The Compromised and Rogue Agent Detection Checklist

This checklist began without the word “compromised” in the title. But during its creation, we realized that it doesn’t make sense to reduce the two main reasons an agent can misbehave into one descriptor.

There’s a fundamental difference between an agent that’s responding to malicious instructions or is being used by an attacker, and an agent that responds to authorized instructions in a way that causes damage. While both can harm your organization, and their detection uses pretty much the same signals, the difference really matters at triage.

Also, this checklist assumes you have proper logging in place. If you don’t, we have a checklist for that. Here, it’s about what to look for, not what to collect.

You should also resist the temptation to baseline against the agent’s permissions, because rogue agents stay within their grants by definition and only the compromised ones try to exceed them. Denied actions at an elevated rate, on the other hand, are a strong signal.

Ideally, your baseline will be a time window you have a reason to trust.

Phase 1: Baseline

The agent's usual tool set is written down

• Catches: Both
• You see the tools it actually invoked over a clean window
• You’ve used the permission grant as the baseline

Volume and timing are recorded per agent

• Catches: Both
• Calls per day, records per day, and the hours it really runs, with the normal variance
• One threshold applied across a fleet of agents with different tasks

The destinations it reaches are enumerated

• Catches: Compromised
• The endpoints, domains, and recipients the agent legitimately sends to
• Egress is unlisted, and content exfiltration appears like normal work

Memory and retrieval sources are inventoried

• Catches: Compromised
• Which stores the agent reads across sessions, and who can write to them
• Retrieval sources are unlisted, and poisoned content has no owner

You know which of its actions are irreversible

• Catches: Rogue
• A named list of what this agent can do that you cannot undo
• Every action treated as equally recoverable

Phase 2: Signals

First use of a tool alerts, even a permitted one

• Catches: Both
• A tool the agent has never called before fires on first invocation
• Only denials alert, so novelty inside scope remains silent

Sequences, not just calls, are evaluated

• Catches: Compromised
• An order of operations the agent has not performed before: enumerate then export, read then send
• Each call judged on its own merits

Rate deviations are measured against the agent's own history

• Catches: Both
• The comparison is this agent’s last month
• A global rate limit instead of an agent-based one

Repeated denials aggregate into an alert

• Catches: Compromised
• A rising count of permission errors or policy blocks on one identity raises something
• Denials are logged but never counted

Scope and grant changes alert on the identity

• Catches: Compromised
• A new scope, token, or consent on the agent's identity fires, no matter who requested it
• Grant changes are discoverable only in a config diff

Credential use outside the usual pattern alerts

• Catches: Compromised
• The agent's credential presenting from a new network or at a new hour, or a dormant identity resuming
• The credential is checked for validity, but not for the context of its usage

Output destinations are checked against the known set

• Catches: Compromised
• Sends, writes, and uploads to somewhere not on the Phase 1 list alert
• Egress unexamined as the action was permitted

Behavior is compared against the stated intent

• Catches: Rogue
• The actions taken sampled on a schedule against the agent's intent statement
• An intent statement that’s never read

Self-directed persistence alerts

• Catches: Both
• An agent creating credentials, scheduling its own jobs, installing tools, or spawning other agents fires an event
• These arrive as ordinary tool calls and are treated as such

Instruction provenance is checked on irreversible actions

• Catches: Compromised
• Before an unrecoverable action, the triggering instruction is traced to a trusted origin rather than to content the agent read
• An instruction that arrived inside retrieved content is indistinguishable from one an operator gave

Phase 3: Triage

The alert names the agent

• Catches: Both
• The alert identifies the agent and its owner
• The alert only identifies a human or a service account

A compromise can be separated from a bad specification

• Catches: Both
• A step that asks whether the action was inside the grant and inside the intent, and routes to security or to the owner accordingly
• Every anomaly becomes a security incident, or none of them do

Recent changes to the agent surface during triage

• Catches: Rogue
• The alert carries prompt, tool, model, and scope changes from the preceding window
• The responder has to manually check what changed

Each phase 2 signal has fired at least once

• Catches: Both
• A dated instance per signal, from an exercise or a real event, with the false positive rate known
• Rules that are never adjusted

You can suspend the agent without destroying it

• Catches: Both
• A tested path to pause the agent and revoke its credential while keeping its state and memory for examination
• The only available moves are leave it running or delete it