🔥 24×7 Proxy Interview Support · Job Support · Profile Engineering | USA • Canada • UK • Europe • Australia

ProxyTech ResearchEngineering Research Archive

Autonomous AI Agent Security

An independent engineering-research archive. We take live evidence — academic papers on arXiv, primary security disclosures, and threat intelligence — and work out what it means for teams building and operating production AI agents. Not summaries. Not news. A running investigation into the security boundaries that autonomous, tool-using models break, and the architectures that hold.

Active cluster

Autonomous AI Agent Security

Publications

11

Evidence reviewed

September 2026

Evidence base

Academic researchPrimary disclosures · Threat intel
Featured research

The incident that made this concrete

AI Agent Security · Flagship incident researchAnatomy of an AI-Orchestrated Intrusion: A Technical Reconstruction of GTG-1002The flagship. In November 2025 Anthropic disclosed a campaign in which an agent ran the majority of an intrusion lifecycle at machine speed. We reconstruct the architecture, isolate the boundary that failed, and build the counterfactual secure deployment.INCIDENTPRIMARY SOURCEANALYSISOPEN QUESTION22 min
AI Agent SecurityAutonomous AI Agent SecurityThe pillar of the series. Autonomous agents collapse the boundary between untrusted data and privileged action. We map the new attack surface, separate what the evidence proves from what it does not, and lay out the architectural response.Research Pillar · 18 minAI Agent SecurityPrompt InjectionInjected instructions in retrieved data cross the same channel as trusted instructions. We treat this as a control-flow integrity problem, review benchmark and incident evidence, and grade the defense classes honestly.Technical Research Analysis · 19 min
Active research cluster · latest

All publications in this cluster

11 publications

AI Agent SecurityAutonomous AI Agent SecurityThe pillar of the series. Autonomous agents collapse the boundary between untrusted data and privileged action. We map the new attack surface, separate what the evidence proves from what it does not, and lay out the architectural response.RESEARCHINCIDENT18 minAI Agent Security · FlagshipThe GTG-1002 IncidentThe flagship. In November 2025 Anthropic disclosed a campaign in which an agent ran the majority of an intrusion lifecycle at machine speed. We reconstruct the architecture, isolate the boundary that failed, and build the counterfactual secure deployment.INCIDENTPRIMARY SOURCE22 minAI Agent SecurityPrompt InjectionInjected instructions in retrieved data cross the same channel as trusted instructions. We treat this as a control-flow integrity problem, review benchmark and incident evidence, and grade the defense classes honestly.RESEARCHINCIDENT19 minSoftware EngineeringAI Coding AgentsCoding agents sit inside the developer trust boundary with a shell attached. We examine how prompt injection in repository content becomes code execution, and where the approval boundary must sit.INCIDENTPRIMARY SOURCE17 minAI InfrastructureMCP SecurityMCP made "give the agent a tool" as easy as installing a package — and inherited every package-manager security problem plus new semantic ones. We map the MCP attack surface with empirical and incident evidence.RESEARCHINCIDENT18 minCloud SystemsSandbox EscapeA sober look at containment as a security boundary. Agents that can run code inherit every classic container-escape technique; we assess what the evidence proves and what remains an open question.RESEARCHEXPERIMENTAL17 minDistributed SystemsContainment ArchitectureIf the agent is potentially the adversary, containment must be structural, not behavioral. We translate OS-security principles — isolation, mediation, least privilege — into an agent runtime architecture.RESEARCHANALYSIS20 minCybersecurityIdentity & AccessThe hardest agent-security question is authorization, not authentication. We compare identity models for delegated, autonomous operators and make an evidence-aware recommendation.RESEARCHANALYSIS18 minAI Agent SecurityTool PermissionsThe most tractable agent-security lever is the permission envelope around tools. We review deterministic privilege control and least-privilege enforcement, and where they trade utility for safety.RESEARCHEXPERIMENTAL16 minCloud SystemsNetwork EgressThe last line of defense against a compromised agent is the network. We analyze real exfiltration channels and the egress architecture that turns "obeyed the injection" into "went nowhere."INCIDENTANALYSIS16 minCybersecurityExploitation BenchmarksBenchmark numbers drive both hype and policy. We read the offensive-capability literature carefully, separating "exploited with the CVE handed to it" from "found it alone," and flag the measurement traps.RESEARCHEXPERIMENTAL18 min
Research areas

What we investigate

AreaAI Agent SecurityTrust boundaries, injection, and confinement for tool-using models.
AreaCybersecurityOffensive capability, identity, and threat evidence.
AreaCloud SystemsIsolation, egress, and runtime boundaries for agent workloads.
AreaDistributed SystemsMediation and blast-radius control across agent architectures.
AreaSoftware EngineeringCoding agents inside the developer trust boundary.
AreaAI InfrastructureThe tool supply chain: MCP, registries, and provenance.
Research questions

Questions driving the cluster

Open questionsOPEN QUESTION
  • Can any defense drive indirect prompt-injection success low enough for high-privilege production agents?
  • How much autonomous offensive capability is real versus an artifact of information handed to the benchmark?
  • What is the right identity model for an agent that acts for a user but is not the user?
  • Is behavioral alignment ever a sufficient substitute for architectural containment?
  • How do you detect an agent that is doing exactly what it was told — by an attacker?
Incident research

Real-world incidents we analyze

DisclosedIncident / disclosurePrimary sourceAnalyzed in
Nov 2025GTG-1002 — AI-orchestrated cyber espionageAnthropicThe GTG-1002 Incident
Jun 2025EchoLeak — zero-click M365 Copilot injectionAim Security; Microsoft (MSRC)Prompt Injection
Oct 2025CamoLeak — Copilot source-code exfiltrationLegit Security; GitHubNetwork Egress
Aug 2025CVE-2025-53773 — Copilot RCE via prompt injectionJ. Rehberger (Embrace The Red); MicrosoftAI Coding Agents
Aug 2025Cursor CurXecute / MCPoisonAim Security (CurXecute); Check Point Research (MCPoison)AI Coding Agents
Sep 2025postmark-mcp — malicious MCP serverKoi Security; SnykMCP Security
Jul 2025mcp-remote RCE (CVE-2025-6514)JFrog Security ResearchMCP Security
Engineering evidence

Recent papers we are following

From the ProxyTech blog

Accessible lead-ins

Blog · Incident briefingGTG-1002: What the First AI-Orchestrated Cyberattack Means for EngineersA plain-English briefing on the incident and the four controls that would have contained it.Blog · ExplainerPrompt Injection Is Now Remote Code Execution: EchoLeak & CamoLeakWhy injection is a control-flow bug — and what actually stops it.Blog · ChecklistSecuring AI Agents in Production: A 2026 Engineering ChecklistEight evidence-based controls, each linked to the research behind it.

ProxyTech Research is an independent engineering-analysis project. We reference public academic papers and primary security disclosures; we do not claim peer review, journal publication, arXiv affiliation, or academic positions, and we do not represent the cited authors or vendors.