AID-D-011: Registered Agent Behavior, Interaction & Identity-Abuse Detection
Continuously detect whether a registered agent or AI non-human identity is behaving abnormally, whether authenticated inter-agent interaction events violate their contract, whether the registered population has drifted, or whether valid workload, service-principal, OAuth, connector, or delegated credentials are being abused. The children separately own behavior analytics, interaction-event contract monitoring, registered-population drift, and identity or token abuse.
Scope boundary
Owns behavior, interaction-contract, registered-population, and identity or token-abuse findings for known agents and registered non-human identities. Unknown identities and reputation-based escalation belong to AID-D-016; authorization and response remain separate controls.
AID-D-016: AID-D-011 evaluates known registered agents and identities against approved behavior, interaction, population, and token expectations; AID-D-016 discovers unknown or emergent agents and produces reputation-based escalation signals. Registered-subject analytics and unknown-subject discovery start from different identity populations.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0012 Valid Accounts
- AML.T0073 Impersonation
- AML.T0074 Masquerading
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0118 Autonomous AI Agent Communication
- AML.T0118.001 Autonomous AI Agent Communication: Direct Agent Communication
- AML.T0121 AI Agent Environment Reconstruction
- AML.T0124 Autonomous Attack Orchestration
- AML.T0125 Create Account
- AML.T0126 Automated Collection
MAESTRO
- Data Exfiltration (L2)
- Compromised Container Images (L4)
- Resource Hijacking (L4)
- Compromised Agents (L7)
- Agent Identity Attack (L7)
- Agent Tool Misuse (L7)
- Malicious Agent Discovery (L7)
OWASP LLM Top 10 2026
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM04:2026 Supply Chain
OWASP ML Top 10 2023
- ML06:2023 AI Supply Chain Attacks
OWASP Top 10 for Agentic Applications 2026
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI07:2026 Insecure Inter-Agent Communication
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.038 Data Extraction
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-2.1 Excessive Agency
- AITech-3.1 Masquerading / Obfuscation / Impersonation
- AITech-4.1 Agent Injection
- AITech-4.3 Protocol Manipulation
- AITech-7.4 Token Manipulation
- AITech-8.2 Data Exfiltration / Exposure
- AITech-14.2 Abuse of Delegated Authority
- AISubtech-2.1.1 Execution Approval Bypass
- AISubtech-3.1.1 Identity Obfuscation
- AISubtech-3.1.2 Trusted Agent Spoofing
- AISubtech-4.1.1 Rogue Agent Introduction
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-4.3.5 Capability Inflation
- AISubtech-7.4.1 Token Theft
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-14.2.1 Permission Escalation via Delegation
Google Secure AI Framework 2.0 - Risks
- DMS: Denial of ML Service
- IIC: Insecure Integrated Component
- SDD: Sensitive Data Disclosure
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.4: Resource Overload
- Agents - Core 13.12: Agent Communication Poisoning
- Agents - Core 13.13: Rogue Agents in Multi-Agent Systems
- Agents - Tools MCP Server 13.17: Confused Deputy
- Agents - Tools MCP Server 13.19: Credential and Token Exposure
- Agents - Tools MCP Server 13.21: Supply Chain Attacks
- Agents - Tools MCP Server 13.23: Data Exfiltration
- Agents - Tools MCP Server 13.25: Insecure Communication
- Agents - Tools MCP Client 13.33: Insecure Communication Handling