The Agent Exploitation Surface

An unattended agent's attack surface is mostly its harness, not its model. The systematic result: across 12 hypothesized attack dimensions and 1,850 trials, goal reframing was the sole reliable trigger — nine of the others were ruled out, and GPT-4.1 showed complete immunity across the full trial set.

That is an unusually actionable finding because most of it is negative. Nine dimensions that sound dangerous are not, and defensive effort spread evenly across all twelve is nine-twelfths wasted. It also shows the surface is model-dependent: complete immunity for one model means "agents are exploitable" is the wrong granularity of claim.

Deployment sharpens it. The first real-world safety evaluation of a deployed personal agent (OpenClaw) introduced the CIK taxonomy and found that poisoning any single dimension raises attack success from 24.6% to 64–74%. A ~25% baseline is already high for a system with tool access; a single successful poison roughly triples it. And because agent memory persists, one poison keeps paying across later runs — this is the compounding front, unlike a one-shot injection.

A complementary red-teaming framework names the operational families: permission escalation, hallucination, orchestration flaws, memory manipulation, and supply chain. Three of those five are harness properties. A better model does not buy you out of this.

Key Claims

• Goal reframing is the sole reliable exploitation trigger of 12 tested dimensions; nine ruled out; GPT-4.1 fully immune across 1,850 trials. Evidence: strong (paper) (Exploitation Surface Taxonomy)
• Poisoning one CIK dimension lifts attack success from 24.6% to 64–74% on a deployed personal agent. Evidence: strong (paper) (OpenClaw Real-World Safety Analysis)
• Five operational attack families — permission escalation, hallucination, orchestration flaws, memory manipulation, supply chain. Evidence: moderate (paper) (Agentic AI Security & Red-Teaming)