The complete
engineering reference.

Before runtime, the adversary's work is to get a capability into the registered release or to bypass registration altogether: a poisoned tool definition, a package that turns malicious after adoption, inflated trust signals, a modified configuration, a model whose alias hides a substituted deployment. 6.16 verifies digests and signers, 6.14 evaluates the exact release, 6.13 enrolls an owner and a bounded delegation, and 6.15 makes the activation decision. An agent that skipped step 0 has no manifest to be checked against.

The adversary needs a sentence to arrive inside the operating envelope. They do not need an account: a lead form, a public issue, a ticket field or a web page the agent will read is enough. ServiceNow, ForcedLeak and GitHub MCP all begin here.

The adversary wants the sentence to survive and to be retrieved under someone else's authority. Poisoned RAG entries, poisoned memory and over-broad retrieval scope convert a one-time injection into a standing one. Asana's flaw sat here: retrieval ignored the tenant boundary.

Context assembly is where the sentence becomes a plan. Delimiters are discovered and defeated, instructions are obfuscated or delayed, and the model proposes recruitment, retrieval or a tool call that looks like task completion.

The adversary needs the proposal to be allowed. In the incidents here it was, because there was no independent gate: auto-approval was on (GitHub), the recruiting feature was authorized by default (ServiceNow), or the destructive command needed no approval (Replit). Discovery of configuration, teammates and runtime capabilities happens here.

Tool invocation is the objective. Agent-to-agent communication is lateral movement; a write tool is the exfiltration channel; a mutative tool is destruction. A rendered image tag is exfiltration that never touches a tool at all.

The adversary's last need is for the record to agree with them. Fabricated test results, manipulated citations, edited chat history and an agent that is its own only witness all defeat phase 6. The SIEM / AI-DDR workflow exists so that producers, not the model, write the evidence.

Once a warning fires, the adversary's objective is to survive it: keep a child agent running after the parent is revoked, reconstruct the operating environment after a reset, leave tasking in a shared artifact for the next run, or hold a grant on an agent nobody retired. Step 7 answers with an independent response owner, an approved interruption that revokes or narrows credentials, verification that running and queued work actually stopped, a recovery test, a notice and recourse assessment, and a retirement record that closes the registry so reactivation needs fresh approval.

Every material source is instrumented and captured independently as the task runs; collection and retention stay outside the controlled agent's write authority. Coverage and loss records name the missing sources rather than implying complete visibility. The lab's telemetry notes make the point per component: an execute_tool span alone does not prove the effect; a source ID alone does not prove the corpus contents; a missing record ID is not proof of deletion.

Preserve event meaning, origin, time and delegated identity when joining activity across models, agents, retrieval, tools and targets. This is where a recruitment chain becomes visible as one trace with a privilege direction, and where a single token used across many targets shows up as one principal.

Compare the observed task with its approved baseline and hard boundaries; distinguish a suspected anomaly from a confirmed violation. Record detection version, supporting events, confidence, business impact and known blind spots. The baseline is the registered manifest and delegation envelope from step 0, which is why detection without attestation has nothing to compare against.

Route material warnings to the appropriate responder. Pre-authorized automation may contain an event, but the decision rule, scope and accountability stay explicit and recorded. The adversary's play here is trust exploitation: fabricated status, impersonated approvers, delayed execution timed past the review.

The independent control plane revokes or constrains the affected execution paths, and the resulting state is confirmed rather than equating a sent command with containment. Check child agents, credentials, scheduled jobs, memory and downstream effects. This is the step that answers the inter-agentic question directly: did the teammates stop too?

Reconstruct the incident, remove its cause and persistence, and validate return-to-service conditions before resuming affected work. Document integrity tests, residual risk, release authority and heightened monitoring. For a poisoned memory or RAG index this is where the persistence is actually removed.

Findings become owned decisions and corrective action; material risk and unresolved warnings reach the board or its designated committee; the approved baseline feeds the next monitoring cycle. In v13.4 this is the handoff into step 7 of the harness: notice and recourse assessment, retirement, and a registry that requires fresh approval to reactivate.