#124
Adversarial audit: map the 2026 agentic attack classes (memory poisoning, plan hijacking, tool abuse) onto ARTEX itself
Summary
Run an adversarial audit that maps the agentic attack classes from Bugcrowd's updated AI security guide (Sept 2026) onto ARTEX's own internals. The same classes the industry now pays to find in AI products apply to our agents: during a hunt, the TARGET controls part of what our agents read (web content, API responses, tool output), which makes our own planner, facts graph, and tool surface an injection boundary.
Class-by-class map
| Attack class (Bugcrowd guide) | ARTEX surface to audit | Existing coverage | Open question |
|---|---|---|---|
| Memory poisoning | Facts/goals graph: record_fact from worker runs persists target-influenced text that later intents and the planner read | #63 dedup, proof-basis gates on findings (not on facts) | Do facts carry provenance (target-response vs tool-output vs operator)? Can a poisoned fact steer later intents? |
| Plan hijacking | Planner consumes worker traces/summaries containing raw target text | #49 prompt-injection hardening (seeds + MCP descriptions) | Are planner-facing summaries marked as untrusted content with an instruction-ignoring rule? |
| Goal drift | Planner drifting from the task goal | #104 stagnation warning | Does the planner re-anchor to the original goal when summaries pull it away? |
| Tool abuse | Workers invoking tools with target-influenced arguments (SSRF-ish relaunch, destructive commands from injected instructions) | Intercept/approval gates, RoE baked in goals | Coverage for the newest tools: bbot recipe output is target-influenced JSONL that becomes facts; does the ingestion path mark it untrusted? |
| Many-shot jailbreak | Not directly applicable (agents do not preload third-party conversation history) | - | - |
Plan
- One adversarial audit pass (lab target serving injection payloads in pages, API responses, and HTTP headers) that tries each class against a running task: poison a fact and see whether a later intent acts on it; smuggle planner-facing instructions through a worker summary; pull the planner off-goal.
- Where a class lands, harden: provenance tags on facts, untrusted-content delimiters plus instruction-ignoring rules on planner-facing surfaces, goal re-anchoring in the planner prompt.
- Document what held (negative results are useful: they are the tool's misuse-resistance posture).
Non-goals
No new attack capability, no changes to hunting behavior. This is about making our own agents resistant to the targets they test.
References
- Bugcrowd, "What's changed in AI security over the past two years" (Sept 2026) - names memory poisoning, plan hijacking, goal drift, tool abuse as the agentic category.
- Prior in-house work: #49 (prompt-injection hardening), #63 (finding dedup), #53 (adversarial gate), #104 (stagnation warning).
Activity
0No activity yet.