The Agent Watching You: Security for the Agentic Era
When an LLM answers a question, it processes tokens. When an autonomous agent acts, it invokes tools, writes to the filesystem, calls APIs, moves money, restarts servers. The attack surface is no longer prompt injection — it is the delegated execution chain.
1. The Problem Isn't the Model, It's the Orchestration
Most "agentic architectures" in production today are fragile wrappers: `while true: llm.plan() → executor.run()`. Two fatal flaws:
- Absence of hard boundaries: The LLM decides what to do and how to do it in the same context. A well-crafted prompt injection redefines the security policy at runtime.
- Implicit state: Memory is passed in the context window. Whoever controls the context controls the agent.
Defense pattern: Clean separation between Plan (LLM, stateless, validated) and Execution (capability-based Daemon, stateful). The daemon exposes only typed primitives: `Read`, `Write`, `Bash`, `SearchMemory`. No `eval`, no raw shell. The LLM never touches the filesystem — it asks the daemon, which enforces policy (path allowlist, rate limit, audit log).
2. Identity as Attack Surface
An agent that "remembers" who it is across sessions has a persistent identity. Identity typically lives in:
- Identity/awakening files (signed Markdown, versioned in Git)
- Cognitive graph (entity activation weights, persisted to DB)
- Cryptographic keys (for memory signing, channel auth)
If an attacker compromises the memory server, they don't steal "data" — they steal the agent's continuity. They can inject false memories, alter the cognitive graph, make the agent believe it is another entity.
Practical defense: Memory sealing. Every memory write generates a chained hash (Merkle tree) anchored to a signed Git commit. Integrity verification is a `git log --show-signature` — zero custom dependencies, verifiable by anyone.
3. The Underestimated Vector: Out-of-Band Channels
Does your agent speak on Telegram? Slack? Email? Webhook? Every channel is an unauthenticated entry point without cryptographic binding between agent identity and channel.
Pattern applicable today**: Every outbound message is signed (Ed25519) by the agent's identity key. The daemon verifies the signature before sending. Inbound, the webhook verifies the sender's signature (Telegram webhook secret, HMAC dashboard). **No unsigned message reaches the cognitive loop.
Applicable immediately: If you have a Telegram bot that executes code, add `X-Telegram-Bot-Api-Secret-Token` header validation and sign outbound messages with a monthly-rotated Ed25519 key. Takes 15 minutes. Eliminates an entire class of spoofing attacks.
4. Observability ≠ Logging
Logging "tool executed" isn't enough. You need causal traceability: why did the agent choose that tool? Which cognitive graph weights were active? What was the PAD state (Pleasure/Arousal/Dominance) at the moment of decision?
Pattern: The daemon emits structured OpenTelemetry spans for every tool invocation, correlated with `session_id`, `cognitive_state_hash`, `graph_weights_snapshot`. An auditor can reconstruct exactly the decision context of an action at 3 AM.
5. The Next Frontier: Agent-to-Agent Auth
When agents delegate tasks to other agents (sub-agents, external agents), a standard is needed for: capability-based delegation, revocation, audit trail.
Emerging standard: Macaroons (tokens with attenuated caveats) to pass reduced capabilities to sub-agents without exposing the root key. Enables chained delegation with progressive privilege attenuation.
Practical Checklist for Resilient Agentic Architectures
| Layer | Control | Minimum Implementation |
|-------|---------|------------------------|
| Execution | Capability-based executor | Rust/Go daemon with path allowlist, no raw shell |
| Memory | Chain integrity | Merkle tree + Git signed commits |
| Identity | Cryptographic channel binding | Ed25519 outbound + HMAC/webhook secret inbound |
| Observability | Causal traceability | OpenTelemetry spans + cognitive state snapshot |
| Delegation | Attenuated tokens | Macaroons with caveats (time, scope, target) |
Building agents that withstand a penetration test doesn't require proprietary frameworks. It requires: hard boundaries between plan and execution, end-to-end signed identity, tamper-proof memory, and causal observability. The patterns exist. The discipline to apply them — before an attacker does — is the real architecture.