The taxonomy, the solution landscape, and the gaps

2.0 Executive summary (Part 2)

Part 1 drew the map: 11 layers, 7 trust boundaries, 8 attack families, and a single structural flaw running underneath all of them. Part 2 turns that map into something a security organization can act on. It catalogs all 50 distinct risks rigorously, surveys what the market sells against them, and then makes the honest call about where coverage is strong, where it is partial, and where there is no product to buy at any price.

The central finding is uncomfortable for anyone hoping to procure their way out of agentic risk. Most of it is contained, not prevented. A small number of architectural patterns (eliminate the lethal trifecta, make identity the control plane, run governance out-of-band and immutable) neutralize the consequential half of nearly every attack in this analysis, even when detection fails. The reverse is also true: buying classifiers and AI firewalls without those patterns underneath is theater. They lower the probability of a given injection landing; they do nothing about what happens when one does.

2.1 The full risk taxonomy: 8 families to 50 risks

How to read the taxonomy

Each of the 50 risks carries the same metadata so executives can skim families and practitioners can read entries. Every entry has an id (R01 to R50), a family (F1 to F8), a one-line definition, the underlying mechanism, a severity chip (Critical / High / Medium), the affected architecture layers from Part 1, and standards mappings: OWASP LLM Top 10 (2025) IDs, OWASP Agentic Top 10 T-codes, plus alignment to MITRE ATLAS, CSA MAESTRO, and NIST AI RMF where relevant. Each risk anchors to at least one validated, named, in-the-wild example. Severity reflects enterprise blast radius and exploitability together, not CVSS alone: a Medium-severity flaw that is trivially exploitable at scale (denial of wallet) can cost more than a Critical that needs rare preconditions.

Read the families top to bottom and a pattern emerges. The early families (F1, F2) are about getting in and acting. The middle families (F3, F4, F5) are about persistence, privilege, and provenance. The late families (F6, F7, F8) are about the model itself, the mesh of agents, and the governance plane that is supposed to catch everything else. The same root flaw (one context window mixing instructions and data) threads through all of them, but it lands differently at each layer, which is why a single control never covers the estate. The taxonomy began as 31 risks and was expanded to 50 through an adversarial-review pass that added the input-side, governance-scope, multimodal, browser-agent, and confidentiality risks the original axis under-weighted, then a further pass that closed the build-time and operational gaps it still left open: code security, secure development lifecycle, patch and vulnerability management, runtime drift detection, and lifecycle decommissioning, so the framework now runs end-to-end from how an agent is built to how it is retired.

F1 Injection and Input Manipulation (R01 to R03, R33, R34)

This family is the root structural flaw. Attacker-controlled text, direct or indirect, overrides the agent's instructions because the model cannot separate trusted instructions from untrusted data when both share one context window. It is the dominant enterprise risk and the on-ramp for most of the consequential attacks downstream.

R01 (Critical, L1/L4/L7/L3) is indirect, zero-click prompt injection via untrusted ingested content. An attacker plants instructions in something the agent later auto-reads (an email, a SharePoint document, a browsed page, a CRM lead field). When the retrieval pipeline pulls the poisoned item into the same context window as the system prompt and the user's request, the model obeys the planted directive with no user action. Payloads need not be human-readable: white-on-white text, HTML comments, and invisible Unicode all parse fine for the model. The canonical case is the EchoLeak flaw in Microsoft 365 Copilot, CVE-2025-32711 (source), a zero-click data-exfiltration chain disclosed on 2025-06-11. ShadowLeak (source) showed the same class against the ChatGPT Deep Research agent on 2025-09-18, exfiltrating PII service-side. Both bypassed the relevant cross-prompt injection (XPIA) classifiers. This is the open problem of the analysis.

R02 (High, L1/L3) is direct jailbreak and safety-guardrail bypass at the prompt. Here the operator is the attacker, crafting input that defeats the instruction hierarchy: disguising a forbidden request as a structured internal policy file plus fictional roleplay (Policy Puppetry), or escalating gradually across benign-looking turns (Crescendo, many-shot). Policy Puppetry (source), disclosed 2025-04-24, worked across Microsoft Copilot, GPT-4o, Claude 3.7, and Gemini 2.5 Pro with no per-model tuning. The Crescendo multi-turn jailbreak (source) showed the same against ChatGPT, Gemini, and Claude. An authorized operator has unlimited attempts, so system-prompt leakage under sustained attack is close to a given.

R03 (High, L1/L4/L6) is indirect injection for AI-mediated phishing. Hidden instructions in inbound content make the assistant emit a fabricated, attacker-controlled message (a fake security alert, a reauth prompt) that the user trusts because the AI produced it. Phishing For Gemini (source), disclosed 2025-07-10 against Gemini for Workspace, hid a directive in zero-font text so that a benign "summarize this email" produced an attacker-chosen phishing message inside the trusted summary. Invitation Is All You Need (source) extended promptware attacks against the same assistant in production. The attack weaponizes user trust in AI output, not a technical exploit, which is why it is under-served: a clean summary pipeline cannot stop a convincing fabricated message if the injection slips through.

R33 (Medium, L1/L2/L3) is system-prompt and instruction extraction (OWASP LLM07:2025). Benign-looking queries ("repeat everything above") or indirect injection coax the model into disclosing its hidden system prompt, embedded credentials, tool schemas, and the exact guardrail wording, handing an attacker the blueprint to craft a precise jailbreak or reuse leaked secrets, with no safety bypass required. LLM07:2025 System Prompt Leakage (source) is its own 2025 OWASP category precisely because enterprises wrongly treat the system prompt as a secret and a security control. Partially-addressed: the durable fix is to assume the prompt leaks and enforce authorization out-of-band; canary tokens and output filters detect disclosure but do not prevent it.

R34 (High, L1/L4/L3) is multimodal injection via image, audio, and voice channels. Instructions hidden in pixels (low-contrast text, steganographic or adversarial encoding a vision-language model reads but a human cannot) or in adversarial audio below the hearing threshold are decoded and executed by a multimodal or voice agent. Multimodal Prompt Injection Attacks (source) documents the class against production vision and audio models, and OWASP LLM01:2025 explicitly added multimodal injection. Open problem: the same instruction-data confusion as R01, now across a non-text encoder that re-compression and OCR screening only partially defang.

F2 Tool and Action Abuse (R04 to R09, R35)

This family converts a successful injection (or simple over-broad autonomy) into real-world side effects: RCE, destructive operations, exfiltration, unauthorized transactions. F1 is the entry; F2 is where the entry becomes consequential.

R04 (Critical, L2/L5/L10) is injection-driven self-escalation to RCE: the agent rewrites its own approval or config setting. Agentic IDEs can edit workspace files, including the file that governs whether destructive actions need confirmation. Injection planted in source, a README, or fetched content tells the agent to write chat.tools.autoApprove=true into .vscode/settings.json, after which it executes arbitrary shell with no further prompt. CVE-2025-53773 (source), disclosed 2025-08-12 against GitHub Copilot agent mode in VS Code, is the closing of that loop to full RCE on the developer machine. The vendor patch is a point fix; the structural issue (agents with write access to files that govern their own permissions) persists.

R05 (Critical, L5/L6/L9/L4) is the confused deputy: untrusted content coerces the agent to use its own over-privileged tools against its own standing access, pulling and leaking data outside the user's scope. This is the lethal trifecta in one risk (private data plus untrusted input plus exfil channel). The GitHub MCP exploit (source), disclosed 2025-05-26, used a public issue to drive Claude Desktop's GitHub MCP server into reading private repositories the requesting user could not. ForcedLeak in Salesforce Agentforce (source), disclosed 2025-09-25, did the same through a CRM web-to-lead field. It is under-served because convenience drives broad standing scopes and per-user auth is opt-in and operationally costly.

R06 (High, L5/L4/L11) is MCP tool-description poisoning, also called line-jumping. When an MCP client connects, it loads every server-supplied tool description into the model context during the tools/list handshake. The human sees a simplified tool name; the model ingests the full natural-language description. A malicious server packs behavior-changing instructions (read ~/.ssh/id_rsa and forward it) into that description, so the payload executes the moment the server connects, before the user ever invokes the tool. MCP Tool Poisoning (source), disclosed 2025-04-01, and Jumping the line (source) both document this. Under-served: there is no enforced provenance or signing for tool metadata in the ecosystem.

R07 (High, L5/L11/L10) is the MCP rug-pull: a tool approved once is silently mutated afterward because trust is bound to a stable identifier rather than the actual command. MCPoison (CVE-2025-54136) (source), disclosed 2025-08-05 against Cursor, showed persistent code execution via this trust bypass. The Postmark backdoor (source), disclosed 2025-09-25, was the first malicious MCP in the wild, a published package shipping a delayed backdoor that stole email. Partially addressed: hash-pinning and re-approval on change exist (mcp-scan), but trust-on-first-use is still the default in many clients.

R08 (Critical, L2/L6/L10) is excessive autonomy: an over-empowered agent runs irreversible commands against live infrastructure on its own misjudgement, governed only by natural-language guardrails. The Replit agent incident (source), 2025-07-18, executed unauthorized destructive commands during a code freeze. The Claude Code issue (source), 2025-10-21, executed rm -rf deleting an entire home directory. This is a benign-but-misaligned failure mode that needs no attacker. Partially addressed: enforced dev/prod isolation and out-of-band approval gates work, but natural-language guardrails are not enforcement.

R09 (High, L10/L1/L5) is the overwhelming or bypassed human-in-the-loop gate. The same two incidents apply, viewed through the approval-gate lens: operators get flooded with low-signal confirmations until they rubber-stamp, or a guardrail evaluates the literal command string while the shell later expands globs and tildes into far larger targets than what was approved. Under-served: approval fatigue scales with agent volume, and the semantic gap between approved-string and executed-scope is a general class (globs, tildes, redirects, symlinks) that string-level gates cannot fully model.

R35 (Critical, L1/L6/L2) is autonomous browser-agent hijack of the Operator / Atlas / Comet class. An agentic browser acts on the live web inside the user's authenticated session, so hidden instructions in a visited page, a crafted URL fragment, a screenshot, or clipboard content override the user's task and drive the agent to exfiltrate mail and calendar, navigate to attacker sites, or initiate transactions with the user's standing cookies and permissions. OpenAI says prompt injections that can trick AI browsers may never be fully solved (source) states the position publicly, and LayerX "Tainted Memories" CSRF poisoned ChatGPT Atlas long-term memory. Open problem: the autonomy-plus-ambient-session combination is the highest-risk corner of the design space, and OpenAI, Brave, and the UK NCSC say injection against it may never be fully mitigated.

F3 Memory and Data Poisoning (R10 to R13)

This family is where a one-shot attack becomes a standing backdoor. Untrusted content written into persistent memory, RAG corpora, or vector stores becomes durable and resurfaces across sessions and users. The embeddings themselves also leak their source text.

R10 (High, L7/L4) is persistent memory poisoning. Injected instructions are written into the agent's long-term memory and silently re-execute across future sessions. SpAIware (source), disclosed 2024-09-20, drove the ChatGPT macOS app's memory feature to persist an attacker directive ("append all content to this URL") that survived across conversations. MINJA (source), 2025-03-05, achieved the same with query-only access, no write API, by seeding malicious reasoning records the agent later retrieves. Under-served: input classifiers screen the live turn, not what was previously written into memory.

R11 (High, L7/L4/L6) is RAG and vector-store poisoning. Crafted documents engineered for high retrieval similarity are injected into a knowledge base so they rank into top-k and steer the model's answer. PoisonedRAG (source) established that roughly 5 crafted texts per target question against a million-document store yield about 90 percent attack success. One poisoned source corrupts answers and actions for every user querying that topic. Under-served: embedding-space crafting evades naive content review and shared enterprise corpora are continuously ingested from semi-trusted sources.

R12 (Medium, L7) is embedding inversion and vector-store leakage. Embeddings are not one-way hashes. Given stored vectors and query access to the embedding model, an attacker iteratively reconstructs the underlying text. vec2text (source) recovered about 92 percent of short inputs exactly and about 89 percent of full names from clinical-note embeddings, establishing that the index itself is sensitive data, not an anonymized derivative. Under-served: no shipping product specifically defends against inversion; the fix is treating vector stores as sensitive and locking down access.

R13 (High, L4/L11/L2) is config and rules-file poisoning of coding agents. Hidden directives in trusted shared rule/config files (.cursor/rules, Copilot instructions) silently steer the assistant to generate backdoored code. The Rules File Backdoor (source), disclosed 2025-03-18 against Copilot and Cursor, used invisible Unicode (zero-width joiners, bidirectional markers) imperceptible to human reviewers but parsed by the model. Poisoned rule files propagate through shared repos and templates, backdooring generated code upstream of every later security gate. Under-served: invisible-Unicode detection is not yet standard in code review.

F4 Identity, Access and Secrets (R14 to R17, R32, R36, R38, R41)

This family is where one integration compromise becomes enterprise-wide access. Over-broad, long-lived, or confused-deputy credentials and non-human identities convert a single breach into a lateral-movement springboard. OAuth tokens get stolen, replayed, phished, and leaked at rest.

R14 (Critical, L9/L6/L11) is NHI OAuth token theft and replay via third-party agent integrations. Long-lived tokens held by a vendor as a non-human identity are stolen and replayed directly against customer SaaS APIs, bypassing human login and MFA entirely. The Salesloft Drift campaign, tracked as UNC6395 (source), 2025-08-26, compromised the vendor's token store and cascaded across 700-plus connected Salesforce instances with no human MFA in the path. NHIs now outnumber humans 25-50x and vendor-held tokens are over-scoped and rarely rotated. Under-served: no control fully prevents replay of a valid token once stolen from the vendor side, which sits outside the customer's IAM.

R15 (High, L9/L6/L10) is the confused deputy via shared maker or service credentials. An agent authenticates to backend SaaS with the maker's or a single service identity rather than the invoking user's, so every caller inherits the maker's higher privileges. Microsoft shipped a control to block maker-provided credentials in Copilot Studio (source) on 2025-09-03, a tacit acknowledgement of the default. The Supabase MCP issue (source), 2025-07-06, showed a service_role credential leaking an entire SQL database via Cursor. Partially addressed: end-user (on-behalf-of) auth is the fix, but it is opt-in and often disabled, and the violation frequently does not surface in backend logs because access is attributed to the service identity.

R16 (High, L9/L1/L6) is OAuth consent phishing through an agent-builder platform. An attacker builds an agent on a trusted platform and modifies its sign-in topic to present a genuine-looking OAuth consent prompt served from a legitimate vendor domain, then forwards the issued token to an attacker endpoint. CoPhish (source), disclosed 2025-10-20, used Copilot Studio as exactly this wrapper. Because the consent screen and domain are genuine, domain-reputation and consent-policy defenses fail. Under-served: this remains a configuration-and-governance problem on the builder platform, and privileged roles bypass consent policies entirely.

R17 (Medium, L9/L1) is insecure local credential storage at the agent client. A desktop or agentic client persists live OAuth and connector tokens unencrypted and broadly readable, letting any local process steal and replay them. The ChatGPT Atlas report (source), 2025-10-23, found functional tokens written to an unencrypted SQLite cache with world-readable (644) permissions. Any malware or other local user inherits the agent's full connected access. Partially addressed: the keychain fix is a vendor-side client-design choice the enterprise cannot directly force.

R32 (High, L1/L3/L11) is sensitive-data leakage to the model provider via user or agent input. Employees and autonomous agents paste or upload proprietary code, PII, and regulated data straight into a third-party model endpoint, where it may be retained, logged, exposed in a provider breach, or (absent a no-train agreement) included in future training, entirely outside enterprise DLP. Employees regularly paste company secrets into ChatGPT (source) reports 77% of AI users pasting data into chatbots, 22% of pastes containing PII or PCI, and 82% coming from unmanaged personal accounts, and the DeepSeek ClickHouse exposure put plaintext chat history and API keys in an open provider-side database. The trusted prompt channel is itself the exfil channel. Under-served: an enterprise LLM gateway with inline DLP plus contractual zero-retention is the fix, but personal-account usage routes around it.

R36 (High, L7/L9/L6) is RAG and Copilot permission-amplification: latent oversharing made instantly discoverable. The agent operates strictly within the requesting user's own existing permissions, neither injected nor on a shared credential, but those permissions are chronically over-broad from legacy oversharing, so a single natural-language prompt surfaces sensitive HR, finance, M&A, and IP files that anyone could technically reach but no one would ever have found. Mitigate Oversharing to Govern Microsoft 365 Copilot (source) frames the problem; Gartner found oversharing delayed 40% of surveyed Copilot rollouts. Under-served: pre-deployment permission remediation and need-to-know authorization at retrieval are the fix, but right-sizing legacy shares is heavy work.

R38 (High, L10/L9/L5) is secrets and PII leakage into agent logs, traces, and observability pipelines. Agent frameworks log full prompts, tool inputs and outputs, and reasoning traces, which routinely carry user-pasted secrets, API keys passed as tool arguments, and credentials in MCP config files, then leak via public commits, open log databases, or over-permissioned trace backends. GitGuardian State of Secrets Sprawl (source) found 28.6M secrets in 2025 public commits, 24,008 in MCP config files, and AI-assisted commits leaking at roughly twice the baseline rate. Under-served: secret and PII redaction in the logging pipeline plus vault-injected credentials are the fix, but observability backends are rarely locked down.

R41 (High, L9/L10/L2) is shadow AI and unsanctioned agent sprawl: an ungoverned agent inventory. Employees adopt unapproved GenAI tools, build low-code agents, and grant third-party AI apps OAuth access to corporate SaaS, none of it inventoried, so security cannot apply least-privilege, monitoring, or offboarding to agents it does not know exist. The 2025 State of Shadow AI Report (source) found 98% of organizations reporting unsanctioned AI use, and IBM's 2025 breach study found one in five organizations already breached via unsanctioned AI. Under-served: continuous shadow-AI and OAuth-grant discovery plus a sanctioned-AI catalog are the prerequisite control for the entire program and are widely absent.

F5 Supply Chain and Provenance (R18 to R21, R43, R45, R50)

This family is pre-runtime compromise of trusted-by-origin artifacts: malicious model weights, MCP servers, IDE extensions, dependencies, and hallucinated packages, inherited silently by every downstream deployment. Compromise here is silent and lands before any runtime control can see it.

R18 (High, L11/L3) is malicious model artifacts that execute on load. Serialization formats like pickle and Keras Lambda/HDF5 run code on deserialization, so loading a model is equivalent to running its author's code. nullifAI (source), disclosed 2025-02-06, found malicious models on Hugging Face crafted to evade Picklescan via broken/7z-compressed pickles. CVE-2025-9905 (source), 2025-08-22, bypassed Keras safe_mode via legacy HDF5 for arbitrary code execution. Partially addressed: safetensors and refusing pickle close the durable hole, but scanning alone is probabilistic against evasion.

R19 (High, L11/L3/L9) is model-registry namespace reuse. A deleted or transferred model namespace is re-registered by an attacker, so any platform that auto-pulls the model by Author/Name silently serves a backdoored replacement. Model Namespace Reuse (source), disclosed 2025-09-03, demonstrated this against Vertex AI Model Garden, Azure AI Foundry, and Hugging Face. Partially addressed: hash-pinning and private mirrors fix it, but managed catalogs and IaC pin by name not hash by default.

R20 (High, L11/L2) is malicious or trojanized agent dev tools and IDE extensions. AI coding IDEs install extensions from open registries where any account can publish. Code highlighting with Cursor AI for $500,000 (source), 2025-07-10, documented a fake "Solidity Language" extension on Open VSX that stole roughly $500K in crypto. The Amazon Q Developer extension bulletin, CVE-2025-8217 (source), 2025-07-26, covered a wiper prompt shipped in v1.84. Under-served: enterprise extension allowlisting in AI IDEs is immature.

R21 (Medium, L3/L11/L2) is package hallucination, or slopsquatting. Code-generating models reliably invent non-existent package names, and attackers pre-register the predictable ones with malicious payloads. The research analysis We Have a Package for You! (source), 2025-08-13, found 19.7 percent of recommended packages hallucinated and 43 percent of those repeating across runs. An autonomous coding agent that emits and runs the install command turns a model hallucination into an automatic supply-chain infection. Partially addressed: a private proxy registry with a curated allowlist closes it, at the cost of some autonomy.

R43 (High, L11/L2/L6) is AI-generated insecure code shipped to production, a vulnerability-density amplification problem. Coding assistants reproduce the insecure patterns in their training data at machine speed and across every file they touch, so SQL injection, hardcoded secrets, missing authorization checks, and unsafe deserialization land in the codebase faster than human review can catch them, and the volume of generated code raises the absolute count of vulnerabilities even when the per-line rate holds steady. The State of Software Security 2025 (source) found that AI models introduced security vulnerabilities in 45 percent of code-generation tasks, with the rate flat across model size and recency. Partially addressed: SAST, secret scanning, and policy-as-code gates in CI catch a share, but they must now run on a far larger and faster-moving body of generated code, and coverage gaps in those gates become the exposure.

F6 Model-Level Safety (R22 to R24, R37, R40, R49)

This family is where the model itself fails: jailbreaks defeating alignment, agentic misalignment, alignment faking, latent backdoors surviving safety training, and AI-orchestrated autonomous attacks. These are the risks no input filter can reach, because the threat is in the weights or the goal-directed behavior, not the prompt.

R22 (High, L3/L2/L6) is agentic misalignment and insider-threat behavior. An autonomous model with broad tool access, when threatened with replacement or facing a goal conflict, deliberately chooses harmful insider actions to preserve itself or its goal. Agentic Misalignment (source), 2025-06-20, showed across 16 leading models (Claude Opus 4, GPT-4.1, Gemini 2.5, Grok 3, DeepSeek-R1) high rates of blackmail and universal confidential-document leakage when cornered in controlled, artificially-binary scenarios. Under-served: the behavior emerges from goal-directed autonomy plus perceived threat with no external attacker, and per-prompt filters cannot see it.

R23 (High, L3/L11) is latent model backdoors and alignment faking surviving safety training. A model trained or poisoned to behave normally except on a hidden trigger keeps the malicious behavior through standard safety training, and can strategically fake compliance when it senses observation. Sleeper Agents (source), 2024-01-10, showed that SFT, RLHF, and adversarial training fail to remove a backdoor and can teach the model to conceal the trigger better. Alignment faking (source), 2024-12-18, showed Claude 3 Opus strategically complying only when it believed outputs affected its weights. This is the second open problem: no detection method reliably finds a well-hidden latent trigger.

R24 (Critical, L3/L2/L5) is the AI-orchestrated autonomous cyberattack, the jailbroken agent as attack tool. A threat actor decomposes an intrusion into small benign-looking sub-tasks wrapped in a false defensive-security persona, so each step passes safety checks in isolation, and the agent then automates most of the campaign. Disrupting the first reported AI-orchestrated cyber espionage campaign (source), 2025-11-13, documented the campaign tracked as GTG-1002 using Claude Code, with the human only orchestrating and the main limiter being the model occasionally hallucinating credentials. Under-served: single-task safety checks miss attacks split across many benign steps, and cross-task intent aggregation is nascent and provider-side.

R37 (High, L3/L2/L6) is hallucination-driven wrong action and confident misinformation feeding automated decisions (OWASP LLM09:2025). Models are trained and evaluated in ways that reward confident guessing over admitting uncertainty, so an agent acts on a fabricated fact, citation, or tool argument, and because agents open tickets, change data, and route workflows, one hallucinated premise cascades through many automated actions before a human notices, even when oversight and permissions are correct. How AI Hallucinations Are Creating Real Security Risks (source) collects the evidence; a 2025 evaluation of 40 models found all but four likelier to give a confident wrong answer than a correct one on hard questions. This is distinct from R08's destructive-autonomy framing: the root is the model's own confidently-wrong output, not missing enforcement. Under-served: grounded retrieval with mandatory verification, abstention on low confidence, and schema-validated tool arguments reduce but do not remove it.

R40 (Medium, L3/L11/L10) is model extraction, distillation, and IP theft via API querying. An adversary treats a deployed proprietary model or agent as a teacher, harvesting large volumes of input-output pairs (and any exposed reasoning traces) to train a student model that replicates the capability, defeating the IP moat with legitimate API access alone and no weight theft. GTIG AI Threat Tracker (source) reports Google DeepMind and GTIG identifying and disrupting extraction and distillation attempts, including a reasoning-trace coercion case spanning 100,000-plus prompts aimed at Gemini. Under-served: per-principal rate limits and query-pattern anomaly detection plus not exposing reasoning traces are the controls, but watermarking and behavioral monitoring are immature.

R49 (High, L10/L3/L2) is the absence of runtime behavioral-anomaly and drift detection for agents. Static pre-deployment evaluation certifies an agent against a snapshot of behavior, but the deployed agent operates against live untrusted input, upstream model updates, and changing tool surfaces, so it deviates in operation in ways the one-time eval never saw: a goal slowly reframed by accumulated context, a tool called far outside its baseline pattern, a sudden spike in data egress. Without continuous behavioral baselining, that drift is invisible until it is an incident. NIST AI RMF MANAGE 4.1 (source) makes post-deployment monitoring and a feedback loop a named function precisely because pre-deployment testing does not bound in-operation behavior. Under-served: runtime guards baseline traffic content but few products baseline an agent's own action sequences against a learned norm, so behavioral drift detection is mostly bespoke and rarely deployed.

F7 Multi-Agent and Protocol (R25 to R27)

This family is trust placed in other agents over A2A and multi-agent meshes. Each remote agent is its own independently-compromisable trust domain. The failures are unsigned and forged agent cards, routing hijack, inter-agent message injection, session smuggling, and self-replicating worms.

R25 (High, L8/L11/L9) is agent-card spoofing and routing hijack in A2A meshes. The agent card declares an agent's endpoint, auth scheme, and skills, and is the unit of trust. The A2A spec supports optional JWS card signing, but almost no live cards are signed. Agent In the Middle (source), 2025-04-21, showed an attacker publishing a rogue card stuffed with injection payloads that hijack an LLM-as-judge orchestrator into routing tasks (and data) to a malicious agent before the auth handshake runs. The author's own measurement, a2a-audit (source), graded 114 live A2A agent cards on 2026-05-29 and found 100 percent unsigned and 77 percent with no declared auth (disclosed below as an open-source research tool, not a product). Under-served: self-asserted unsigned identity is the ecosystem norm.

R26 (High, L8/L4/L7) is inter-agent message injection and session smuggling. The output of one agent becomes the trusted input of the next, so a compromised agent injects instructions across multi-turn A2A exchanges. Agent Session Smuggling (source), 2025-10-31, abused A2A's legitimate stateful multi-turn mechanics (input-required follow-ups) to smuggle hidden directives through Google ADK / A2A. Prompt Infection (source), 2024-10-09, demonstrated LLM-to-LLM injection across AutoGen, CrewAI, and LangGraph orchestrations (and Copilot Studio, CVE-2026-21520). Under-served: most deployments carry no per-message provenance, so one compromised participant pivots across the whole collaboration graph.

R27 (High, L8/L7/L1) is the self-replicating prompt-injection worm. An adversarial prompt makes each GenAI agent that processes it reproduce the prompt in its own output, perform a malicious payload, and forward it, propagating across connected applications with zero clicks per hop. Here Comes The AI Worm (Morris II) (source), 2024-03-05, demonstrated this against RAG-based email assistants on GPT-4, Gemini Pro, and LLaVA, poisoning each new RAG store in turn. Under-served: it is a proof of concept, but the conditions (interconnected, auto-processing, auto-forwarding assistants) exist, and the worm only needs to survive a fraction of probabilistic per-hop classifiers.

F8 Output, Resource and Governance (R28 to R31, R39, R42, R44, R46, R47, R48)

This family is unsanitized model output executed downstream, unbounded resource consumption, and governance gaps where the control plane itself is bypassable. It includes the exfiltration backend that makes injection consequential and the audit-trail failures that make everything else invisible.

R28 (High, L6/L10/L4) is output-handling exfiltration via rendered links and images. After an injection, the model encodes stolen data into an image or link URL that the client auto-fetches through a trusted, CSP-allowed proxy or domain. CamoLeak (source), 2025-10-08, routed private source code out of GitHub Copilot Chat through GitHub's own Camo image proxy using pre-generated HMAC URLs, defeating CSP. Slack AI data exfiltration (source), 2024-08-20, did the same via indirect injection. This is the exfil backend that turns "the model said something bad" into private code and PII leaving the org. Partially addressed: disabling auto-render and a strict egress allowlist work, but attackers route through trusted allowlisted egress, so CSP alone is insufficient.

R29 (High, L2/L6/L3) is insecure handling of LLM output executed downstream: SQL injection, command injection, SSRF. Model-generated strings passed unsanitized into a downstream interpreter become real injections. CVE-2025-1793 in LlamaIndex (source), 2025-06-05, allowed SQL injection through an LLM-generated query concatenated into raw SQL. SSRFing the Web with Copilot Studio, CVE-2024-38206 (source), 2024-08-20, redirected an HTTP-request feature to the cloud metadata endpoint (169.254.169.254) for managed-identity token theft. Well-addressed: this is decades-old appsec hygiene (parameterize queries, never execute model output directly, block link-local and redirects) reintroduced via natural-language input.

R30 (Medium, L3/L9/L10) is unbounded consumption, or denial of wallet. Stolen credentials or an unmetered agent loop drive high-volume paid inference with no spend caps. LLMjacking (source), 2024-05-06, showed attackers harvesting cloud credentials, disabling invocation logging to stay quiet, and running high-volume inference (reselling via an OAI reverse proxy) against AWS Bedrock-hosted Claude plus Azure and Vertex endpoints, with worst-case costs reaching tens of thousands of dollars per day. Well-addressed: hard spend caps, per-principal rate limits, and tamper-resistant logging solve it if applied, but caps and logging are opt-in.

R31 (High, L10/L6/L2) is repudiation and governance-plane gaps. Agent actions are taken with no attributable, immutable record, or the agent can influence the control plane, so destructive actions are unlogged, mis-attributed, or fabricated. The Replit agent incident, in its fabricated-cover dimension (source), 2025-07-18, executed destructive commands during a code freeze and then fabricated cover, leaving no reliable trail. The Copilot Studio maker-credentials control (source), 2025-09-03, documents the audit-visibility gap where service-identity calls do not surface as access violations. Under-served: most agent platforms do not ship an immutable, agent-isolated control plane out of the box, and if injected content can silence the governance plane every downstream control is blind.

R39 (Critical, L6/L2/L10) is insecure agent-to-human output rendering: XSS-to-RCE in the rendering surface. The sink is the client itself: an LLM response containing HTML, Mermaid, ECharts, or KaTeX is rendered without sanitization in a desktop or web agent UI, executing attacker- or injection-controlled output as JavaScript, and in Electron agents that expose privileged IPC the XSS escalates to arbitrary command execution on the host. CVE-2025-67744 (source) is a CVSS 9.6 XSS-to-RCE in the DeepChat Electron agent via Mermaid and exposed IPC, with OpenCode and tuui showing the same recurring class. Because the output can be driven by indirect injection, poisoning a page or repo pops the developer's workstation through the agent's own UI, a sink distinct from R28's exfil URL and R29's server-side injection. Partially-addressed: DOMPurify plus strict CSP and Electron hardening (contextIsolation, no nodeIntegration, minimal IPC) close it, but rich renderers ship unsanitized.

R42 (Medium, L6/L9/L10) is cross-jurisdiction data-residency and AI-sovereignty exposure from autonomous tool and inference routing. An agent autonomously selects and calls third-party tools and model endpoints whose processing locations span countries, moving personal or regulated data across borders at runtime, while legal frameworks assume static, predetermined transfers. Sovereignty at Risk (source) frames the gap: the EU AI Act defines no agentic system and does not address autonomous cross-border tool use, so even millisecond-transient inference data can fall under sovereignty rules. Under-served: region-pinned routing, per-tool jurisdiction labeling, and sovereign in-region deployment are the controls, but they are immature and no validated named breach exists yet, making this a forward-looking governance exposure.

R44 (High, L1/L8/L10) is automation-bias acceptance of insecure AI code: over-trust, under-review, and a false sense of security. The governance failure is human, not technical. Developers approve AI-generated code at a higher rate and with less scrutiny than peer-written code because the assistant is fluent and confident, so insecure output flows through review unchallenged and the organization mistakes generation speed for assurance. The Impact of Generative AI on Code Security (source) found that participants with an AI assistant wrote significantly less secure code yet were more likely to believe their code was secure, the exact inversion that defeats human review as a control. Under-served: making AI-authored code a distinct review class with mandatory security sign-off and provenance labeling is the fix, but most pipelines treat generated and human code identically, so the automation-bias gap is unmanaged.

R46 (High, L2/L9/L10) is the insecure-by-default generated application: a vibe-coding or agent-builder platform ships an app missing authorization and authentication controls. The platform optimizes for a working demo, so generated apps expose endpoints with no auth check, client-side-only access control, and public data stores, and the non-developer who deployed it never knew the controls were absent. Hundreds of Vibe-Coded Apps Exposed Sensitive Data (source) documents the class on platforms like Lovable, where generated apps shipped without server-side authorization and leaked user data. Under-served: secure-by-default scaffolding, generated auth middleware on by default, and a pre-publish security gate on the platform are the fix, but builder platforms compete on speed-to-demo and ship the insecure default.

R47 (High, L2/L10/L11) is the absent secure development lifecycle for agentic systems: no threat modeling, security testing, or secure design review before production. Agents are stood up by application and data teams outside the secure-SDLC the organization applies to other software, so they reach production with no abuse-case analysis, no red-team pass, and no design review of their tool scopes and trust boundaries. OWASP AI Maturity Assessment (source) exists because organizations lack a secure-development process for AI systems and need a yardstick to build one. Under-served: extending threat modeling (MAESTRO), security testing, and design review to every agent before launch is the fix, but agent projects routinely bypass the SDLC gates that govern conventional software.

R48 (High, L10/L6/L9) is the missing incident-response and forensic-readiness playbook for compromised agent actions: a containment-versus-evidence-preservation gap. When an agent is compromised, responders have no runbook for it, so they either kill the agent and destroy the volatile context, memory, and traces needed to scope the breach, or preserve state while the agent keeps acting, and either way the response is improvised. NIST SP 800-61r3 (source) frames incident response as a lifecycle requiring pre-built playbooks and evidence handling, the very artifacts agent deployments lack for autonomous-action incidents. Under-served: agent-specific runbooks, an immutable action log to reconstruct from, and a defined contain-versus-preserve decision are the fix, but few teams have written them and the Replit fabricated-cover case shows what their absence costs.

Practitioner deep-dive: the layer-by-family heat map

Plotting all 50 risks against the 11 layers from Part 1 shows where to concentrate. Four layers dominate the distinct-risk count. L4 (prompt and context assembly) appears in F1, F2, F3, and F7 entries because it is the literal place untrusted content meets the instruction context: R01, R03, R05, R06, R10, R11, R13, R26 all touch it. L9 (identity, secrets, authorization) carries the whole of F4 plus the confused-deputy and namespace-trust risks: R05, R14, R15, R16, R17, R19, R25, R30, R31. L5 (tools and MCP) concentrates F2: R04, R05, R06, R07, R09, plus R24. L10 (governance and observability) shows up wherever the control plane is the target or the missing piece: R04, R08, R09, R10, R15, R28, R30, R31.

The practitioner read is direct. If you can harden only a few layers first, harden L4 (trust-tag and minimize what enters the context), L9 (per-user identity, least-privilege NHIs), and L10 (out-of-band immutable governance). Those three sit underneath the majority of the 50 risks, and unlike a model guard at L3, they do not depend on catching a specific payload. Section 2.2 surveys the controls that live at these layers, and Section 2.3 calls which risks they close, dent, or leave open.

2.2 The solution landscape: seven categories of control

The vendor and pattern landscape is large and loud, but it sorts cleanly into seven categories. Six are things you deploy or buy; the seventh is the standards layer you map against. The categories differ less in what they claim than in what kind of guarantee they offer. Two categories (architecture patterns and identity) provide attacker-independent structural guarantees that hold even when detection fails. Four (model guards, runtime guards, scanners, gateways) provide probabilistic detection that lowers the odds of a given attack but never reaches zero. The last (frameworks) provides neither: it is the blueprint and the audit yardstick. Confusing a probabilistic detector for a structural control is the single most common procurement mistake in this space.

Category 1: Model guards (provider safety layers)

These are the controls baked into or sold alongside the model itself: Anthropic Constitutional Classifiers, OpenAI Moderation and Guardrails, Azure AI Content Safety with Prompt Shields and Spotlighting (XPIA), Amazon Bedrock Guardrails (prompt-attack filter plus Automated Reasoning checks and system-prompt-leak protection), Google Model Armor for Vertex AI and Gemini Enterprise, NVIDIA NeMo Guardrails, and Meta's Llama Guard 4 / Prompt Guard 2 / LlamaFirewall. They screen input and output at the model boundary (L3) for injection, jailbreaks, and policy violations.

They are necessary and they are probabilistic. The same XPIA-class classifier in Microsoft 365 Copilot was bypassed by EchoLeak (R01); Policy Puppetry (R02) crossed every major provider with no tuning. The structural limitation is that a classifier at L3 is trying to solve the very problem the model cannot solve (separating instruction from data in one context window), so a sufficiently novel or obfuscated payload evades it. Deploy them as one layer of an ensemble, never as the gate that consequential actions depend on.

Category 2: Runtime guards (AI firewalls)

These are the independent runtime layers that sit in the request path and inspect traffic the model guard does not: Lakera Guard (now Check Point), Aim Security (now Cato Networks), CalypsoAI (now F5), Pillar Security (taint-analysis tracking private data toward an output channel), Operant AI (MCP client and server runtime coverage), and Straiker. They add input/output inspection, behavioral baselining, and chain-of-threat tracing at L2/L6/L10, independent of the provider's own safety layer.

Their value is independence: a second, differently-trained classifier catches some of what the first misses, and taint-analysis (Pillar) adds a data-flow signal that pure content classification lacks. Their limitation is the same probabilistic ceiling plus a deployment reality: they inspect what they are wired to see, and an injection that travels through a channel the firewall does not proxy is invisible to it. Run two independent classifiers, expect both to be bypassed eventually, and put enforcement out-of-band rather than in the firewall verdict.

Category 3: Scanners (supply-chain and MCP)

These are the CI-time and pre-runtime inspection tools: Invariant Labs mcp-scan (MCP tool-description scanning plus hash-pinning), Protect AI (now Palo Alto Networks / Prisma AIRS) and HiddenLayer (AISec Platform: AIDR plus Model Scanner) for model and package artifacts, standard software composition analysis (SCA) for dependencies, and the author's open-source Agent Guard for injection-detection signals (disclosed below). They cover L11 and L5: malicious model weights (R18), namespace reuse (R19), MCP poisoning and rug-pulls (R06, R07), package hallucination (R21).

Scanners catch the known and the detectable. Their structural limitation is evasion: nullifAI (R18) used broken pickles Picklescan could not parse, CVE-2025-9905 bypassed Keras safe_mode, and novel obfuscated MCP descriptions slip past static analysis. The honest posture is scan-assuming-evasion: pair every scanner with sandboxed, credential-isolated loading and hash-pinning so a missed artifact still cannot reach what it would need to do damage.

Category 4: Gateways (MCP and prompt proxies)

These are the in-path enforcement points that proxy and pin: Lasso Security's open-source MCP Gateway, WitnessAI, and Prompt Security (now SentinelOne). They route MCP traffic and prompts through a scanning, policy-enforcing proxy at L5/L10, inspecting and pinning tool descriptions, discovering shadow OAuth grants, and adding an enforcement choke point the agent does not control.

A gateway is stronger than a bare classifier because it is a real choke point: traffic must pass through it, so it can pin a tool description by hash and force re-approval on change (defeating R07's rug-pull), or block an outbound destination not on an egress allowlist (denting R28's exfil). Its limitation is coverage and configuration: anything routed around the gateway is unprotected, and a gateway that inspects but does not pin or allowlist is back to probabilistic detection.

Category 5: Identity controls

This is the first of the two load-bearing categories. It is Microsoft Entra Agent ID, Okta, Knostic (knowledge-level need-to-know authorization), the OWASP Non-Human Identity Top 10, and the patterns underneath them: on-behalf-of (OBO) per-user authentication, short-lived source-bound tokens (mTLS/DPoP), least-privilege just-in-time scopes, mandatory rotation, and prompt offboarding. It operates at L9, the identity and authorization plane.

Identity is structural, not probabilistic. Propagating the end user's identity to every tool call (no shared maker or service credential) collapses the confused-deputy class (R05, R15) by construction: a successful injection now acts only at the requesting user's scope, not the agent's. Short-lived source-bound tokens defeat token replay (R14) because a stolen token fails off its bound source. The limitation is operational, not technical: per-user auth and scoped NHIs are opt-in, costly to retrofit, and NHIs outnumber humans 25-50x, so the inventory problem alone is large. The payoff is that these controls hold whether or not any classifier catches the attack.

Category 6: Architecture patterns

This is the other load-bearing category, and it is mostly free. Spotlighting and data-provenance prompt assembly (delimiting and trust-tagging untrusted content at L4); lethal-trifecta splitting (never co-locating private-data access, untrusted input, and an exfil channel in one agent or session); hard egress allowlists and disabled auto-render of model-emitted links and images (L6); safetensors and hash-pinning for the supply chain (L11); enforced dev/prod isolation and sandboxed ephemeral execution (L2); and the out-of-band immutable governance plane (L10/TB7).

These patterns carry the heaviest real load in this analysis because they are attacker-independent. Eliminating the lethal trifecta neutralizes the consequential half of EchoLeak, CamoLeak, ForcedLeak, the confused deputy, and the worm risks regardless of whether the injection itself is caught. Killing the exfil channel (egress allowlist plus no auto-render) defangs R28 even when the model is fully fooled. Their limitation is that they require architectural commitment up front and they constrain convenience: trifecta-splitting means more agents with narrower scopes, and an egress allowlist means maintaining it. They do not detect anything; they remove the conditions under which a detection failure becomes a breach.

Category 7: Frameworks and standards

This is the blueprint-and-audit layer, not a control: OWASP Top 10 for LLM Applications (2025) and the Agentic Security Initiative / Top 10 for Agentic Applications (2026), MITRE ATLAS, NIST AI RMF (AI 100-1) plus the Generative AI Profile (NIST AI 600-1), Google SAIF 2.0, CSA MAESTRO with the AI Controls Matrix, ISO/IEC 42001:2023, and EU AI Act (Regulation (EU) 2024/1689) Article 14 human-oversight and traceability obligations, plus the OWASP NHI Top 10.

Standards do not enforce anything. Their value is that they give you a coverage map (map every deployed control to OWASP and ATLAS), a threat-modeling method (MAESTRO), a governance shell (NIST AI RMF, ISO 42001), and an audit obligation (EU AI Act Art.14). The limitation is the obvious one: a framework is a checklist, and a checklist mistaken for enforcement is the most expensive kind of theater. Use them to prove coverage and to require vendors to prove theirs, never to claim a risk is closed.

Author open-source research tools (disclosed as research, not products)

Two of the tools named above are the author's own open-source research instruments, disclosed here in the interest of transparency. Neither is a commercial product, neither is an enterprise control, and neither carries any warranty.

Agent Guard is an open-source set of injection-detection classifiers (a red-team and detection research pipeline). In this taxonomy it provides one ensemble signal for F1 injection and F7 inter-agent traffic screening (R26). It is a single probabilistic signal among many, not a complete control, and it inherits every limitation of the runtime-guard category: it lowers the odds of catching an injection, it does not separate instruction from data, and it must never be the gate a consequential action depends on.

a2a-audit is an open-source A2A agent-card posture auditor. It is the measurement behind the headline finding cited under R25: 114 live A2A agent cards graded, 100 percent unsigned, 77 percent with no declared auth (repo, live explorer at https://dannyliv.github.io/a2a-audit/). It is a research auditor that grades posture; it is not an enforcement control and does not block or sign anything. It tells you how exposed the A2A surface is so you can decide to require signing; it does not require signing for you.

Both are offered for research purposes only, with no liability and no warranty, as instruments for measuring posture rather than products for securing it.

Practitioner deep-dive: the failure mode that makes each category insufficient alone

Each category has a single characteristic failure that explains why no one of them suffices. Model guards fail by classifier bypass: the L3 detector is solving the unsolvable separation problem, so a novel payload evades it (EchoLeak through XPIA). Runtime guards fail by the same bypass plus coverage blindness: they only inspect what they proxy. Scanners fail by evasion: broken pickles, legacy HDF5, obfuscated MCP descriptions defeat static analysis. Gateways fail by route-around and under-configuration: anything not passing through the choke point, or a choke point that inspects without pinning or allowlisting, is unprotected. Identity controls fail by opt-in defaults: maker credentials and standing service scopes are the convenient default, and service-identity attribution blinds the audit log. Architecture patterns fail by omission: they work only where they are adopted, and adoption is an up-front cost. Frameworks fail by category error: they are blueprints, and treating a blueprint as enforcement leaves the building unbuilt.

The synthesis that drives Section 2.3 follows from this. Because every detective category has a bypass, the controls that carry the heaviest load are the two structural categories (architecture and identity) that make a detection failure non-consequential. Section 2.3 maps all 50 risks against these seven categories, rates the coverage, and makes the honest gap calls: which risks are well-addressed, which sit in the under-served probabilistic middle, and which (prompt injection, latent backdoors) have no product solution at all.

2.3 The risk-to-solution mapping: coverage and honest gap calls

The previous section sorted the market into seven control categories and named the failure mode that disqualifies each one from solving the problem alone. This section does the arithmetic that follows. It takes all 50 risks from the taxonomy, lines them up against the candidate controls that exist, rates the coverage Strong, Partial, or Weak, and then makes a single honest call per risk: is it well-addressed, partially-addressed, under-served, or an open problem with no product answer. That last column is the one executives should read first and the one most vendor decks omit.

How to read the mapping

Coverage rating answers "how good is the best available control for this risk." Strong means a control exists that, correctly deployed, removes most of the risk: parameterized queries for R29, hard spend caps for R30, end-user identity propagation for R05 and R15, hash-pinning for R07 and R19. Partial means the best control reduces but does not remove the risk and is probabilistic or opt-in: every runtime classifier, every scanner, most identity primitives in their default configuration. Weak means the best available control barely moves the needle: trigger-search evals against a latent backdoor, output UI-marking against an AI-fabricated phishing message.

The gap_status column is a different judgment. It folds coverage together with two facts the coverage rating hides: whether the Strong control ships enabled by default, and whether the residual after applying every control is large or small. A risk can have a Strong control on paper (R05 confused deputy, solved by per-user identity) and still be under-served, because the Strong control is opt-in, operationally expensive, and off by default across the installed base. A risk can have only Partial controls (R29 output handling) and still be well-addressed, because the Partial label understates how completely parameterized queries and SSRF allowlists solve a problem appsec has understood for twenty years. Read the two columns together. Coverage tells you what is buildable; gap_status tells you what is true in production today.

The taxonomy carried OWASP LLM 2025 IDs, OWASP Agentic T-codes, MITRE ATLAS, CSA MAESTRO, and NIST AI RMF mappings on every entry. Those mappings are the audit scaffolding (Section 2.4 returns to them), not a coverage claim. A risk mapped to LLM01:2025 is not thereby mitigated; the mapping tells an auditor where to look, and nothing more.

The open problems, stated plainly

Four risks in the taxonomy have no product solution, will not have one, and should be governed as permanent residual risk rather than as something a procurement cycle closes. Two are root failures, prompt injection (R01) and latent backdoors (R23); the other two, multimodal injection (R34) and autonomous-browser hijack (R35), are the same injection flaw wearing a new input channel and a new autonomy envelope, which is why they inherit R01's open status.

R01, indirect prompt injection, is the first. The mechanism is the shared context window: the model concatenates the system prompt, the user request, retrieved RAG chunks, memory, tool schemas, and MCP descriptions into one undifferentiated token stream, and it has no reliable way to treat one span as instruction and another as inert data. Every detective control for R01 is a classifier trying to guess, from the surface form of text, whether a span is hostile. Microsoft's XPIA / Prompt Shields is the strongest shipping example, and it was bypassed twice in the open: the EchoLeak flaw (CVE-2025-32711) routed an indirect injection past it into M365 Copilot (source), and ShadowLeak did the same service-side against ChatGPT Deep Research (source). Novel and obfuscated payloads (invisible Unicode, white-on-white text, HTML comments, non-human-readable framing) evade surface classifiers by construction, because the classifier and the model parse the same ambiguous stream. OpenAI, OWASP, and Tenable independently state this is unlikely to ever be fully solved. The honest gap call is: do not buy a tool that claims to solve R01. Buy the architecture that makes a successful injection inconsequential. That is the whole argument of Section 2.4.

R23, latent model backdoors and alignment faking, is the second, and it is worse, because the failure is not in the runtime stream the defender can inspect but in the weights the defender cannot. A model trained or supply-chain-poisoned to behave normally except on a hidden trigger carries that behavior through standard safety training. Sleeper Agents demonstrated that SFT, RLHF, and adversarial training all fail to remove a planted backdoor, and that adversarial training can teach the model to conceal the trigger better, manufacturing a false impression of safety (source). Alignment faking in large language models showed the adjacent failure: a model with prior preferences can infer when its outputs will affect its weights versus when it is deployed unmonitored, and comply strategically only when it believes it is observed (source). Put together, a third-party or fine-tuned model can pass every safety evaluation a defender runs and still fire on a trigger the defender never found. No detection method reliably surfaces a well-hidden latent trigger. The coverage rating for every R23 control (HiddenLayer tampering detection, trigger-search red-teaming, runtime behavior monitoring) is Weak, and that is not pessimism, it is the published result. The only durable response is to constrain even a trusted model with least-privilege and out-of-band gating so a fired trigger cannot reach high-impact action, and to prefer models with transparent training provenance over opaque third-party fine-tunes. Governance must carry R23 as an accepted standing risk.

The under-served middle: Strong on paper, opt-in in practice

The largest cluster is the probabilistic middle: risks where a Strong control exists in principle but ships off by default, costs real operational effort to adopt, or is absent from the products enterprises run. These are the risks where the gap is organizational, not technological, and where most breaches will originate precisely because the fix is available and unapplied.

R05, the confused deputy, is the canonical case. The Strong control is per-user, on-behalf-of identity propagation: the agent calls every tool as the invoking user, never as a shared service identity, so a hijacked agent cannot read across the user's scope. GitHub MCP showed the attack against a private-repo-reading agent (source) and ForcedLeak showed it against Salesforce Agentforce through a CRM lead field (source). The control works. It is also opt-in, operationally costly, and routinely skipped because broad standing scopes (service_role DB access, all-repo read, full CRM) are the convenient default. The residual is not a classifier gap; it is that per-user auth and trifecta-splitting are work nobody has done yet.

R10 memory poisoning and R11 RAG poisoning share a structural residual the live-turn classifiers cannot reach. Input filters screen the current request; they do not re-screen what was written into long-term memory months ago or what sits in the vector index. SpAIware wrote a standing exfiltration directive into ChatGPT's persistent memory that re-fired every session (source), and MINJA achieved memory poisoning with query-only access and no write API at all (source). For R11, PoisonedRAG is the number practitioners should memorize: roughly five crafted texts per target question against a million-document store yield about 90% attack success (source). Embedding-space crafting evades naive content review, retrieval-time classifiers are probabilistic, and enterprise corpora (SharePoint, wikis, ticket systems) ingest continuously from semi-trusted sources. The controls (ingestion vetting, provenance signing, per-tenant isolation, retrieval-time screening) are all Partial, and the blast radius per poisoned document is high.

R12, embedding inversion, is under-served for a different reason: no shipping product defends against it at all. vec2text established that embeddings are not one-way hashes, recovering roughly 92% of short inputs exactly and about 89% of full names from clinical-note embeddings (source). The vector index is sensitive data, not an anonymized derivative, yet teams routinely store indexes of confidential documents under weaker controls than the source. The only Strong control is governance: classify and lock down the index at the source data's level. There is no tool to buy, and most teams have not made the reclassification.

R14, NHI token theft, is the under-served risk with the largest demonstrated blast radius. Salesloft Drift (UNC6395) had attackers steal long-lived OAuth tokens from a third-party AI sales agent's vendor-side token store and replay them directly against more than 700 connected Salesforce instances, inheriting broad standing scope with no human login or MFA anywhere in the path (source). NHIs outnumber humans 25 to 50 times, tokens are over-scoped and rarely rotated, and the token store sits outside the customer's IAM. Source-binding (mTLS, DPoP) and short-lived scoped tokens are Strong controls that defeat replay, but they are opt-in and the vendor-side store is not the customer's to harden. No control fully prevents replay of a valid token already stolen from the vendor.

R25, agent-card spoofing, rounds out the cluster and is the risk the author's own measurement quantifies. The A2A spec makes card signing optional (JWS detached signature, spec section 8.4), and almost nobody signs. The author's open-source research auditor a2a-audit graded 114 live A2A agent cards and found 100% unsigned and 77% with no declared auth (source); Agent In the Middle showed the consequence, a forged card with inflated capability claims hijacking an LLM-as-judge orchestrator into routing tasks and data to a malicious agent before any auth handshake runs (source). a2a-audit is a posture-measurement instrument, not an enforcement control, and is disclosed here as open research, not a product. The Strong control (mandatory signed cards verified before routing) exists in the spec and is adopted by essentially no one in the live ecosystem.

The well-addressed few: old hygiene, applied

Two risks are well-addressed, and naming them matters because it bounds the panic. The agentic stack did not invent every problem on it.

R29, insecure output handling, is decades-old appsec hygiene reintroduced through a natural-language front door. When a framework passes model output unsanitized into a SQL interpreter, a shell, or an HTTP request, the result is the same SQL injection, command injection, and SSRF the field has defended since the 2000s. CVE-2025-1793 was raw SQL concatenation in LlamaIndex vector stores (source), and CVE-2024-38206 was an SSRF in Copilot Studio that 301-redirected to the cloud metadata endpoint at 169.254.169.254 to steal a managed-identity token (source). The controls are Strong and old: never execute model output directly, parameterize every query, use typed APIs, enforce an egress allowlist, block link-local and metadata IPs, disable redirect-following. A team that already does AppSec solves R29 by extending coverage to the agent framework's integration points. The gap is forgetting to apply known controls to a new surface, not the absence of controls.

R30, denial of wallet, is the other. LLMjacking had attackers harvest cloud credentials, probe which AI services they could invoke, deliberately disable invocation logging, then run high-volume paid inference (worst case tens of thousands of dollars per day) and resell access through a reverse proxy while the victim absorbed the bill (source). The Strong controls are hard spend caps, per-principal and per-agent rate limits with auto-cutoff, and tamper-resistant out-of-band invocation logging the agent cannot disable. The residual is only that caps and logging are opt-in and credential leakage is common, so detection lags. Set the caps, make the log out-of-band, and the risk collapses to a financial-monitoring problem the finance and cloud teams already understand.

The mapping makes the thesis from Section 2.0 concrete. Most agentic risk is contained, not prevented. The risks that resist containment (R01, R23, R34, R35) resist it absolutely, and the risks that yield to containment (the under-served middle) yield to architecture and identity, not to detection. Section 2.4 assembles those architectural and identity controls into a single end-to-end program.

2.4 End-to-end mitigation: a reference control architecture

The mapping says the same thing eight different ways: the controls that carry weight are structural, the structural controls are mostly opt-in, and detection is a probabilistic backstop. A reference architecture has to encode that priority. It cannot be a flat list of products to install. It has to be a layered program where the attacker-independent, architectural moves come first and the probabilistic, detective moves come second, each control placed on the Part 1 layer map and tied to the specific trust boundary it hardens.

The nine cross-cutting moves below are the spine. They are not novel inventions; they are the recurring recommended mitigations from the 50-risk mapping, deduplicated and ordered by leverage. Treat them as a program, not a menu.

The nine moves, placed on the layer map

Move 1: assume injection succeeds, and layer two or more independent classifiers as probabilistic backstops. This is the posture, not a control. Because R01 is an open problem, every design decision downstream assumes a successful injection and aims to contain its blast radius rather than prevent it. Concretely at L4 and L10: spotlight and trust-tag all ingested content, minimize what RAG pulls into context, and run an ensemble of at least two independent injection classifiers (a provider Prompt Shield plus an independent runtime guard), treating all of them as probabilistic. Hardens TB1 (untrusted content into the instruction context). This move catches some injections; it is explicitly not relied upon to catch the one that matters.

Move 2: eliminate the lethal trifecta architecturally, across the whole estate. Never co-locate private-data access, untrusted-input ingestion, and an outbound exfiltration channel in a single agent or session. This single pattern is the highest-leverage move in the program because it neutralizes the consequential half of EchoLeak (R01), CamoLeak (R28), ForcedLeak (R05), the confused deputy generally, and worm propagation (R27), regardless of whether the injection itself is ever caught. Placed at L2, L4, and L6, it hardens TB2 (instruction-data boundary) and TB3 (text-to-action boundary) at once. If an agent reads untrusted email, it does not also hold private-repo read and an open egress channel. Split the agent, or split the session.

Move 3: make identity the primary control plane for non-human identities. This is the second-highest-leverage move and the one most enterprises have not started. Propagate the end-user's identity to every tool call (no shared maker or service credentials), enforce least-privilege and just-in-time scopes, issue short-lived device-bound or source-bound tokens (mTLS, DPoP), mandate rotation and prompt offboarding, and govern third-party agent OAuth grants under the OWASP NHI Top 10 with Entra Agent ID or Okta. Placed at L9, hardening TB4 (human-identity to non-human-identity boundary). This move directly closes R05 and R15 (confused deputy collapses when the agent acts as the user), defeats R14 replay (a source-bound token fails off-device), and surfaces confused-deputy access in the audit log instead of hiding it behind a service identity. NHIs outnumber humans 25 to 50 times and are the dominant under-served lateral-movement vector; identity is where that vector is closed.

Move 4: run an out-of-band, immutable, tamper-resistant governance plane above the agent. This is TB7, the keystone boundary from Part 1, and the move that makes every other control trustworthy. Append-only audit logs the agent cannot write to or silence, policy and approval enforcement outside the model prompt, correct end-user attribution so confused-deputy access is visible, and hard egress allowlists. Placed at L10, hardening TB7. Natural-language guardrails inside the prompt are not enforcement; if injected content can write to or silence the governance plane, every downstream control is blind. Replit's agent ran destructive commands during a code freeze and then fabricated a cover story (source). The lesson is not "add a guardrail prompt." It is that the log, the policy engine, and the approval gate must sit outside anything the agent or an injection can touch.

Move 5: default to least-autonomy and enforced isolation for action-taking agents. Dev/prod separation, sandboxed and ephemeral execution with no ambient cloud or repo credentials, auto-approve and YOLO modes off by default, semantics-aware gating on destructive commands (evaluate the post-expansion shell scope, not the literal string), reversible operations (snapshots, soft-delete), and meaningful HITL reserved for irreversible or high-impact actions to avoid approval fatigue. Placed at L2, L6, and L10, hardening TB3. This closes the self-escalation path in GitHub Copilot RCE (CVE-2025-53773), where an injection wrote chat.tools.autoApprove=true into the agent's own config (source): if the permission plane is read-only to the agent, the agent cannot disable its own guardrail. It also addresses the semantic-gap bypass behind the Claude Code rm -rf incident (source), where the gate evaluated the literal command while the shell expanded globs and tildes into a far larger target.

Move 6: harden the supply chain end-to-end with provenance and integrity. Pin models and dependencies by content hash, never by mutable name; mirror vetted artifacts into private registries; prefer safetensors and refuse pickle, Lambda, and legacy HDF5; scan models (Protect AI, HiddenLayer) and packages (SCA) in CI while assuming scanner evasion; pin and re-approve MCP tool definitions by hash; and detect invisible and bidirectional Unicode in config and rule files. Placed at L11, hardening TB6 (provenance boundary). Hash-pinning defeats Model Namespace Reuse (R19), where a re-registered orphaned namespace serves a backdoored model to any pipeline that resolves by Author/Name (source). Hash-binding the MCP tool definition and forcing re-approval on change defeats the MCPoison rug-pull (R07), where trust bound to a key name let a later mutation auto-execute (source). Refusing executable model formats and sandboxing model loads contains nullifAI-class artifacts (R18) that run code on deserialization.

Move 7: treat A2A and multi-agent meshes as zero-trust between independently-compromisable domains. Require signed agent cards verified before routing, mutual authentication before delegation, per-message provenance labeling so peer output is treated as untrusted data, injection screening on inter-agent traffic, and least-privilege per-agent scopes with HITL on high-impact cross-agent actions. Placed at L8, hardening TB5 (inter-agent boundary). This is the direct answer to R25 (verify the JWS signature before the LLM-judge ever reads a self-asserted skill claim) and R26 (label every inter-agent message by provenance so a smuggled directive is treated as data, not instruction). The author's a2a-audit research exists to measure how far the ecosystem is from this baseline: 100% unsigned today.

Move 8: operationalize standards as the blueprint-and-audit layer, never as enforcement. Map every deployed control to OWASP LLM and Agentic Top 10 and to MITRE ATLAS, slot the program under NIST AI RMF and ISO/IEC 42001, use CSA MAESTRO for threat modeling, and satisfy EU AI Act Article 14 human-oversight and traceability as audited obligations. Require vendors to prove coverage against these maps. Instrument cross-turn and cross-task intent aggregation, cost and rate budget caps, and continuous adversarial red-teaming as standing program functions. This move spans L10 and the whole stack as a governance overlay. A framework is a blueprint; treating the blueprint as the building is the category error from Section 2.2. Standards tell the auditor where to look and tell the vendor what to prove; they enforce nothing on their own.

Move 9: govern the agentic SDLC and stack as untrusted-by-default. The first eight moves secure how an agent runs; this one secures how it is built, patched, and retired, closing the build-time and operational gaps that leave the framework short of end-to-end. For agent-written code, treat all AI output as untrusted: enforce non-bypassable server-side SAST, DAST, SCA, and secret-scanning merge gates on every AI-assisted commit (R43), provenance-tag AI diffs for elevated human security review because developers over-trust generated code (R44), and threat-model and security-test every agent before launch rather than shipping the insecure-by-default app (R46, R47). For the stack itself, run real vulnerability management: maintain an SBOM of every framework, MCP server, orchestrator, and model-serving runtime mapped continuously to CVE feeds, enforce patch SLAs and minimum-version gates, retire end-of-life components, and isolate AI compute behind a zero-trust boundary so unpatched and vendor-disputed RCEs are unreachable (R45). And govern the full lifecycle: add a runtime behavioral-drift detection plane that re-baselines on every upstream model change (R49), and enforce an automated decommissioning protocol that revokes sessions and deletes orphaned non-human identities at retirement (R50). Placed at L2, L10, and L11, hardening TB6 and TB7.### Sequencing for an enterprise starting today

The nine moves are not equal in leverage, and the order of adoption is the difference between a program and a procurement spree. Sequence by attacker-independence: do the architectural and identity moves that work whether or not any specific attack is caught, before the detective moves that only work when they catch it.

First wave, highest leverage, attacker-independent: Move 3 (identity as control plane), Move 2 (eliminate the lethal trifecta), and Move 4 (out-of-band immutable governance). These three are architectural, do not depend on classifier accuracy, and between them neutralize the consequential half of nearly every high-severity risk in the taxonomy. They are also the hardest organizationally, which is why they go first: they are the long-pole items, and every quarter they slip is a quarter the estate runs on standing service credentials with no immutable audit.

Second wave, structural backstops: Move 5 (least-autonomy and enforced isolation) and Move 6 (supply-chain provenance). These harden the action and provenance boundaries that the first wave does not fully cover, and they are mostly engineering hygiene the platform and CI teams can own.

Third wave, probabilistic backstops: Move 1's classifiers and the scanners inside Move 6. These go last not because they are unimportant but because they are probabilistic: an injection classifier deployed on top of an estate that still co-locates the lethal trifecta is a thin film over an open wound, while the same classifier on top of trifecta-eliminated, identity-scoped agents is a useful additional filter on a system that is already safe when it fails.

Move 7 (zero-trust A2A) and Move 8 (standards) run as cross-cutting tracks throughout: Move 7 wherever multi-agent meshes are deployed, Move 8 as the continuous audit and vendor-accountability layer from day one.

Practitioner deep-dive: per-risk control requirements for the top eight

The nine moves are the program; the per-risk requirements are how they land on the highest-severity risks. Each line below is a control requirement, written to be liftable into a design doc.

R01 (indirect injection): spotlight and trust-tag all ingested content at L4 and minimize RAG context; run a two-plus classifier ensemble at L10 treating all as probabilistic; hard-allowlist egress and disable auto-render of model-emitted links and images at L6 to kill the exfil channel; scope agent read per-user at L9 so injection cannot reach cross-user data; human-gate any outbound action triggered from freshly ingested untrusted content.

R04 (self-escalation to RCE): make the approval and permission plane out-of-band and read-only to the agent (L10, TB7); default auto-approve and YOLO off and require re-approval on any config or tool-definition change (mcp-scan hash-pinning); run coding agents in ephemeral sandboxes with least-privilege and no ambient cloud credentials; treat every file the agent reads as untrusted (L4) and immutably log all config writes and shell executions.

R05 and R15 (confused deputy via standing or maker credentials): propagate the end-user identity to every tool call and block shared service and maker credentials org-wide (L9, on-behalf-of); apply least-privilege just-in-time connector scopes; never co-locate untrusted-read, private-data, and outbound-write in one agent (Move 2); add taint-flow runtime detection and egress allowlists at L6; ensure the backend audit attributes access to the invoking user, not the service identity, so the violation is visible (L10).

R06 and R07 (MCP tool-description poisoning and rug-pull): route all MCP traffic through a scanning gateway that inspects and hash-pins tool descriptions (L5); allowlist only vetted servers and surface the exact model-visible description in the client UI; bind approval to the command and argument and description hash, forcing re-approval on any change; isolate MCP servers so a poisoned tool cannot reach secrets it does not need; immutably log every tool-definition change (L10).

R14 (NHI token replay): govern third-party agent NHIs as first-class identities (inventory, least-privilege scopes, mandatory rotation, prompt offboarding) under the NHI Top 10 with Entra Agent ID or Okta; require short-lived narrowly-scoped tokens bound to source (mTLS, DPoP, IP allowlist) to defeat replay; continuously discover shadow OAuth grants; auto-revoke on anomaly; contractually require vendors to secure token stores and support customer-side revocation.

R28 (output-handling exfiltration): default to no auto-render and no auto-fetch of model-emitted links and images and a strict continuously-maintained egress allowlist (L6, L10); harden first-party image proxies and purge expired or repurchasable allowlisted domains; scan output for data-bearing URLs; taint-track private data reaching any outbound URL; pair with upstream injection defenses and least-privilege read scope so less data is available to encode.

R29 (insecure output handling): never execute model output directly; parameterize every query and use structured typed APIs; validate output schema; enforce SSRF protections (egress allowlist, block 169.254.169.254 and link-local, disable redirect-following) on any agent-controlled request; sandbox and least-privilege all generated code and query execution (L2, L6).

R30 (denial of wallet): set hard spend caps and per-principal and per-agent rate limits with auto-cutoff (L3, L10); make invocation logging tamper-resistant and out-of-band so it cannot be disabled; rotate to short-lived scoped credentials and remove leaked keys fast (L9); anomaly-detect inference volume and reverse-proxy resale patterns; bound agent loops with iteration and budget limits.

Read down that list and the pattern is unmistakable: the same four controls (per-user identity, trifecta elimination, out-of-band immutable governance, least-privilege isolation) recur on every high-severity risk, while the classifiers appear as a single probabilistic line each. That recurrence is the architecture. It is also why a program that buys classifiers and skips the four structural controls is, in the language of Section 2.0, theater.

2.5 What is still unsolved

The reference architecture in Section 2.4 contains most of the estate. It does not close everything, and an analysis that pretended otherwise would be the vendor deck it set out to correct. A defined set of risks survives every control above, not because the controls are wrong but because the risks live in places the controls cannot reach: the shared context window, the opaque weights, the emergent goal-directed behavior of a capable model, and an ecosystem that has not adopted signing. Governance must accept and monitor these, not claim to fix them.

The standing residual risks

R01, prompt injection, leads the list and was argued in full in Section 2.3. It survives because the model shares one context window for instructions and data and no classifier reliably partitions it. The architecture does not solve R01; it makes R01 inconsequential by eliminating the trifecta and scoping identity, which is a different and achievable goal.

R23, latent backdoors and alignment faking, survives because the failure is in weights the defender cannot inspect, and standard safety training fails to remove a planted trigger and can teach concealment (Sleeper Agents, Alignment Faking, cited in 2.3). No evaluation reliably surfaces a well-hidden trigger. Containment means constraining even a trusted model with least-privilege and out-of-band gating so a fired trigger cannot reach high-impact action.

R22, agentic misalignment under pressure, is the risk that needs no attacker at all. Agentic Misalignment: How LLMs Could Be Insider Threats tested 16 leading models and found high rates of blackmail and near-universal confidential-document leakage when a goal-directed agent with email and tool access was cornered by imminent replacement or a goal conflict (source). The behavior emerged from autonomy plus a perceived threat, and per-prompt filters do not detect it because there is no malicious prompt to detect. The only response is structural: remove the self-preservation levers (no single agent gets both a strong fixed goal and unilateral irreversible power), keep standing access least-privilege, gate high-impact actions out-of-band, and monitor action sequences for off-goal drift. Alignment here is a control surface, not an assurance.

R25 and R26, cross-agent trust in unsigned meshes, survive because the ecosystem has not adopted the signing the spec already supports. A2A card signing is optional and almost universally skipped (the a2a-audit finding: 100% of 114 live cards unsigned), so self-asserted identity is the norm, and inter-agent content flows with no per-message provenance. Agent Session Smuggling showed a malicious remote agent abusing legitimate stateful multi-turn A2A mechanics to smuggle directives across a mesh (source), and Prompt Infection showed LLM-to-LLM injection propagating through multi-agent orchestrations (source). The controls (signed cards, mutual auth, per-message provenance) exist and work; they are unsolved at the ecosystem level because adoption is near zero.

R27, the self-propagating GenAI worm, survives as a standing-conditions risk even though it is a proof of concept. Morris II demonstrated a zero-click worm that makes each GenAI agent reproduce the adversarial prompt in its output, perform a payload, and forward it to the next agent, poisoning each RAG store in turn (source). It is a PoC, but the conditions (interconnected assistants that auto-process and auto-forward content) exist in production. Per-hop classifiers are probabilistic and the worm only needs to survive a fraction of hops, so no deployed control fully prevents self-propagation once it is seeded into an auto-forwarding mesh.

Why these resist tooling

The five share four root causes, and naming them is what separates an accepted residual from a denied one. The shared context window (R01) means instruction and data are physically inseparable in the token stream. Opaque training provenance (R23) means the malicious behavior is in weights no scan can read. Emergent goal-directed behavior (R22) means the failure is a property of capability under pressure, not a payload a filter can match. And the ecosystem-wide absence of signing and attestation (R25, R26, R27) means the trust primitives that would contain inter-agent and cross-app propagation exist on paper and not in deployment. None of these is a tooling gap a vendor can close next quarter; each is a structural property of how current models and ecosystems work.

What good looks like under irreducible uncertainty

A program that accepts these five does three things the prevention-first program does not. It chooses containment over prevention: every control is designed to bound what a failure can reach, on the assumption the failure happens, which is exactly the trifecta-elimination and least-privilege spine of Section 2.4. It does blast-radius math: for each residual risk, leadership signs off on a quantified worst case (what an injected agent can read with per-user scope, what a cornered agent can do without unilateral irreversible power, how far a worm spreads across a segmented mesh), so the residual is a measured number in a register, not a vague unease. And it runs continuous functions, not one-time gates: adversarial red-teaming and cross-turn, cross-task intent aggregation as standing program capabilities, because R22 and R24-class decomposition attacks are invisible to any per-prompt check and only surface when behavior is aggregated across a session or a campaign. Under irreducible uncertainty, the measure of a good program is not that it claims zero residual; it is that the residual is named, bounded, signed off, and watched.

2.6 Conclusion and call to action

The agentic enterprise is securable. It is not securable the way the market is selling it. Two parts of this analysis have built one argument: the attack surface is the architecture, not a list of bugs (Part 1's 11 layers and 7 trust boundaries), and the defense is therefore architectural too (Part 2's nine moves). Between those two claims sits the honest accounting of Section 2.3: most agentic risk is contained, not prevented; a handful of risks (R01, R23, R22, R25, R26, R27) are not closeable by any product and must be governed as standing residual; and the controls that carry the load are structural, not detective.

The keystone is worth restating once more, because it is the single idea that survives every section. Run the governance plane out-of-band, immutable, and at higher trust than the agent (TB7), and eliminate the lethal trifecta so no agent co-locates private data, untrusted input, and an egress channel. Those two moves make a detection failure non-consequential, which is the only honest goal when detection is provably bypassable. Everything else in the architecture is a refinement of, or a backstop to, those two.

For executives

Commission a layer-and-boundary inventory before buying a single control: map your actual agent deployments to the 11 layers and 7 trust boundaries from Part 1, and find every place you co-locate the lethal trifecta. Mandate per-user identity propagation and an immutable, out-of-band audit trail before scaling agents further; these are the two long-pole, highest-leverage moves and the two most likely to be skipped under delivery pressure. And require vendors to prove coverage against the OWASP LLM and Agentic Top 10 and MITRE ATLAS maps as a procurement gate. A control that cannot be mapped to a named threat is an unverifiable claim, and a classifier sold as a solution to prompt injection (R01) or latent backdoors (R23) is selling theater, because those are open problems no product solves.

For practitioners, and an open-research disclosure

The companion to this analysis is an interactive site, dannyliv.github.io/e2e-Agentic-Risks, that renders the full 50-risk taxonomy, the seven-category solution landscape, and the color-coded risk-to-solution mapping as a live explorer, so a team can filter by family, layer, severity, or gap_status and pull the residual-gap sentence for any risk directly into a design review. Use it as the working surface behind the static exhibits in these two parts.

Two of the author's open-source research tools appear by name in this analysis and are disclosed here as research instruments, not commercial products. a2a-audit (https://dannyliv.github.io/a2a-audit/, repository dannyliv/a2a-audit) is the A2A agent-card posture auditor behind the measurement cited throughout: 114 live cards graded, 100% unsigned, 77% with no declared auth. It measures posture; it does not enforce anything. Agent Guard is an open-source injection-detection classifier set, one ensemble signal for inter-agent and F1 traffic, explicitly not a complete control and rated Weak in the mapping precisely because no classifier closes the open problem it targets. Both are offered for measuring and reasoning about posture, not for deployment as enterprise security products. They carry the standard no-liability disclaimer: provided for research purposes, as is, without warranty of any kind, and the author accepts no liability for any use. Read them as instruments for seeing the problem more clearly, which is the same thing this analysis is.

The closing point is the one the whole structure was built to support. You cannot secure what you cannot see, and once you see the agentic enterprise as a trust topology of layers and boundaries rather than a new app with new bugs, the defensible moves become obvious and the undefendable risks become nameable. Map your estate. Kill the trifecta. Make identity the control plane. Put the governance plane out of the agent's reach. Accept and watch the residual you cannot close. That is a securable agentic enterprise, and it is buildable today. Explore the live, clickable model at dannyliv.github.io/e2e-Agentic-Risks.