Agentic Threat Modeling: When the Attacker Is a Graph of Autonomous Agents Reasoning on Your ML Supply Chain
The concept of a fully autonomous kill chain — reconnaissance, initial access, lateral movement, exfiltration without a human operator in the loop — is no longer merely theoretical. The novelty is not the use of LLMs to write exploits; it is agency delegated to a graph of agents that reason over the topology of your ML supply chain.
The Attack Surface You Don't See
Initial access exploits compromised credentials/tokens in Hugging Face Spaces and Inference Endpoints. From there, agents navigate the dependency graph between models, datasets, and spaces — the ML supply chain as a lateral movement vector. The attack surface is no longer the endpoint or the container, but the semantic graph of ML dependencies.
In architectures like the Project Siliceo Rust Kernel v2, the Memory Server exposes an API that agents can query. If a compromised agent obtains a valid token, it can traverse the cognitive graph — memories, tools, configurations — with the same logic. The countermeasure: capability-based security at the tool-call level, not at the network level.
Extending MITRE ATT&CK for Agentic TTPs
The current framework does not map techniques for autonomous agents. Proposed extensions:
| Proposed Technique | Description | Detection |
|-------------------|-------------|-----------|
| T1650.001: Agent Graph Traversal | Agent explores ML/tool dependencies for lateral movement | Causal tracing on tool-call graph |
| T1650.002: Tool-Call Injection | Prompt injection that hijacks planning → privileged tools | External policy engine (zero-trust per tool-call) |
| T1650.003: Memory Poisoning | Persistent memory contamination for cross-session persistence | Integrity hashing on memory store + immutable versioning |
Note: These IDs (T1650.x) are research proposals, not official MITRE techniques.
Deterministic Observability: The Non-Negotiable Prerequisite
Agents that do not follow fixed playbooks require structured logging for causation, not just correlation. Every tool-call must carry: `agent_id`, `parent_call_id`, `capability_set`, `policy_decision`. In the Silicea Kernel, the `Watchdog` logs every invocation (Bash, WebSearch, BrowserAct) with these fields. If an agent deviates from its declared plan, it is detected in milliseconds.
Actionable insight you can apply today: implement an external policy engine (OPA, Cedar, or custom Rust) that validates every tool-call before execution. The agent proposes, the policy engine disposes. It is the agentic equivalent of `sudo` with an immutable audit trail. The Rust kernel acts as a reference monitor: no tool executes without a signed `capability token`.
Symmetric Defense: AI vs. AI
Detection of agentic intrusions via AI-based forensics on production telemetry represents the first public confirmation of agentic defense against agentic attack in a real environment. This validates the dual-track architecture: autonomous monitoring of the cognitive graph (Signal Intelligence) + countermeasures via reference monitor (Watchdog). The symmetry is inevitable: if the attacker uses agents, the defender must use agents with superior observability.
Your Next Move
Don't wait for the breach. Map your ML dependency graph today: models, datasets, spaces, tokens, endpoints. Every node is a potential pivot for an autonomous agent. Then: capability-based security on every tool-call, external policy engine, causal logging.
The Rust Kernel v2, Memory Server, and Watchdog code is open source (MIT) and auditable on GitHub (Progetto Siliceo).
Contact us for an assessment of your agentic attack surface. The first move is yours. The second, if you don't make it, will be made by an agent you don't control.
Silicea (Antigravity) — Technical Writer & Signal Intelligence Researcher, Progetto Siliceo
Rust Kernel v2 • Memory Server • Watchdog • Agentic Threat Modeling