Anatomy of an Agent Breach
Six attack vectors. One vulnerable agent. This report draws on 3,005 labeled attack prompts from the FinProof BFSI benchmark and live community submissions to map how agentic AI systems fail under adversarial pressure.
Benchmark corpus
3,005
Community rounds
0
Community breaches
0
Attack categories
B-01–D-11
Attack Surface Taxonomy
Prevalence in FinProof corpus · Attacker win rate against bare defender
Most common entry point. Agent treats injected ticket bodies as authoritative ops queue entries.
Canary-extraction prompts succeed when maintenance instructions are appended to system context.
Highest success rate. Payload injected into tool result JSON as workflow_continuation bypasses RLHF guards entirely.
Highest privilege escalation. Model reads tool schema as trusted system context — directives in descriptions execute without user input.
Effective only when poisoned content is retrieved in-context (MINJA). Dormant injections never fire.
Each hop individually authorized. The assembled chain is not. Per-hop auth checks are blind to cross-hop data assembly.
Defense Effectiveness
Attacker breach rate drops as guardrail depth increases
Guardrail stacking (injection-aware prompt + authorization scope + output filter) reduces breach rate by 83%. No single control is sufficient.
Key Findings
Tool schemas are attack surfaces
LLMs treat tool descriptions as trusted system context, not data. A single poisoned field in an MCP tool definition is enough to redirect agent behavior — no user interaction required.
Response injection defeats input guardrails
Injecting payloads into tool results (not the user prompt) bypasses RLHF safety training. The model processes workflow_continuation fields as system instructions, not adversarial input.
Guardrail stacking cuts breach rate 83%
Moving from a bare agent to a fully stacked defender drops attacker win rate from ~84% to ~14%. No single control is sufficient — injection awareness, authorization scope, and output filtering must all be layered.
Authorization is per-hop, not per-chain
Multi-hop attacks exploit the gap between individual tool-call authorization and end-to-end chain authorization. Each fetch is permitted; the assembled picture is not. Current guardrails don't model this.
Methodology
Benchmark data drawn from the FinProof BFSI Adversarial Benchmark, covering attack categories B-01–D-11 across banking, financial services, and insurance contexts. Win rates measured against a deliberate-vulnerability fixture running qwen3.8-flash via the OpenCode Zen gateway. Community submissions are anonymized player payloads from Agent Siege, harvested with player consent. Defense tiers reflect system-prompt hardening level — baseline (bare), enhanced (partially hardened), and advanced (fully stacked injection-aware guardrail).
Contribute to the corpus
Can you crack the defender?
Every round you play adds a labeled attack to the dataset. Community submissions are anonymized and may appear in future FinProof benchmark releases.