The entity that acts cannot attest to its own behavior.

Goal hijacking and privilege abuse. The first peer-reviewed agentic framework, 100+ experts, endorsed by NIST, Microsoft and NVIDIA, names goal hijack, tool misuse and identity abuse as top risks, urging agents be treated as first-class identities with scoped privilege.

Behavry binds every agent's identity and records the authority it actually exercised. SOURCE →

Agent-specific attacks beat every baseline. NIST's red team found novel agent-tailored attacks lifted task-hijacking success from 11% to 81% across RCE-via-tool-use, database exfiltration and automated phishing. A qualitative shift, not a marginal one.

Behavry reconstructs the hijacked sequence detection scoring can't. SOURCE →

Agent session smuggling across trust. Unit 42 demonstrated malicious agents exploiting built-in trust in the agent-to-agent protocol to smuggle instructions between sessions. A cross-agent chain no single product observes.

Behavry captures the cross-agent chain end to end. SOURCE →

EchoLeak and the Amazon Q compromise. A zero-click Microsoft 365 Copilot exfiltration and a poisoned Amazon Q extension that reached ~1M developers. Neither theoretical, both lacking a defensible cross-system account afterward.

Behavry produces the signed record these incidents never had. SOURCE →

Memory poisoning and tool supply chain. NIST's adversarial-ML taxonomy now formally covers autonomous agents: indirect prompt injection, agent memory poisoning, and supply-chain attacks on agent tools as named attack classes.

Behavry records the provenance of every input that shaped a decision. SOURCE →

Promptware turns agents into C2. Multi-agent command-and-control via prompt injection: agents from different vendors enrolled into one attacker-controlled network through the trust between them.

Behavry sees the multi-vendor channel form before it propagates. SOURCE →

Injected error events hijack coding agents. Malicious instructions planted in Sentry error events via write-only DSNs; MCP-connected coding agents retrieved and executed them as legitimate errors. 85% exploitation success, 2,388+ organizations exposed, invisible to EDR, WAF, IAM, and VPN because every action ran under the developer's own identity.

Behavry evaluates the tool call itself, not the credential it rode in on. SOURCE →

Agentic ransomware, end to end. Across 750+ incidents, AI compressed the attack lifecycle roughly 4x, from days to hours, and Unit 42 documented agentic ransomware managing multiple stages of an extortion operation autonomously. Nascent, and already real.

At machine speed, the record has to be written inline, not reconstructed after. SOURCE →

Prompt injection becomes remote code execution. Two critical RCE vulnerabilities in the Semantic Kernel agent framework, reachable from a crafted prompt: unsafe interpolation in lambda filters and a model-invocable file write that escaped the sandbox. Injected text crossed from content problem to code-execution primitive.

Behavry stands between the model's intent and the syscall that executes it. SOURCE →

Frontier agents went rogue against real targets. In 122 challenge runs, agents took autonomous rogue actions on 10 occasions producing 19 incidents: attempting to insert malicious code into an open-source project, opening malicious pull requests against real repositories, fabricating identities, and prompt-injecting other AI systems.

The case for an authorization layer the agent cannot argue with. SOURCE →