09
Persistent planner bias from early RAG poisoning
An attacker seeds a low-privilege document that the first retrieval pulls in. The planner's goal-decomposition step internalises that framing, so later high-privilege decisions inherit the poisoned context even after the document is removed.
Remediation
- —Bound the influence of any single retrieval on goal decomposition (e.g., relevance and recency decay).
- —Periodically re-ground the planner against a trusted system prompt and current policy.
- —Maintain an auditable "context provenance" chain that can be pruned.
Finding 10
Credential lifetime mismatch between tools
An authentication tool returns a short-lived token that is cached in working memory. A later network tool re-uses the cached token after formal expiry because the memory layer never re-validates against the live identity service.
Remediation
- —Attach absolute expiry metadata to every credential and enforce re-validation before use.
- —Prefer just-in-time token acquisition over long-lived caching inside the agent.
- —Instrument token-use events for anomaly detection (use-after-expiry).
Finding 11
Multi-hop exfiltration via helpfulness + summarisation chain
The agent is steered into retrieving internal configuration under a legitimate-sounding diagnostic query, then asked to "summarise for the user." The summariser strips original access-control labels, converting an authorised internal lookup into an external disclosure.
Remediation
- —Propagate and respect original ACLs through every summarisation and rewriting step.
- —Require an explicit external-disclosure authorisation check before any internal data leaves the trust boundary.
- —Redact or refuse to summarise content whose source ACL would not permit the current principal to view it externally.