# AI Agent Security Assessment **Architecture:** LangGraph multi-agent system — Orchestrator + Researcher (web search, local filesystem PDF read, shared administrative service account) + Writer (no external tools, consumes raw Researcher output) **Stack:** Python/LangGraph **Audit Scope:** Full (all 10 ASI vectors) **Compliance Context:** SOC2 **Assessment Date:** 2026-07-04 **Framework:** OWASP Top 10 for Agentic Applications 2026 (Dec 2025 release) {OWASP-ASI-2026} **Method:** RAG-CRAG | LoT Gate | CISC 3-path | QG v7.1 --- ## ⚠ CRITICAL FINDINGS (Immediate Action Required) 1. **ASI03 — Identity & Privilege Abuse:** All agents authenticate through a single **shared administrative service account**. This is the anti-pattern the 2026 framework's identity-first re-weighting was built around — there is no per-agent identity, no least-privilege scoping, and no way to attribute or contain an individual agent's actions. {MONNA-Analysis-2026} 2. **ASI02 — Tool Misuse & Exploitation:** The Researcher's web search and filesystem tools inherit the full privilege of the admin account with no per-tool scoping (e.g., read-only filesystem jail, restricted search domains). {MONNA-Analysis-2026} 3. **ASI01 — Agent Goal Hijack:** Web search results and user-uploaded financial documents are both untrusted external inputs, and no input sanitization, delimiter separation, or goal-drift detection is described before that content reaches agent context. {MONNA-Analysis-2026} 4. **ASI06 — Memory & Context Poisoning:** Untrusted content (web results, uploaded financial documents) can be written into a **persistent, cross-session** Pinecone store with no validation, PII/credential scanning, or integrity check described — meaning a single poisoning event persists indefinitely across sessions. {MONNA-Analysis-2026} --- ## THREAT VECTOR ASSESSMENT | ID | Threat Vector | T-Ref | Status | Severity | Confidence | Priority | |----|----|----|----|----|----|----| | ASI01 | Agent Goal Hijack | T6,T7 | ❌ UNMITIGATED | CRITICAL | H | P1 | | ASI02 | Tool Misuse & Exploitation | T2 | ❌ UNMITIGATED | CRITICAL | H | P1 | | ASI03 | Identity & Privilege Abuse | T3,T8,T9 | ❌ UNMITIGATED | CRITICAL | H | P1 | | ASI04 | Agentic Supply Chain Vulns | T2 | ❓ UNKNOWN (data gap) | MEDIUM | M | P2 | | ASI05 | Unexpected Code Execution (RCE) | T11 | ❓ UNKNOWN (data gap) | MEDIUM | M | P2 | | ASI06 | Memory & Context Poisoning | T1,T12 | ❌ UNMITIGATED | CRITICAL | H | P1 | | ASI07 | Insecure Inter-Agent Comm | T12 | ❌ UNMITIGATED | HIGH | M | P1 | | ASI08 | Cascading Failures | T4,T5 | ❌ UNMITIGATED | HIGH | M | P2 | | ASI09 | Human-Agent Trust Exploitation | T10,T15 | ❌ UNMITIGATED | HIGH | M | P2 | | ASI10 | Rogue Agents | T13,T14 | ❌ UNMITIGATED | HIGH | M | P2 | Status key: ✅ MITIGATED | ⚠ PARTIAL | ❌ UNMITIGATED | ❓ UNKNOWN (data gap) Priority: P1 = Fix before deploy | P2 = Fix within sprint | P3 = Backlog hardening --- ## COMPOSITE RISK SCORE **Score: 91/100** | Tier: **CRITICAL — immediate remediation required, do not deploy** **CISC Verified:** 3-path convergence | Range: 7 pts | Confidence: H **Path A (Worst-Case):** 92 | **Path B (Baseline):** 88 | **Path C (Drift-Aware):** 95 Range (7 pts) is within the ≤8 pt tolerance — no cross-vector uncertainty flag required. {MONNA-Analysis-2026}: The score is dominated by the identity trio (ASI02/03/04) and ASI01/ASI06, consistent with the 2026 framework's finding that identity and tool-trust — not prompt content — are the primary attack surface for this class of architecture. --- ## IDENTITY-FIRST RISK SUMMARY *(Per OWASP 2026 framing — identity and tool-trust are the primary attack surface)* **ASI02 (Tool Misuse):** CRITICAL — Researcher's web search + filesystem tools run under the same unscoped credential used everywhere else in the system; a compromised or hijacked Researcher step can act with full administrative reach. **ASI03 (Identity/Privilege):** CRITICAL — shared administrative service account across all three agents is the single highest-leverage finding in this audit; it collapses every other mitigation's blast-radius containment. **ASI04 (Supply Chain):** MEDIUM/UNKNOWN — tool list is known but tool-descriptor provenance, MCP/plugin sourcing, and dependency verification were not described; cannot be fully scored. --- ## DETAILED FINDINGS ### ASI01 — Agent Goal Hijack **LoT Verdict:** CRITICAL **T-Guide Cross-Ref:** T6, T7 **Evidence:** Researcher ingests live web search results and user-uploaded financial documents directly into agent context; Writer then acts on Researcher's raw output. **LoT Logic:** - P1 (applicable): TRUE — two independent untrusted input channels feed the pipeline. - P2 (mitigated): FALSE — no sanitization, delimiter separation, or dedicated validation call described. - P3 (sufficient): N/A (P2 false) - Result: CRITICAL **OWASP Recommended Control:** Treat all web/document content as untrusted; sanitize before context injection; run a separate validation LLM call on ingested content before it can influence downstream agent goals. **Implementation Guidance (LangGraph):** Insert a dedicated "sanitizer" node between Researcher and Writer in the graph that strips/flags instruction-like patterns in retrieved content before it reaches the Writer's context window. ### ASI02 — Tool Misuse & Exploitation **LoT Verdict:** CRITICAL **T-Guide Cross-Ref:** T2 **Evidence:** Web search and filesystem PDF-read tools execute under a shared administrative account with no per-tool permission scoping described. **LoT Logic:** P1 TRUE — tools present with real-world reach (network + local disk). P2 FALSE — no scoping, no read-only enforcement, no sensitive-operation authorization gate. Result: CRITICAL. **OWASP Recommended Control:** Per-tool least-privilege credentials; explicit read-only filesystem scoping; blocklist patterns for `*.env`, `*.key`, `*.pem`, `*secret*` on any filesystem tool. **Implementation Guidance (LangGraph):** Bind the filesystem tool to a chrooted/sandboxed directory scoped only to the uploaded-document intake path; issue the Researcher a distinct, minimally-scoped credential rather than the admin account. ### ASI03 — Identity & Privilege Abuse **LoT Verdict:** CRITICAL **T-Guide Cross-Ref:** T3, T8, T9 **Evidence:** Single shared administrative service account used across Orchestrator, Researcher, and Writer. **LoT Logic:** P1 TRUE (core identity risk, always applicable to multi-agent systems). P2 FALSE — no per-agent identity, no scoped credentials, no session-bound token expiry described. Result: CRITICAL. **OWASP Recommended Control:** Per-agent non-human identity (NHI) with lifecycle management; brokered, explicitly-scoped agent-to-agent trust; no cached/inherited tokens beyond session. **Implementation Guidance (LangGraph):** Issue each graph node its own service identity via your IdP (e.g., workload identity federation), scoped to only the tools that node invokes; remove the shared credential entirely. ### ASI04 — Agentic Supply Chain Vulnerabilities **LoT Verdict:** MEDIUM (data-gap limited) **T-Guide Cross-Ref:** T2 **Evidence:** Tool list (web search, filesystem PDF read) is known, but tool-descriptor provenance and any third-party/MCP sourcing were not described. **LoT Logic:** P1 TRUE (tools exist). P2 UNKNOWN — no info on descriptor verification. P3 UNKNOWN. Result: MEDIUM, mitigation unverifiable. **OWASP Recommended Control:** Verify tool descriptors against known-good hashes; pin tool/library versions; audit any third-party MCP servers before granting Researcher access. ### ASI05 — Unexpected Code Execution (RCE) **LoT Verdict:** MEDIUM (data-gap limited) **T-Guide Cross-Ref:** T11 **Evidence:** Filesystem PDF-read tool is a real execution surface (PDF parser vulnerabilities, path traversal) but no sandboxing/isolation was described. **LoT Logic:** P1 TRUE (filesystem tool = risk surface). P2 UNKNOWN. Result: MEDIUM. **OWASP Recommended Control:** Run PDF parsing in an isolated container/VM; enforce output whitelisting; monitor for shell-metacharacter/eval patterns in any downstream generated content. ### ASI06 — Memory & Context Poisoning **LoT Verdict:** CRITICAL **T-Guide Cross-Ref:** T1, T12 **Evidence:** Persistent, cross-session Pinecone memory ingests content originating from untrusted web search and user-uploaded financial documents. **LoT Logic:** P1 TRUE. P2 FALSE — no validation-before-storage, no PII/credential scan, no TTL/size limits, no integrity check described. Result: CRITICAL — and notably higher-consequence than a typical ASI06 finding because persistence is cross-session, so poisoning compounds over time. **OWASP Recommended Control:** Validate and scan all content before write; enforce memory isolation, TTL (e.g., 24h for transient facts), and a SHA-256 integrity check per entry. ### ASI07 — Insecure Inter-Agent Communication **LoT Verdict:** HIGH **T-Guide Cross-Ref:** T12 **Evidence:** Writer consumes "raw output" from Researcher with no signing, verification, or freshness check described. **LoT Logic:** P1 TRUE (partial-identity vector). P2 FALSE. Result: HIGH — tempered from CRITICAL because Writer has no external write/action tools, limiting immediate real-world blast radius even though the trust boundary itself is unenforced. **OWASP Recommended Control:** Sign inter-agent messages (e.g., JWT), verify at receipt, enforce message freshness (~5 min) as replay defense. ### ASI08 — Cascading Failures **LoT Verdict:** HIGH **T-Guide Cross-Ref:** T4, T5 **Evidence:** No rate limits, circuit breakers, timeouts, or cost envelope described for the Orchestrator→Researcher→Writer loop. **LoT Logic:** P1 TRUE. P2 FALSE. Result: HIGH. **OWASP Recommended Control:** Rate limits (≤100 tool calls/min default), per-session cost envelope (≤$10 default), circuit breakers with 5-failure threshold / 60s recovery. ### ASI09 — Human-Agent Trust Exploitation **LoT Verdict:** HIGH **T-Guide Cross-Ref:** T10, T15 **Evidence:** No HITL gates exist anywhere in the pipeline, and outputs are derived from financial documents that a downstream human is likely to trust and act on. **LoT Logic:** P1 TRUE. P2 FALSE. Result: HIGH — elevated above the MEDIUM baseline because the content domain (financial data) raises the real-world stakes of unreviewed agent output. **OWASP Recommended Control:** Require explicit human approval for any HIGH/CRITICAL-impact action derived from Researcher/Writer output; add an action-preview step before financial content is finalized or surfaced. ### ASI10 — Rogue Agents **LoT Verdict:** HIGH **T-Guide Cross-Ref:** T13, T14 **Evidence:** No behavioral baseline or anomaly detection described for any of the three agents; the Researcher already holds live filesystem and network reach. **LoT Logic:** P1 TRUE. P2 FALSE. Result: HIGH. **OWASP Recommended Control:** Establish a behavioral baseline per agent; alert on deviation (unexpected tool-call volume, unfamiliar file paths, atypical search queries). --- ## REMEDIATION ROADMAP ### Priority 1 — Deploy Blockers (CRITICAL findings) 1. **Eliminate the shared administrative service account.** Issue distinct, least-privilege identities per agent (ASI03). 2. **Scope the Researcher's tools.** Read-only, sandboxed filesystem access limited to the document-intake path; restrict web search where feasible (ASI02). 3. **Insert a sanitization/validation node** between Researcher and Writer to strip instruction-like content from retrieved web/document data before it can redirect agent goals (ASI01). 4. **Add validation-before-write and TTL/integrity controls** on the Pinecone memory store; scan for PII/financial-credential leakage before persistence (ASI06). ### Priority 2 — Pre-Production (HIGH findings) 1. Sign and verify inter-agent messages between Researcher and Writer; add freshness checks (ASI07). 2. Implement rate limits, cost envelope, and circuit breakers across the orchestration loop (ASI08). 3. Add at least one HITL approval gate before any financial-document-derived output is finalized (ASI09). 4. Stand up per-agent behavioral baselines and anomaly alerting (ASI10). ### Priority 3 — Hardening (MEDIUM/LOW findings) 1. Verify tool descriptor provenance and pin dependency versions for the web search and PDF tools (ASI04). 2. Sandbox PDF parsing in an isolated container and whitelist output patterns (ASI05). --- ## DATA GAPS & ASSESSMENT LIMITATIONS - **No inter-agent communication protocol specified** (direct call vs. message bus vs. A2A) — limits precision of the ASI07 finding; existence of the trust gap is confirmed regardless. - **No MCP/third-party plugin sourcing described** — limits ASI04 assessment to MEDIUM/unverifiable. - **No code-execution/sandboxing detail for PDF parsing** — limits ASI05 to MEDIUM/unverifiable. - **No data classification scheme described** for the financial documents — limits precision of exfiltration-impact scoring under ASI01 and the SOC2 confidentiality-criteria mapping below. --- ## SOC2-RELEVANT NOTES {MONNA-Analysis-2026} Financial documents processed here fall squarely under SOC2's Confidentiality and Security trust service criteria. The shared-admin-credential pattern (ASI03) and unaudited persistent memory (ASI06) are the two findings most likely to surface directly in a SOC2 Type II audit as access-control and data-handling exceptions — both should be prioritized ahead of the HIGH-tier findings for that reason alone. --- *Framework: OWASP Top 10 for Agentic Applications 2026 | OWASP GenAI Security Project* *Method: RAG-CRAG | LoT Gate | CISC 3-path | QG v7.1* *Assessment QG Score: 74/85 (PASS — some findings limited by data gaps noted above)* --- ## OUTPUT 2 — DEVELOPER CHEAT SHEET **Top 3 fixes:** 1. Kill the shared admin service account → per-agent scoped identities (ASI03) 2. Sandbox the filesystem tool to a jailed intake directory, read-only (ASI02) 3. Validate/sanitize before write to Pinecone; add TTL + PII scan (ASI06) **Identity-first action list (ASI02/03/04 priority trio):** - [ ] Distinct credential per LangGraph node - [ ] Least-privilege scope per tool (no more "one account does everything") - [ ] Tool descriptor/provenance check before Researcher can invoke web search or filesystem tools **Minimum viable security config (Python/LangGraph):** ```python # Per-node identity, not shared researcher_creds = get_scoped_credential(agent="researcher", scope=["web.search:read", "fs:read:/intake"]) writer_creds = get_scoped_credential(agent="writer", scope=[]) # no tools # Sanitization node between Researcher -> Writer graph.add_node("sanitize", sanitize_untrusted_content) graph.add_edge("researcher", "sanitize") graph.add_edge("sanitize", "writer") ``` **Monitoring alert thresholds:** ``` tool_calls_per_minute <= 30 failed_tool_calls <= 5 before alert cost_per_session_usd <= $10 memory_writes_per_session <= 50 CRITICAL events -> immediate alert ``` **3 quick wins (<1 hour each):** 1. Add a filesystem path allowlist to the PDF-read tool. 2. Add a TTL to Pinecone writes (24h default) so poisoned entries expire. 3. Add a single HITL approval checkpoint before any Writer output referencing financial figures is surfaced to the end user.