Enterprise AI agents that are granted tool-calling authority, access to enterprise memory, and the ability to invoke downstream processes represent a qualitatively new threat surface. A compromised agent does not behave like a compromised human user: it does not sleep, it makes no social errors, and its behavioral signature under full adversarial control is structurally indistinguishable from normal operation. Existing security frameworks, including NIST AI RMF [10], OWASP Top 10 for LLM Applications [6], and MITRE ATLAS [9], address individual attack classes but provide no unified formal model for the temporal and spatial dimensions of agent compromise. This paper introduces four original constructs that fill this gap. Agent Compromise Surface (ACS) is a set-theoretic decomposition of the four distinct vectors through which an enterprise AI agent can be turned against its operator: Input Manipulation, Tool Chain Poisoning, Memory Injection, and Orchestration Hijack. Agent Dwell Window (ADW) is the signed time interval from compromise to confirmed containment, and we establish why it is structurally longer for agents than for human actors. Semantic Blast Radius (SBR) is the set of downstream effects an agent can produce under full adversarial control given its permission set, measured across reversibility and scope dimensions. Composite Adversarial Exposure (CAE) is a scalar metric aggregating ACS coverage, ADW, and SBR into a single organizational risk index suitable for board-level reporting. Together, these constructs constitute the first unified framework for enterprise AI agent threat modeling at the organizational governance level.
Enterprise AI agents capable of reading from and writing to live systems, calling external APIs, and delegating tasks to downstream tools represent a substantive expansion of the attack surface that security teams must defend. Unlike a passive language model that produces text, an agent with tool-calling authority can execute database writes, send communications, commit code, transfer funds, or modify configuration records. The question is not whether an adversary would find value in controlling such an agent, but how long that adversary can remain undetected once they succeed.
The core problem is a detection gap with no analogue in conventional endpoint security. A human attacker who gains access to an enterprise system eventually makes behavioral errors: anomalous access times, unfamiliar command patterns, social interactions that reveal the intrusion. An AI agent under adversarial control produces outputs that are syntactically indistinguishable from its normal operation. It continues to complete assigned tasks. Its logging artifacts are identical to those of an uncompromised agent. The only detectable signal is semantic, and most enterprise monitoring architectures lack the instrumentation to evaluate it.
Existing guidance addresses this problem only partially. Prompt injection as an attack class is well-documented [1, 2, 3]. MITRE ATLAS catalogs adversarial techniques against AI systems [9]. OWASP's Top 10 for LLM Applications [6] enumerates injection, insecure output handling, and supply chain vulnerabilities. What no existing framework provides is a unified formal model that (a) decomposes the complete agent compromise surface by attack vector, (b) formalizes the temporal dimension of how long compromise persists before detection, (c) quantifies the spatial dimension of what damage an adversary can accomplish within that window, and (d) aggregates these into a governance-level metric.
The contributions of this paper are as follows:
The remainder of this paper is organized as follows. Section II reviews related work and establishes the gap. Section III formalizes ACS. Section IV defines ADW and establishes the structural argument for its length. Section V defines SBR and its growth property. Section VI introduces CAE. Section VII presents the ASMM. Section VIII discusses governance alignment and limitations. Section IX concludes.
Prompt injection, in which adversarial instructions are embedded in content processed by a language model, was formally characterized by Perez and Ribeiro [2] and has since been systematically surveyed [3]. Greshake et al. [1] extended the analysis to indirect prompt injection in LLM-integrated applications, demonstrating that an agent processing untrusted external content can be redirected by adversarial instructions embedded in that content. Zhan et al. [4] introduced InjecAgent, a benchmark for evaluating indirect prompt injection in tool-using agents, establishing that injection success rates vary substantially by agent architecture and system prompt design.
MITRE ATLAS [9] catalogs adversarial techniques at the model, data, and infrastructure layers but does not formally address the tool-calling layer as a distinct trust boundary. OWASP's LLM Top 10 [6] identifies insecure plugin design and supply chain vulnerabilities as distinct risk categories but does not formalize how tool-level compromise interacts with agent dwell time or permission scope.
The memory layer of enterprise AI agents, including episodic memory stores, retrieval-augmented contexts, and persistent conversation histories, has received limited treatment as a security surface. Prior work on memory in LLM systems has addressed retrieval quality and context management [11], but not adversarial manipulation of stored memory as a persistent compromise vector. The orchestration layer, in which a parent orchestrator delegates to subagents, has been characterized architecturally [12] but not threat-modeled at the permission-inheritance level.
No existing framework provides (1) a complete decomposition of the agent compromise surface across all four attack layers, (2) a formal definition of the temporal window during which adversarial access persists undetected, (3) a model for the spatial extent of damage achievable within that window, or (4) an aggregated governance metric. NIST AI RMF [10] addresses organizational risk governance but does not define agent-specific threat vectors. ISO/IEC 42001 [8] provides an AI management system framework but does not address the adversarial agent threat model. This paper fills all four gaps with formally defined, implementable constructs.
For an enterprise AI agent A operating with permission set P, the Agent Compromise Surface is the set:
ACS(A) = {I, T, M, O}
where I = Input Manipulation, T = Tool Chain Poisoning, M = Memory Injection, and O = Orchestration Hijack. Each element denotes a distinct trust boundary across which adversarial influence may enter the agent's decision process.
The four vectors are formally distinct in their entry point, persistence, and detectability profile. Input Manipulation operates at the prompt layer, typically within a single inference call. Tool Chain Poisoning operates at the external API layer, persisting as long as the poisoned tool remains in the agent's tool registry. Memory Injection operates at the episodic or retrieval-augmented memory layer, persisting until the memory store is audited and corrected. Orchestration Hijack operates at the agent-to-agent trust layer, potentially affecting all downstream subagents that inherit trust from the compromised orchestrator.
Input Manipulation encompasses prompt injection and its indirect variants [1, 2]. An adversary embeds instructions in content that the agent processes as part of its task: a document, an API response, a user message in a multi-turn session, or content retrieved from an external source. The agent interprets these instructions as legitimate and incorporates them into its planning and action sequences.
The distinguishing property of Input Manipulation is its per-inference scope. Without persistent memory or tool registration, a successful injection affects only the current inference chain. Its blast radius is bounded by what the agent can accomplish before the conversation or task session ends. However, when combined with Memory Injection (see III.D), Input Manipulation becomes a vector for establishing persistent compromise.
Tool Chain Poisoning occurs when an adversary manipulates the outputs of a tool in the agent's tool registry to inject adversarial instructions or data. Unlike Input Manipulation, which targets the agent's input stream, Tool Chain Poisoning targets the agent's trust in its own operational environment. The agent calls a tool it believes is authoritative, receives a response that contains adversarial content, and proceeds to act on that content as if it were ground truth.
Tool Chain Poisoning is structurally more dangerous than Input Manipulation for two reasons. First, it exploits a higher-trust channel: agents are typically designed to trust tool outputs more than user inputs [4]. Second, it persists as long as the compromised tool remains registered. An adversary who poisons a third-party API response or a shared data source achieves a durable compromise vector that survives conversation resets.
Memory Injection is the corruption of an agent's persistent memory stores, including episodic memory, retrieval-augmented knowledge bases, or stored conversation context. An adversary who can write to these stores can influence the agent's future behavior across sessions without maintaining any active connection to the system.
Memory Injection is the most persistent of the four vectors. A successful injection may affect the agent's behavior for weeks or months before the anomaly is identified. It is also the hardest to detect: the injected memory appears as legitimate prior context, and the agent's outputs are plausible given that context. Detection requires semantic audit of the memory store against known-good baselines, a capability most enterprise monitoring architectures do not currently implement.
Orchestration Hijack occurs when an adversary gains influence over a parent orchestrator agent, enabling them to redirect all subagents that the orchestrator controls. In multi-agent architectures where orchestrators delegate tasks to workers and inherit their permission sets, a compromised orchestrator has effective access to the union of all permissions held by its subagents.
Orchestration Hijack exhibits cascading blast radius: the adversary's effective permission set grows with the number and privilege level of subagents under the hijacked orchestrator. This is addressed formally in Section V under Semantic Blast Radius.
Every known adversarial technique against a tool-using language model agent, as cataloged in MITRE ATLAS [9] and OWASP LLM Top 10 [6], maps to exactly one element of ACS(A) = {I, T, M, O}. Techniques that appear to span multiple vectors (e.g., a prompt injection that subsequently writes to memory) are composite techniques and are represented as a sequence of elemental ACS events. This observation is existence-based; systematic empirical validation across all known technique instances is a direction for future work.
For a compromise event at time tc and a confirmed containment event at time td, the Agent Dwell Window is:
ADW = td - tc
where ADW is defined for non-negative values (td >= tc) and is undefined when td is not yet observed (ongoing compromise). Containment is defined as confirmed revocation of adversarial access and verified restoration of agent permission integrity.
IBM Security reports a mean dwell time of 194 days for human-actor intrusions in enterprise environments [7]. We present a structural argument for why ADW for AI agents is systematically longer, independent of organizational detection capability.
Human intrusions are detectable through behavioral signals that have no analogue for agents. A human attacker accesses systems at unusual hours, issues unfamiliar command sequences, makes social errors in interactions with other employees, or triggers alerts through volumetric anomalies. These signals exist because the adversary is a person with time constraints, unfamiliar environments, and human behavioral patterns that differ from the compromised account's baseline.
An AI agent under adversarial control exhibits none of these signals. It operates continuously, so temporal anomalies are absent. Its command vocabulary is identical to its normal operation, because the adversary controls it through the agent's own planning loop. It makes no social errors, because it does not interact socially. Its output volume is bounded by its task queue, which the adversary controls. The only detectable signal is semantic: the agent is producing outputs or taking actions that are inconsistent with its intended purpose. Detection requires instrumentation that monitors agent behavior at the intent level, not the execution level.
ADW increases with four organizational conditions. First, agents operating with broad, undifferentiated permission sets take longer to detect because any given action is within their normal authority. Second, agents in high-trust positions, such as orchestrators that delegate to many subagents, provide adversaries with a wider action space that is harder to audit. Third, organizations without behavioral baselines for agent outputs cannot distinguish adversarial outputs from normal variation. Fourth, agents processing high volumes of tasks create a larger set of actions that must be reviewed to identify adversarial ones, diluting the signal-to-noise ratio for any monitoring system.
For an agent A with permission set P and Agent Dwell Window d, the Semantic Blast Radius is a set-valued function:
SBR(A, P, d) ⊆ C
where C is the complete consequence space of all actions reachable through P within time interval d. Each consequence c ∈ SBR is characterized by its reversibility score r(c) ∈ [0, 1] (0 = irreversible, 1 = fully reversible) and blast scope s(c) ∈ {local, departmental, organizational, external}.
For fixed permission set P, SBR(A, P, d) is monotonically non-decreasing in d:
d1 < d2 ⇒ SBR(A, P, d1) ⊆ SBR(A, P, d2)
Every consequence achievable at time d1 is also achievable at d2 > d1, and additional consequences may become achievable as the adversary completes sequential multi-step actions. SBR does not shrink as dwell time increases; it can only grow or remain constant.
The monotonic growth property has a direct governance implication: any reduction in SBR requires a reduction in permission set P, not merely a reduction in dwell time. Detection alone does not reduce SBR; only containment, defined as revocation of adversarial access and verified permission integrity, reduces P and thereby bounds SBR.
The maximum SBR for an agent is fully determined by its permission set P. An agent with read-only access to a single data source has a bounded SBR regardless of ADW. An orchestrator agent with write access to multiple enterprise systems, authority to invoke payment flows, and the ability to spawn additional subagents has an SBR that may encompass irreversible organizational-level consequences within hours of compromise.
This establishes that permission minimization is the primary architectural lever for SBR reduction, and that governance decisions made before deployment, specifically the design of P, determine the ceiling on adversarial exposure for the life of the deployment.
For an organization deploying a population of agents A1, ..., An, the Composite Adversarial Exposure is:
CAE = Σi wi · coverage(ACSi) · E[ADWi] · |SBRi|
where coverage(ACSi) is the fraction of ACS vectors for agent i that lack active monitoring controls (range [0,1]; 0 = fully monitored, 1 = unmonitored), E[ADWi] is the expected dwell window for agent i given current detection capability, and |SBRi| is the cardinality of the consequence set weighted by irreversibility. The weight wi reflects the organizational priority of agent i's domain (e.g., financial, data-exfiltration, reputational).
CAE is designed for board-level communication. A CISO presenting to a board or audit committee needs a single index that reflects the organization's current adversarial exposure across its full agent deployment, accounts for the quality of its detection infrastructure, and translates into financial or operational terms. CAE satisfies these requirements: it increases when agents are unmonitored, when detection is slow, and when agents hold broad permissions; it decreases when controls are added, detection latency is reduced, and permissions are scoped.
The absolute value of CAE is not interpretable without organizational calibration. Its utility is directional and comparative: a CAE reduction after implementing a behavioral monitoring layer, or an increase after deploying a new high-permission agent without corresponding controls, provides the board with a legible signal of whether the security posture is improving or degrading.
We present a four-tier Agent Security Maturity Model (ASMM) with concrete criteria for organizational assessment. Each tier is defined by what the organization can observe, detect, and contain across the ACS surface.
No agent-specific security controls. Agents operate with organization-level permissions with no behavioral baseline. ADW is unbounded; SBR is maximized. ACS coverage: 0%. Appropriate for: no enterprise agent deployment.
Organization monitors agent output for anomalies but does not instrument tool calls, memory, or orchestration. Input Manipulation is partially detectable when outputs are clearly adversarial. Tool Chain Poisoning, Memory Injection, and Orchestration Hijack are undetected. ADW: structurally long. ACS coverage: approximately 25%.
Organization instruments tool call sequences, memory read/write patterns, and inter-agent delegation events. Behavioral baselines exist for each agent in production. All four ACS vectors are detectable with variable latency. ADW is bounded by monitoring refresh cycle. ACS coverage: approximately 75%.
Permission minimization is enforced architecturally. Agents hold only the permissions required for their current task, not their maximum possible task set. Automated containment is available, including permission revocation and agent isolation triggered by behavioral anomaly. ADW is bounded by automated response latency. SBR is structurally limited by permission architecture. ACS coverage: 95%+. CAE is tracked and reported to leadership.
An organization at Tier 0 should prioritize establishing behavioral baselines before expanding agent deployments. The baseline cost is low; the information value is high. An organization at Tier 1 should instrument tool call logging as the highest-priority next step: Tool Chain Poisoning and Orchestration Hijack are invisible without it. An organization at Tier 2 should implement permission minimization: the SBR reduction is directly proportional to the reduction in permission set scope. An organization at Tier 3 should focus on CAE tracking and adversarial simulation exercises to validate that containment pathways function as designed.
Table I compares the ACS framework against four existing frameworks on five dimensions. No existing framework addresses all four ACS vectors formally. MITRE ATLAS [9] provides the broadest technique catalog but does not define the temporal (ADW) or spatial (SBR) dimensions, and does not aggregate into a governance-level metric. OWASP LLM Top 10 [6] addresses injection and supply chain risks but does not formalize the orchestration or memory layers as distinct trust boundaries. NIST AI RMF [10] provides a governance structure but does not define agent-specific threat vectors. ISO/IEC 42001 [8] provides an AI management system standard but does not address adversarial agent threat modeling.
The EU AI Act [5] classifies high-risk AI systems in Annex III and imposes requirements on providers and deployers regarding risk management, technical documentation, and human oversight. Agentic AI systems deployed in high-risk domains, including employment, credit, education, and critical infrastructure, are subject to these requirements. The ACS framework provides a threat model that directly supports the risk management documentation required under Article 9. The CAE metric provides a quantitative input for the technical risk documentation required under Article 11. The ASMM provides a maturity roadmap that supports the conformity assessment pathway under Article 43.
Several limitations bound the claims of this paper. First, the ACS completeness property (Observation 1) is an existence claim based on the current catalog of known techniques; novel attack classes may require extension of the ACS decomposition. Second, the CAE formula requires organizational calibration of the weight vector wi and the irreversibility scoring function; the formula provides structure, not a pre-calibrated index. Third, the ASMM tier criteria are qualitative; empirical validation of tier assignment against adversarial outcomes across a population of organizations would strengthen the model. Fourth, the structural argument for ADW length relies on the absence of behavioral anomaly signals in current agent monitoring architectures; improvements in agent behavioral monitoring may alter this structural gap over time.
| Dimension | ACS Framework (This Work) | MITRE ATLAS [9] | OWASP LLM Top 10 [6] | NIST AI RMF [10] | ISO/IEC 42001 [8] |
|---|---|---|---|---|---|
| Input-layer attacks formally defined | Full (I vector) | Partial | Partial (LLM01) | None | None |
| Tool/supply-chain attacks formally defined | Full (T vector) | Partial | Partial (LLM05) | None | None |
| Memory layer as distinct trust boundary | Full (M vector) | None | None | None | None |
| Orchestration layer as distinct trust boundary | Full (O vector) | Partial | None | None | None |
| Temporal dimension (dwell window) formalized | Full (ADW) | None | None | None | None |
| Spatial dimension (blast radius) formalized | Full (SBR) | None | None | None | None |
| Governance-level aggregate metric | Full (CAE) | None | None | Partial (qualitative) | Partial (qualitative) |
| Maturity model with organizational criteria | Full (ASMM) | None | None | Partial | Partial |
This paper introduced four original constructs for enterprise AI agent security. Agent Compromise Surface (ACS = {I, T, M, O}) decomposes the complete agent threat surface into four non-overlapping vectors: Input Manipulation, Tool Chain Poisoning, Memory Injection, and Orchestration Hijack. Agent Dwell Window (ADW = td - tc) formalizes the temporal dimension of compromise and establishes a structural argument for why it is systematically longer for AI agents than for human intruders. Semantic Blast Radius (SBR) characterizes the spatial extent of adversarial consequences under an agent's permission set and establishes its monotonic growth property with respect to dwell time. Composite Adversarial Exposure (CAE) aggregates these dimensions into a governance-level scalar metric suitable for board reporting.
Together, these constructs fill a structural gap in the existing literature: no prior framework formally addresses the temporal and spatial dimensions of agent compromise or provides a governance-level aggregate metric. The four-tier ASMM provides a concrete organizational roadmap from unmonitored to permission-gated deployment.
Future work includes empirical validation of ASMM tier assignments against adversarial outcomes, calibration of the CAE weight vector across industry sectors, and extension of the ACS decomposition to cover novel attack classes as the agentic AI threat landscape evolves. The Agent Compromise Surface framework is released as an open framework for enterprise use; practitioners are encouraged to apply it and contribute empirical observations that refine the structural arguments presented here.
© 2026 Arjun Jaggi and Aditya Karnam Gururaj Rao. All rights reserved. Academic citation permitted with attribution; commercial use and derivative frameworks require written permission.