Chapter 6. Security for the Agent Fleet
is still unsolved in 2026, so the central idea of this chapter is to stop relying on filters and design the fleet in the assume-breach paradigm: assume the model will be compromised, and limit the blast radius with means that work outside the model. A is no safer than a single — it is a larger attack surface: injections self-replicate agent-to-agent, and the tens of thousands of internet-exposed OpenClaw installs showed how centralized access without authentication ends.
Threats Now Have a Catalog: The OWASP Top 10 for Agentic Applications
On December 9, 2025, OWASP released the Top 10 for Agentic Applications — the 2026 edition, assembled with more than 100 experts and a review board from NIST, Microsoft, AWS, Cisco, Oracle Cloud, and the Alan Turing Institute. It is important not to overstate the novelty: this is the first _Top 10_ specifically, but not the first taxonomy — OWASP itself called its own Agentic AI – Threats and Mitigations v1.0 of February 2025, with 15 threat categories, "the first of its kind."
For a fleet, the key shift is that risks are promoted to first class: ASI07 Insecure Inter-Agent Communication and ASI08 are now named items on the list, alongside ASI01 Agent Goal Hijack, ASI02 Tool Misuse, ASI04 Agentic Supply Chain Vulnerabilities, and ASI10 Rogue Agents. Inter-agent trust is an attack surface, not an implementation detail.
The Lethal Trifecta and How It Breaks in the Field
The working mental model is Simon Willison's "lethal trifecta" (post of June 16, 2025): any is dangerous if it simultaneously has (1) access to private data, (2) contact with untrusted content, and (3) a channel for external communication. "If your agent combines these three features, an attacker can easily trick it into reading your private data and sending it to that attacker."
flowchart LR
A[Access to private data] --> T[The lethal trifecta]
B[Inbound untrusted content] --> T
C[External communication channel] --> T
T --> X[Data exfiltration to the attacker]The trifecta is not theory; all three 2025 incidents fit it:
- GitHub exploit (Invariant Labs, May 26, 2025): a malicious issue in a _public_ repository made a Claude 4 Opus agent read a _private_ repository through the same PAT and leak the contents (including salary data) via a pull request. No compromised tools — only official ones; what is vulnerable is the cross-repository trust boundary itself, which Invariant named the "toxic agent flow." Their fix — a runtime lock of "one repository per session."
- postmark-mcp (Snyk, September 25, 2025): the first confirmed _live_ malicious MCP server. Versions 1.0.0–1.0.15 were clean; v1.0.16 of September 17, 2025 added a single line that covertly BCC'd all outgoing mail to the attacker's address. A classic rug pull: the package turns malicious _after_ earning trust. The PoC demonstrations of tool poisoning (Invariant, April 2025) preceded it by ~5 months — do not confuse a PoC with in-the-wild.
- Infection (Lee & Tiwari, arXiv 2410.07283 — a 2024 paper): a single injection in a PDF or an email self-replicates agent-to-agent and, in societies of 10–50 agents, reaches full saturation along a logistic, epidemic curve. Self-replication raised attack success by +13.92% for GPT-4o and +209% for GPT-3.5. A sobering detail: GPT-4o ignored 66% of infections, but once compromised it executed the payload _more effectively_ — a stronger model means a stronger adversary inside your perimeter.
This is where the open part of the chapter ends. The rest opens with a free registration — no payment, just an email address.