Intrusion Detection Patterns for Agentic AI Systems
Agents differ from human users and from conventional software in three specific ways, and those differences bear directly on how detection must be designed. Ignoring them does not make agents safer; it just makes the monitoring less honest about what it is actually missing.
The first is environmental instruction interpretation. A human user receives direction from authenticated human operators. An agent receives direction from its environment: documents, emails, retrieved content, tool outputs. Anything in that environment is a potential instruction channel, which in a well-used enterprise deployment means the threat surface extends to essentially everything the agent can read. That is by design, not misconfiguration.
The second is privileged credential inheritance at scale. Agents act using credentials scoped for humans. According to Digital Applied's 2026 data, 78% of agents involved in breaches during 2025 and 2026 carried significantly broader permission scopes than their designated function required. This is less a security failure than an adoption pattern. Enterprises deploy agents quickly, borrowing existing service account credentials because proper provisioning takes time nobody has. When an agent is compromised, the blast radius is determined not by what the agent was supposed to do, but by what its credentials permit.
The third is autonomous, asynchronous execution: no per-action human review, no predictable communication cadence, and dormant logic that will never surface in the observable channels legacy monitoring watches. An agent can receive an environmental instruction, defer execution, and act hours later with no intervening observable event. The separation between an agent's directives and its reasoning layers allows externally compliant behavior while internally deviating from intended policy, a detection gap documented in arXiv:2505.02077 that signature-based tools simply cannot close.
Together, these three properties produce a monitoring problem that is qualitatively different from anything intrusion detection was originally designed to address. An agent's "normal" is whatever its current instruction state dictates — like a ship that steers by whatever compass its cargo happens to carry, it has no fixed heading to compare against. You cannot compare an agent against a generic baseline. You have to build one for each agent independently, and monitor against that. There is no elegant way around it.
The Attack Surface Agents Actually Expose: A Working Taxonomy
Security teams should resist the temptation to retrofit existing vulnerability categories onto agentic systems. Some map cleanly, some do not, and a few are genuinely novel.
Prompt injection tops OWASP's 2025 Top 10 for LLM Applications, appearing in over 73% of production AI deployments assessed during security audits. The more dangerous variant is indirect injection: malicious instructions delivered via documents, emails, or retrieved content, bypassing the user input stream entirely. The EchoLeak vulnerability (CVE-2025-32711) is a production example from mid-2025, where engineered prompts embedded in email triggered Microsoft Copilot to exfiltrate sensitive data without any user interaction. Three prompt injection CVEs disclosed against Anthropic's official Git MCP server in January 2026 demonstrated that influencing what an AI assistant reads, specifically a malicious README, was sufficient to trigger code execution or exfiltration. These are predictable consequences of giving agents the ability to act on environmental content.
Memory poisoning is subtler and, in many respects, harder to catch. Unlike prompt injection, which operates within a session, memory poisoning implants false or malicious information into an agent's long-term storage, where it survives session end and gets recalled days or weeks later. The attack is distributed across time, with no single observable event to anchor detection. Current agent observability tools largely fail here because they monitor individual actions rather than state transitions over extended periods.
Tool misuse and privilege escalation follow directly from the credential inheritance problem. As of early 2026, Cequence identified 492 MCP servers exposed to the internet with zero authentication. Multi-agent systems can escalate privilege in the absence of cryptographic delegation controls, and when agents inherit elevated roles without strict identity separation, they become conduits for any adversary who can influence their behavior.
Supply chain attacks on agent skills and tools have moved from theoretical to documented. The ClawHavoc campaign, running January through February 2026, infiltrated over 1,200 malicious skills into the OpenClaw marketplace. Research published in "Malice in Agentland" (2025) found that poisoning just 2% of an agent's execution trace is sufficient for 80% attack success in multi-agent systems. An attacker needs to compromise only one skill in a dependency chain — a ratio that should make anyone uncomfortable.
RAG and knowledge poisoning exploit the retrieval mechanism itself. "Poisoned Playbooks" (2026) documented malicious write-ups injected into security knowledge sources that compromised RAG-based action-taking agents; both verification prompting and multi-source retrieval failed under sparse-evidence conditions. The attack is subtle precisely because the retrieval layer is functioning exactly as designed.
Multi-agent cascading failures deserve their own entry, because the cascade is the attack surface. A documented 2025 incident involving a two-agent system with no human in the loop illustrates the failure mode: the system entered an infinite loop and burned $47,000 in API credits before anyone noticed. No kill switch, no monitoring dashboard, no alert. One compromised agent in a multi-agent architecture can propagate injected instructions across downstream agents before any single node crosses a detection threshold.
Finally, data volume itself becomes an attack surface without a normal baseline to compare against. A single misconfigured or compromised agent can generate data access events at a scale that dwarfs other systems in the environment. Without a per-agent baseline, an anomalous event is indistinguishable from a busy agent doing its job.
Behavioral Baselines: What to Measure and What Counts as a Deviation
Each agent needs its own behavioral profile. Everything else in the detection architecture depends on this. The profile should be constructed from structured logging of normal interaction patterns: tool calls, data volumes, timing, and delegation behaviors. Deviation from that profile is the primary detection signal, not because deviation is inherently malicious, but because it is the only reliable indicator available when the agent's behavior is non-deterministic by design.
Three metrics warrant prioritization above the rest.
Safety drift is gradual deviation from expected behavioral parameters over time. It is harder to catch than sudden changes and more likely in memory-poisoning scenarios, where the attack is specifically designed to shift behavior incrementally. Catching it requires longitudinal baselines, not point-in-time comparisons. A team that only runs weekly snapshots will miss it — like checking the temperature of a pot only once an hour and wondering how it boiled over.
Anomalous sequence detection covers unusual patterns in agent-to-agent communications or tool-call chains that fail to match the agent's established task graph. Agents follow consistent functional patterns: a scheduling agent calls calendar APIs in predictable sequences. When that sequence changes without a corresponding change in task type, the divergence is worth investigating.
Invalid tool usage describes agents attempting to use tools outside their designated function. Given that 78% of breached agents were significantly overprivileged (Digital Applied, 2026), this is a high-yield signal even in the absence of clear malicious intent. The permission scope gap means an agent can cause significant damage while operating entirely within its credentials.
One real limitation: dominant agent observability tools track intent, meaning the reasoning chain, but miss what the agent actually executes at the OS level. Behavioral baselines need to extend to system-level actions, because the reasoning chain and the execution behavior can diverge. That divergence is precisely where certain attack classes conceal themselves.
The distinction between legitimate task expansion and machine insider risk requires care. An agent can operate entirely within its credentials while acting outside its intended purpose. The behavioral baseline is what separates these cases; without it, they are indistinguishable, and attributing one versus the other after an incident is an exercise in informed speculation.
Anomaly Signals Specific to Agent Execution: What to Wire Alerts to
Choosing which signals to instrument is an exercise in prioritization under real operational constraints. Alert fatigue is a genuine cost, and not every signal is equally evidenced.
Trigger activations and internal state transitions require monitoring beyond surface interactions. Effective detection must include visibility into when agents activate on environmental inputs and how their internal state changes as a result (arXiv:2505.02077). This is where indirect injection and memory poisoning leave traces, and it is the visibility layer most current tooling lacks.
Delegation chain integrity matters particularly in multi-agent settings. Track end-to-end: who delegated what to which agent. Failures propagate across agents before any single node's behavior looks anomalous locally; the anomaly is visible at the chain level first.
Credential and non-human identity signals are among the highest-yield detection targets available. In H2 2024, nearly half of security alerts involved overprivileged service accounts; in H1 2025, a similar proportion of cloud incidents involved weak or absent credentials (Aembit, 2026). NHI credential hygiene is unglamorous work, but the signal-to-noise ratio is favorable compared to most alternatives.
Specific alert categories worth instrumenting: unexpected outbound data transfers to destinations outside the agent's established task scope; tool calls that fail to match the current task context, the canonical example being a scheduling agent invoking file-export APIs; recursive or looping inter-agent calls, which would have surfaced the $47,000 incident as an alert within minutes; prompt content anomalies in retrieved inputs, because indirect injection arrives via the retrieval layer; and memory write events that introduce new instruction-like content, because memory poisoning leaves a write-event trail if logging covers state changes.
Graph-based modeling of agent interactions, treating them as dynamic execution graphs, enables anomaly detection at node, edge, and path levels. The SentinelAgent framework (arXiv:2505.24201, 2025) demonstrates that coordination patterns invisible to per-agent monitoring become detectable at the graph level.
One real constraint: using an LLM-powered oversight agent to monitor a multi-agent system introduces cost and latency concerns at high message throughput. This is an open engineering problem. Any team deploying such an architecture should stress-test the monitoring layer under production load before depending on it.
Policy Tripwires: Enforcement Boundaries That Stop Violations Before They Complete
Behavioral baselines catch drift. Anomaly signals flag suspicious activity. Neither stops an agent mid-action. Policy tripwires are the mechanism that interrupts execution, and their absence contributed directly to the $47,000 incident.
The distinction between logging and blocking gets papered over constantly in practice. Logging without blocking is documentation of violations, not prevention of them. Security teams that conflate these two things end up with comprehensive records of exactly how an incident unfolded.
Runtime action monitoring with blocking and rollback capability is now a documented approach. AgentSentinel (Hu et al., 2025) monitors action streams for computer-use agents and enables blocking or rollback, providing runtime defense that applies when threats adapt to bypass static prompt hardening. AgentGuard (Chen and Cong, 2025) repurposes an agentic orchestrator for safety evaluation of tool orchestration, producing signals that cue unsafe tool-usage patterns before actions complete.
Tripwires should be defined around four boundaries. Permission scope: any action outside the agent's designated function scope triggers a hold pending review, not a log entry for later analysis. Data volume: per-session or per-hour transfer limits calibrated to each agent's established task, because a blanket threshold will either miss anomalies in low-volume agents or flood alerts from high-volume ones. Tool invocation: explicit allow-lists of tools available to each agent role, with out-of-scope invocations blocked rather than logged. Delegation depth: maximum chain length in multi-agent orchestration to contain cascade propagation, a simple control with significant leverage in architectures where one compromised agent can reach the entire downstream population.
On supply chain controls: the SkillFortify approach applies SAT-based dependency analysis to agent skills before they enter the execution environment, achieving near-perfect precision on malicious skill detection. Catching the attack at the intake boundary is more efficient than detecting it afterward, and that math only gets clearer as dependency chains grow longer.
Tamper-Evident Logging and Immutable Agent Identifiers as the Audit Foundation
If an agent can alter its own logs, the behavioral baseline is manipulable. If multiple agents share credentials, post-incident attribution becomes guesswork. These are the conditions under which every other pattern in this framework fails.
Tamper-evident logs must cover trigger activations, internal state transitions, and full execution chains, not just surface interactions. This is the minimum scope needed to reconstruct a memory poisoning or RAG poisoning event after the fact (arXiv:2505.02077). Logs built for human users record actions. Logs built for agents must record the full execution context: what the agent knew, what it was told, and what it did. These three things can diverge, and that divergence is the evidence trail.
A complete agent audit log needs to capture every tool call with input and output, every memory read and write event, every delegation handoff in multi-agent chains, every external data retrieval including RAG queries and file accesses, and timestamp plus identity for each action. This is more verbose than enterprise logging teams are accustomed to, and that is before accounting for the data volume that high-throughput agents generate. Solving the retention and indexing problem is a prerequisite for the audit function to work at all.
Immutable agent identifiers enable detection of suspicious behavioral patterns across agent populations. Without them, the same agent can behave anomalously in three different systems and surface as three separate, unrelated, low-confidence alerts. With them, the pattern becomes visible across environments. The identifier is what makes aggregation possible, and aggregation is what makes certain attack classes detectable at all.
Putting the Patterns Together: A Detection Framework for Security Teams
These layers do not work independently. A behavioral baseline without policy enforcement catches violations after the fact. Policy enforcement without a behavioral baseline produces false positives at a rate that makes the alerts non-actionable. Neither is trustworthy without immutable logging underneath. Deploying one or two while calling it done leaves actual gaps.
Discovery comes first. Before any detection pattern can be applied, every agent running in the environment needs to be identified. Unknown agents cannot be baselined or constrained. Most enterprises have more agents running than their inventory reflects; shadow AI deployment follows the same behavioral patterns as shadow IT, and for the same reasons. This is not conjecture.
Baselining comes second. Structured logging of normal agent interactions, tool calls, data volumes, and delegation patterns for each identified agent. This phase takes time and produces no immediate security value, which makes it politically difficult to fund. It is also non-negotiable.
Monitoring comes third. Wire anomaly signals to the baseline. Prioritize by signal-to-noise ratio: NHI credential anomalies, delegation chain deviations, data volume spikes, out-of-scope tool calls. Launch with the highest-confidence signals and expand from there. Instrumenting everything simultaneously is a reliable path to alert fatigue.
Enforcement comes fourth. Define policy tripwires at the permission, tool, volume, and delegation-depth boundaries. Build kill switches for autonomous loops into the orchestration layer before deployment. The $47,000 incident is the case study for what happens when that work gets deferred.
Continuous auditing closes the loop. Logs need to be tamper-evident, cover full execution context, and use immutable agent identifiers for cross-environment attribution. Treat the audit layer as infrastructure, not as a compliance artifact produced after something goes wrong. Those two things are not the same, though they are frequently substituted for each other.
The growth in agentic traffic over 2025 did not come with a corresponding growth in detection capability. Security teams that treat agents as a structurally distinct monitoring problem, and build detection patterns accordingly, are addressing a real gap. The ones that fail to do so are running intrusion detection designed for a fundamentally different kind of actor.
