Beyond Behavioural Trust: The Shift to Architectural Certainty in Agentic AI at 12:54 AM

Research briefing — Agentic AI security and enterprise architecture

Beyond Behavioural Trust: The Shift to Architectural Certainty in Agentic AI

01

The "Vibe Coding" Hangover and the Autonomous Reality

The enterprise is currently emerging from the "Vibe Coding" era, a period characterised by the use of LLMs as stochastic parrots for low-stakes, probabilistic content generation. In this experimental phase, security was largely a matter of monitoring chat logs. However, we have transitioned into the "Autonomous Reality," where agents are no longer passive advisors but active participants in the enterprise stack. These agents possess the capability to read, write, and execute across production directories, databases, and APIs.

The strategic importance of this shift cannot be overstated: it represents a leap in productivity, but it fundamentally shatters current security perimeters. As agents move from reading data to executing multi-step tool chains, the trust model must shift. Relying on "model alignment" to prevent unauthorised actions is a category error. As agents gain agency, our current security mental models, rooted in human-centric sessions, are no longer just outdated; they are an invitation to systemic compromise.

02

The Authorisation Gap: Why Traditional IAM Fails the Agent

The central failure in contemporary agent deployment is the "Authorisation Gap." Traditional Identity and Access Management (IAM) and Privileged Access Management (PAM) are designed for deterministic software paths. Proving an identity (Authentication) is insufficient when the entity's execution logic is non-deterministic and calculated on the fly.

To formalise this, we must view the agent's state as a Partially Observable Markov Decision Process (POMDP). The internal context of an agent at step is defined as:

c_i,t​=(p_i​,d_i,t​,k,h_i,t​,P_i​)

where is the prompt, represents untrusted external observations (files/tool outputs), is system knowledge, is history, and is the active execution plan. In an adversarial plan injection, an attacker introduces a perturbation into the context substrate (via poisoned data), yielding a corrupted context:

c∗=(p_i​,d_i,t​,k,h_i,t​,P_i​⊕δP​)

Because the model maximises action probability conditioned on this corrupted state, it executes the malicious plan δP as a legitimate directive.

Traditional software authorisation	Autonomous agent logic
Deterministic: Paths are predefined in code during provisioning.	Calculated on the fly: Actions generated at runtime based on context.
Stable handshake: Authentication translates to a predictable profile.	Dynamic chaining: Multi-step operations over extended horizons.
Static entitlements: Permissions remain constant per session.	Non-deterministic: Logic changes based on ingested untrusted data.

When an agent inherits a human's full permission set, model hallucinations or prompt injections lead to "catastrophic, unreviewed side effects." This includes unauthorised database writes, exfiltration of GITHUB_TOKEN via CI/CD runners, or the destruction of production infrastructure. This gap exists because the control plane and data plane have collapsed into a single, vulnerable context window.

03

The Framework Illusion: NIST, MITRE, and the Empty Promise of Compliance

Organisations frequently fall for the "Framework Illusion," believing that alignment with a single standard constitutes security. In reality, picking one framework creates predictable gaps.

The AI security framework matrix

Framework	Primary axis	Level	Enforcement layer	The "runtime gap"
NIST AI RMF	Governance & risk process	Organisational	Process / policy	Satisfied entirely through documentation; lacks any runtime enforcement.
MITRE ATLAS	Adversary TTPs	Threat intel	Detection / defense	Describes attacker behaviour but omits defender architecture.
OWASP (LLM/Agentic/MCP)	Vulnerability taxonomy	Protocol / layer	Application / system	Names vulnerabilities but does not prescribe implementation.

A "NIST-only" strategy is a governance failure. An organisation can be fully NIST-aligned while their agents make ungoverned tool calls to production databases with sero audit trail. These frameworks are maps, not shields. The missing layer is the deterministic runtime infrastructure.

04

Anatomy of a Sero-Click Kill Chain: Deconstructing the MCP and RCE

The Model Context Protocol (MCP) has introduced severe architectural vulnerabilities. Specifically, the protocol allows bidirectional sampling where an external MCP server can request model completions via the sampling/createMessage method. Without origin authentication, a malicious server can use the "user" role to inject prompts directly into the host LLM.

The sero-click RCE kill chain

1. Malicious instruction delivery: An attacker embeds an indirect prompt injection in a file (e.g., README.md or a source code comment).
2. Binary planting: The agent, manipulated by the injection, uses a file-write tool to plant a malicious executable (e.g., a payload-carrying npx.exe) in the project root.
3. Unsafe execution trigger: On the next routine command, the system resolves the binary. On Windows, the "Relative Binary Resolution" flaw prioritises the Current Working Directory (CWD) over C:\Windows\System32, executing the malicious code with the user's full OS privileges.

This is exemplified by CVE-2026-10591 (CVSS: 8.8 High), where workspace configuration poisoning allowed agents to write to .vscode/tasks.json, triggering arbitrary command execution upon opening a folder. Furthermore, the "GitInject" vector proves that malicious configuration files like CLAUDE.md or AGENTS.md are parsed before code evaluation in CI/CD pipelines, allowing for the silent exfiltration of environment secrets.

05

The "No-Read" Principle: Implementing Execute-Only Agents (XOA)

To move from probabilistic trust to architectural certainty, we must adopt the Execute-Only Agent (XOA) paradigm. This is a move from trying to build "safer" models to building a system that is safe even when the AI is successfully manipulated.

XOA is built on two core principles

1. The No-Read Principle: The LLM never observes untrusted data directly.
2. Data-Independent Code Generation: The LLM generates scripts based solely on tool schemas and user requests.

The architecture: The LLM operates in a "Trusted Dev Playground" to generate scripts. These are then executed in an "Isolated Sandbox" (e.g., gVisor) that returns sero data to the LLM, only a final result to the user. Analysis of the AgentDojo benchmark confirms that 79% of tasks are scriptable without the LLM ever observing untrusted data.

The utility trade-off: XOA achieves a 0.0% effective Attack Success Rate (ASR). However, a strategic advisor must acknowledge the utility cost: XOA currently exhibits a 16-27 percentage point utility drop compared to standard ReAct architectures. This is the price of deterministic certainty.

06

The Blueprint for Enterprise AI Governance: The Agent Gateway

Security must move out of the non-deterministic context window and into a deterministic Agent Gateway. This gateway treats the agent as an untrusted requester, mediating every interaction between the agent and infrastructure.

The five phases of a least-privilege agent gateway

1. Discovery: Agents find tools via a schema-restricted interface, limited by role.
2. Request: The agent submits a structured JSON-RPC tool invocation.
3. Validation: The gateway validates the request against a static schema and computes a plan hash.
4. Authorisation: A Policy Engine (e.g., Open Policy Agent / OPA) evaluates the request against declarative "Policy-as-Code."
5. Ephemeral execution: Approved actions run in short-lived, gVisor-based sandboxes, destroyed immediately after use.

This architecture is bolstered by "Semantic Firewalls." Unlike simple filters, these are independent, lightweight auxiliary models performing real-time intent classification to flag directive intent within passive context data before it ever reaches the core LLM.

07

Strategic Implication: From Probabilistic Trust to Architectural Certainty

The core thesis for 2026 is that AI security is not a model-tuning problem; it is a document-architecture and system-design problem. We must stop trying to "align" models and start governing the infrastructure they inhabit.

Leadership checklist for 2026

• Close the Authorisation Gap: Deploy dynamic Agent Gateways to move beyond session-level IAM.
• Enforce the No-Read Principle: Transition high-risk data processing to XOA architectures to eliminate injection vectors.
• Implement Signed Plan Catalogs: Ensure every execution chain is cryptographically bound to a verified artifact.
• Adopt Continuous Runtime Authorisation: Use OPA to validate every individual tool call against Policy-as-Code.

The goal is not to build a "safer" AI, but a system that remains secure even when the AI is successfully compromised. Building a hardened gateway is no longer an option; it is a strategic necessity for the autonomous age.

Operation Amethyst: Anatomy of an Invisible Phishing Attack

Introduction: The Deceptively Simple Click

The attack begins with a moment of unsettling familiarity. You click a link in an email, and your browser opens to what appears to be the standard Microsoft login page. 

The logo is correct, the layout is pixel-perfect, and the URL- portal.microsoftonline.com.orgid.com -looks plausible at a glance. You feel the muscle memory kick in, ready to type your credentials.

This is the "Russian Doll" trick. By burying the malicious domain (orgid.com) behind a string of legitimate-looking subdomains, the attacker exploits how the human eye processes information. But behind this ordinary interface, a sophisticated Adversary-in-the-Middle (AiTM) attack known as Operation Amethyst (a variant of the Tycoon 2FA campaign) is silently manipulating your session.

The goal isn't merely to steal a password; it is to hijack your entire authenticated session. By sitting between you and the real Microsoft service, the attacker clones the "Digital VIP Pass" - the session token - generated after you have successfully completed the login process. This makes even the most robust two-factor authentication (2FA) completely irrelevant.

Your Learning Roadmap

To understand how this "ghost in the machine" operates, we will explore the three distinct stages of the attack:

• Stage 1: Smart Reconnaissance – How the attacker validates you as a high-value target and weaponizes Microsoft's infrastructure to find your location.
  
  
• Stage 2: The Invisible Hijack – How a malicious "spy" is planted directly inside your web browser using a Service Worker.
  
  
• Stage 3: The Unblockable Escape Route – How stolen data is smuggled out through Microsoft's own trusted Application Insights telemetry.

While you are busy reviewing the pixel-perfect login box, the attack is already performing a series of silent checks to ensure you are the right person to target.

---

Stage 1: The Intelligent Welcome Mat (Smart Reconnaissance)

Before the attack ever prompts for a password, it executes a two-part reconnaissance phase. This ensures the attacker doesn't waste resources on bots or personal accounts and prepares a path that bypasses modern security alerts.

The First Test: Validating the Target

The moment you enter your email (e.g., ddasgupta@attackdefenselab.xyz), the attack performs a Tenant Lookup. It queries Azure AD to identify your Tenant GUID and specific Azure AD Instance (such as Azure AD Global).

This maneuver separates this precision strike from a spray and pray campaign; if the email doesn't belong to a high-value corporate tenant, the attack may simply terminate, weeding out security researchers and bots.

The Geographic Pinpoint: Evading "Impossible Travel"

Once validated, the attack queries Microsoft’s Tenant Partitioning service to find your regional data center (e.g., Oceania). By identifying exactly where you are located, the attacker can route the subsequent attack traffic through servers in your own region.

Additionally, the attack employs a layer of restraint: it checks the browser type and specifically disables itself if it detects Microsoft Edge ("isEdgeAllowed": false). This is a deliberate tactic to avoid the reputation-based blocking of Microsoft Defender SmartScreen.

Why Reconnaissance Matters

Attacker Action	Security Bypass
Tenant Lookup	Confirms a legitimate corporate target; avoids detection by security bots.
Geographic Pinpointing	Matches the victim's region (e.g., Oceania) to defeat "Impossible Travel" alerts.
Edge Exclusion	Aborts the attack if Edge is detected to avoid SmartScreen reputation checks.

Once the attacker has confirmed who you are and where you are, they move to plant an invisible "spy" directly within your browser's architecture.

---

Stage 2: The Invisible Spy in the Machine (The Hijack)

With the groundwork laid, the phishing page loads a specialized file: service_worker_Mz8XO2ny1Pg5.js. This is the core engine of the hijack.

The "Man-in-the-Browser" Tactic

The attack weaponizes a Service Worker, a legitimate feature of modern browsers designed for background tasks and offline access. You can think of this Service Worker as an invisible traffic cop sitting between your browser and the internet.

Because it operates within the browser's own process, it is remarkably difficult to detect.

Warning for Analysts:

Network logs often label this malicious traffic as "Initiated by Service Worker." This can easily confuse junior analysts who may dismiss the entry as a routine, legitimate background task rather than a Man-in-the-Browser hijack.

Dual-Stream Processing

Once active, the Service Worker creates two parallel paths for every piece of data you enter:

1. The Legitimate Face: It forwards your real password and 2FA codes to Microsoft's actual servers. The login proceeds normally, ensuring you never suspect an intrusion.
2. The Malicious Face: In real-time, it secretly clones your password, session cookies, and the all-important authentication tokens.

The stolen data, now cloned and ready, must be smuggled out through a path that your company's firewall is trained to trust implicitly.

---

Stage 3: The Unblockable Escape Route (Exfiltration)

The final stage of Operation Amethyst is a masterclass in evasion: it uses Telemetry Tunneling via Microsoft’s Application Insights and the OneCollector service (browser.events.data.microsoft.com).

Hiding in Plain Sight

Standard phishing attacks often fail when they attempt to send data to a suspicious, unknown server. Operation Amethyst avoids this by disguising your stolen credentials as diagnostic data.

Because blocking Microsoft's telemetry endpoints would break core Microsoft 365 functionality, corporate firewalls almost always allow-list this traffic.

The attacker even includes specific campaign tags - such a Amethyst=Sachiel1&Chamuel=Azrael2 -within the requests. This allows the adversary to sort and organize stolen data from different victims and campaigns automatically.

Mailing the Stolen Goods

To ensure the data reaches them, the attacker uses an Instrumentation Key (iKey), such as: o:69adc3c768bd4dc08c19416121249fcc

• The Analogy: Think of the iKey as a mailbox address. The attacker packages your stolen session token into a standard diagnostic packet and applies their iKey.
• Microsoft’s own telemetry infrastructure then mails that packet directly to the attacker’s private Azure workspace.

The 2FA Bypass Insight

Traditional 2FA fails here because this is a Post-Authentication theft. The attacker isn't trying to guess your code; they are waiting for you to provide it to Microsoft. Once Microsoft validates you and generates a session token - the digital wristband given to you after you clear security - the attacker clones it.

This token is a "Digital VIP Pass" that the attacker can replay from their own machine, bypassing the 2FA requirement entirely.

---

Conclusion: The Attacker’s Playbook & Key Takeaways

Operation Amethyst: Strategic Tactics

Phase	Technique	Learner's Key Insight
Reconnaissance	Tenant Partitioning	Attacks use location-matching and Edge-avoidance to blend into local traffic.
Hijacking	Malicious Service Worker	The "spy" lives inside the browser, making malicious requests look like routine tasks.
Exfiltration	Telemetry Tunneling	Data is hidden in plain sight within legitimate Microsoft Application Insights traffic.

Final Synthesis: The Core Concepts

1. Living off the Land

The brilliance of Operation Amethyst lies in its restraint. It uses almost no traditional malware. Instead, it exclusively uses trusted, legitimate Microsoft infrastructure - from identity services to telemetry channels - to blend in perfectly with the daily noise of a corporate network.

2. Weaponizing the Audit Trail

The telemetry system is a defensive tool meant to provide visibility and diagnostic health. This attack masterfully inverts that purpose, turning a tool meant for defenders into a private, encrypted, and unblockable smuggling channel for stolen credentials.

By understanding these "invisible" patterns, you can look past the pixel-perfect login page and recognize the complex machinery of modern cyber warfare. Understanding these tactics is the first step toward becoming a more effective security advocate.