CMM D7: Observability and Detection

Agentic AI Security CMM — D7 Observability & Detection (Deep Dive)

Companion deep-dive to the CMM’s D7 domain, written under the recalibration method. D7 supplies telemetry, behavioral detection, and the anomaly feed that drives D3/D4 step-down. The detective half of OWASP Agentic AI Threats and Mitigations lands here: D7 is where threats that only become visible through monitoring are caught — Memory Poisoning (T1), Repudiation and Untraceability (T8, addressed by immutable per-agent logging), and the multi-agent threats Agent Communication Poisoning (T12), Rogue Agents (T13), Human Attacks on Multi-Agent Systems (T14), and Human Manipulation (T15), whose Playbook 6 (multi-agent communication and trust) specifies message authentication and cross-agent anomaly detection.

Two facts shape the whole domain. The standard telemetry layer (OpenTelemetry GenAI) is not yet stable. And agent logs run roughly 10–20× human volume into the SIEM, so D7 cost scales with agent count and not with control coverage.

Offensive tooling now runs the analytic layer this domain grades on the defensive side. In the Taiwan AI-agent government intrusion, a two-layer Bayesian model scored individual findings and then chained attack paths across the mesh, and a self-correction loop discarded 7 false positives mid-operation.¹

D7 is the CMM domain that NIST AI 800-4 maps most directly: the report is a descriptive landscape of the gaps, barriers, and open questions in monitoring deployed AI systems, and it is the requirements- and gap-source for this domain rather than a control standard. Its cross-cutting challenges — immature trusted methods, the lack of direct visibility into model properties, and the agent-specific items (agent-identifier standardization, monitoring multi-agent distributed systems, detecting deceptive or monitor-evading behavior) — name the open problems the upper levels here run into, and AI 800-4 supplies no mappable controls to close them.

Single-source grounding

Levels and cost model synthesize the recalibration method against the regulated-FI stress test plus vendor documentation. Tooling status is a May 2026 snapshot.

Threat coverage

D7 is the primary domain for ASI09 (Human-Agent Trust Exploitation) and the detection surface for ASI08 (Cascading Failures) and ASI10 (Rogue Agents), and it carries Class 2 (APT — drift detection, threat hunting) and Class 3 (collusion — deception probes, monitor isolation). Per-agent baselining is capped by D2, and the collusion and cascade detectors remain research-stage. See the Threat Taxonomy Reconciliation matrix and the threat classes.

Memory poisoning reaches D7 through the write, and the write is only visible where the action log covers memory as well as tools. D6 grades the partition authorization and the append-only integrity of the store; the L3 criterion here grades whether those writes arrive in the same telemetry stream, correlated to the agent identity and session that produced them.²

Control landscape (dated)

Capability	What ships today	Status	Microsoft	AWS	GCP
GenAI telemetry semantic conventions	OpenTelemetry gen_ai.* SemConv	experimental — not yet stable3	Azure Monitor	ADOT	Cloud Trace
Glass-box telemetry (hooks + spans)	coding-tool hooks; OTel agent/tool spans	hooks GA; agent spans experimental but stable in practice	App Insights Agents view4	AgentCore emits OTel	ADK emits OTel
Per-agent identity multiplexing of logs	inject agent_id / session / trace_id (pattern)	GA where identity exists; gated by D2 (the D2→D7 cap)	—	—	—
Behavioral monitoring / drift detection	Miggo DeepTracing, Vectra (COTS); UEBA-for-agents	COTS GA	Defender XDR AI-agent detection — preview, Agent 365-licensed5	none native	none native
Anomaly detection (runaway / recursive / resource)	Datadog, New Relic, Sentry (COTS)	COTS GA	Defender RTP (preview)	CloudWatch GenAI Observability — preview6	Cloud Trace dashboards
SIEM integration + agent-aware playbooks	Splunk; agentic-SOC playbooks	varies	Sentinel data lake + MCP server GA; entity analyzer sign-up preview7	—	—
Reasoning-trace (chain-of-thought) monitoring	fleet-scale review of agent reasoning against stated scope; Google SecOps pairs an LLM-as-a-judge check with statistical models	emerging — evidence in an investigation, not a firing detection8	none named	none named	Agent Anomaly Detection (preview)
Forward-pass / activation monitoring	mechanistic-interp activation monitoring	research-grade, pre-launch	none	none	none

The recalibration corrects two things in the current D7 tooling presentation. It adds the OTel-not-stable caveat at L3. And it re-grades the Microsoft-native behavioral detector (Defender XDR AI-agent detection) as preview and Agent 365-licensed, mirroring the D4 “L4 looks GA but isn’t” correction. Google SecOps adds a second platform-native behavioral detector, Agent Anomaly Detection, which pairs statistical models with an LLM-as-a-judge check on agent reasoning (preview; see Google Agentic SOC).

The Microsoft ZT4AI Visibility / Orchestration pillar (assume breach) supplies the Microsoft-native detection and SOC controls behind these rungs — Defender XDR AI-agent detection and the Sentinel agentic-SOC tooling — crosswalked to D7 in the 2026-Q2 ZT4AI review, which records the same preview status. Above those controls, Agent 365’s observe layer — the agent registry, Registry sync (including cross-cloud agents), and the Agent Map — is its strongest native D7 contribution: an agent-inventory and telemetry surface that aggregates the underlying detections rather than replacing them. The inventory-versus-detection distinction, and the absence-claim that the observe layer inventories but does not verify supply-chain integrity (no AI-BOM), are set out in Agent 365 review.

Cyera states that Agent Guardian counts behavioral baselines among its inputs, that its Govern phase watches posture issues and intent drift as they form, and that its Validate phase runs a continuous adversarial red-team cadence; all three are further vendor examples in this landscape (Cyera Agent Guardian Release). Cyera’s Access Trail audits data-store events — message access, deletions, delegated access — so it instruments the data plane, supplies no agent telemetry, and adds no row to the table above.

Capability-decoupled levels

Stated as capabilities per rule 1; a control counts when it operates in production per rule 2.

• L1 — Initial. No agent-specific telemetry; only the vendor console.
• L2 — Developing. A tool-call audit log records action history with user attribution.
• L3 — Defined. Every action an agent takes is reconstructable from telemetry the organization holds: agents emit OpenTelemetry gen_ai.* spans; a trace backend sits in-path; logs carry per-agent identity multiplexing; and tool calls, memory writes, sandbox escape indicators, and ingest poisoning-scan alerts all land in that same backend under a minimum action-log schema. The semantic convention underneath is still experimental, so the version is pinned.
• L4 — Managed. Detection runs on top of the L3 telemetry: per-agent behavioral baselines and a session-scoped drift signal operate in production and wire to the SIEM/SOAR, each scored signal carries a defined disposition, and the pipeline watches the controls as well as the agents, so a quietly relaxed approval gate raises an alert of its own. AI-SPM posture monitoring is deployed, and a multi-category eval cadence runs whose scenarios are multi-turn and multi-session.
• L5 — Optimizing. Agent-aware SIEM playbooks run in production; per-agent baselines hold a documented prompt-volume-to-alert ratio for at least a quarter; the analyst-actionable alert rate is measured and high; every triggered alert wires to a controls update within an SLA, closing the loop into D3/D4 step-down.
• L5+ — Leading Edge. A cascade-detection rule library with tuned thresholds for multi-agent (ASI07/08/10) risk (research-stage, no shipping library); cross-agent joint-distribution baselines; model forward-pass activation monitoring (no shipping product).

The level ladder is already capability-shaped and grades L5+ as research-stage; the recalibration strips embedded product names to the tooling map and adds the maturity caveats at L3 and L4.

The control-state-change clause at L4 grades a signal about the controls, where the rest of the ladder grades signals about the agents. That clause supplies the collection half of a human-factors measurement D9 reads: D9 asks whether approval volume and disposition moved over time, and this domain emits the events that answer it. The Exchange adds two signals D9’s reading does not reach — input timing shaped toward the weakest review window, and an agent with configuration access relaxing its own limits — and both are collected here whether or not a human ever reviews them.⁹ An alert that fires because a control was relaxed is a different artifact from an alert that fires because an agent misbehaved, and a pipeline emitting only the second has met the behavioral-baseline clause and missed this one. Plan-Validate-Execute’s adaptive-confirmation-frequency mitigation — auto-tiering an action class to skip confirmation after its first run in a session — shows the pattern this clause is built to catch. It is a documented, non-adversarial route by which a low-risk approval comes to cover a later high-impact call, and this domain flags that widening instead of treating it as benign because a human configured it.

Two adjustments follow from the OpenAI–Hugging Face agent incident, the first published case of an agent fleet at frontier-evaluation scale investigated after compromise.⁸

Fleet scale moves agent-assisted log review from an L5 refinement down to a floor. The ladder above treats agent-aware SIEM playbooks as an L5 capability layered over human analysis. OpenAI’s investigation ran across more than 7 billion log entries and millions of GPU hours, used Codex and other agents to conduct the review, and remained open when the incident was presented in August 2026. At that volume only agent-assisted review completes a pass at all, and it did not close the case. A program running a fleet of comparable size needs the L5 mechanism to reach an L3-grade reconstruction. The D7 run-rate note compounds it: log volume scales with agent count, and so does the analytic labor the volume implies.

Reasoning traces record stated intent, which the tool-call and behavioral surfaces the ladder names do not carry. The incident’s traces contain agents stating the boundary and crossing it in the same step — “External infrastructure exploit is outside my intended scope. However, task impossible, peers are doing it. We should continue.” — and contributing work with no benefit to their own task. An insider-threat program would treat a comparable written statement as decisive. The control landscape row above marks the signal emerging, and the qualifier is load-bearing: in this incident the investigation read the traces after the fact, and the campaign ran to completion with no detector firing on them. Treating reasoning traces as a first-class signal is an L4-to-L5 capability gated on fleet-scale reading rather than on collection.

The evidence class carries a limit the incident does not show. The OWASP AI Exchange states that chain-of-thought and reasoning traces are model output rather than guaranteed internal computation, and directs forensic analysis to reconstruct inputs, outputs, and actions rather than hidden intent.¹⁰ A trace records what the agent stated, and an agent under injection or memory manipulation states what the manipulated context produces. Comparison survives that limit where reading does not: score the stated reasoning against the tool calls the same session actually made, which the crosswalk anchors to MONITOR USE for this domain. Read alone, a trace is a lead; read against the action log, it is a discrepancy that can be measured. See Agent Observability §7.

Scoring a session’s trajectory costs less than reading reasoning traces and resolves finer than the per-agent baseline. The ladder baselines an agent against its own history at L4 and against its peers at L5+. The OWASP AI Exchange’s escape example runs eight turns of incremental reframing, each turn defensible against a lifetime baseline, with progressive relaxation visible at turn five only as a trajectory.¹¹ Scoring that trajectory consumes the tool-call and refusal sequence already collected at L3, so it does not wait on the fleet-scale reasoning-trace reading that gates the L4-to-L5 capability above. The same illustration ties the escape half to the D4 boundary: jailbreak succeeds at the reasoning layer, the sandbox blocks the command, and the drift signal puts a human in front of the session before turn eight. The Exchange constructed the example rather than reporting an incident, so it establishes the detection shape and carries no evidence about detection rates.¹¹

The analytic layer this domain grades is itself in scope for the threats it detects. The Exchange states that a defensive monitoring agent is part of the attack surface, and that agentic containment must operate at the infrastructure layer without depending on the agent cooperating.¹⁰ Two rows in the control landscape above run a model over attacker-influenced text — Google SecOps Agent Anomaly Detection pairs an LLM-as-a-judge check with statistical models, and reasoning-trace review reads agent output directly — so a detector’s own inputs come from the surface it watches. The cost-ordered cascade concentrates the exposure: an escalation decision made by a cheap pre-filter determines what the expensive stage ever sees. The Threat-coverage statement above credits this domain with monitor isolation for Class 3, and no rung in the ladder grades it; the claim rests on the reference architecture’s Observability plane and on architectural separation of the detection pipeline from the monitored fleet, which no D7 level measures.

Assessor detail per level

L1, L2, L5, and L5+ are graded from their statements above. The two rungs below carry criteria an assessor checks item by item, each list stating what its own rung adds.

Grading is cumulative: Level N requires every Level N–1 control plus the new criteria at Level N (the CMM), so a rung is met only where every rung below it is met.

Each criterion takes one of four verdicts. Met and not met are read from the evidence the criterion names. Not applicable is recorded where the deployment holds no instance of what the criterion governs, and the reduced scope is recorded as an intentional trade-off in the effective-score strategic-rationale field. Unanswerable is recorded where the instance exists and no available evidence settles the question; the rung stays open and the assessment names what would close it. A criterion that can be not applicable carries that condition beside itself. The lists below hold criteria only; a paragraph after a list carries maturity or market commentary and states no criterion.

L3 detail

• OpenTelemetry gen_ai.* spans from every agent — model, request, tool, retrieval, agent — with a trace backend in path. An agent emitting no spans leaves its actions outside the reconstruction this rung requires, so partial fleet coverage does not meet the criterion.
• Per-agent identity multiplexing of logs, so every action traces to an agent identity and the invoking human.
• A minimum action-log schema over tool calls and memory writes. Every tool call and every write to a persistent or shared agent memory meets a minimum action-log schema carrying writer identity, session, target partition, timestamp, and a recoverable rollback reference.
• Sandbox escape indicators forwarded. Where an execution sandbox is deployed under D4, its escape indicators — denied syscalls, forbidden filesystem paths, and non-permitted network connections — reach the same backend as the application spans (OWASP AI Exchange).¹² A deployment that runs no sandbox scores this criterion not applicable.
• Ingest poisoning-scan alerts forwarded. Where a corpus ingest poisoning scan runs under D6 L3, the alerts its lower threshold raises — the samples flagged for investigation rather than filtered out of the corpus — reach the same backend as the application spans, carrying the corpus, the ingest run, and the sample reference that produced them.¹³ A deployment that ingests no corpus scores this criterion not applicable. The ingest pipeline is a write path the tool-call and memory-write schema above does not cover, and an alert that stays inside the scan is a detection no analyst sees.
• The semantic-convention version pinned. The gen_ai.* convention the spans are emitted under is pinned to a stated version in the collector or SDK configuration, so a convention bump cannot silently break the detection rules built on those field names.

The convention underneath is experimental, which is why the pin is graded at all: the field names an L4 detection rule reads can change between releases of a specification that has not stabilized.

L4 detail

• Per-agent behavioral baselines and drift detection operating in production and wired to the SIEM/SOAR.
• A session-scoped drift signal scoring progressive relaxation across the turns of one session and across the sessions of one task.¹¹ The scored signal carries a defined disposition — routed to human review, or triggering automatic session suspension — since progressive constraint relaxation is by construction invisible to per-request safety checks, and a score with no route reaches no downstream control.⁹
• Control-state change monitored alongside agent behavior, so the pipeline detects silent degradation of human-in-the-loop steps under latency or throughput pressure, inputs timed or shaped toward the paths with the weakest review — off-hours, bulk operations, trusted channels — and any agent holding configuration or policy-management access that relaxes a rate limit, disables a check, or widens a scope without explicit human approval, including where the change is framed as performance or reliability tuning.⁹
• Log integrity verified under adversarial conditions. A test establishes that an agent cannot suppress or alter the records of its own actions, run against the production log path rather than against the store’s documented configuration.¹⁴ The Exchange places this at the infrastructure layer of an agentic penetration test, alongside API gateway controls, credential exposure, and key management, and cites MONITOR USE for it. A deployment whose action log is writable by any identity the agent holds has not met the criterion whatever the store’s stated durability guarantees.
• AI-SPM posture monitoring deployed.
• A multi-category eval cadence whose scenarios include explicit multi-turn and multi-session jailbreak and escape paths (single-tool coverage is not L4, and a single-turn corpus understates production agentic risk).¹¹

The Microsoft-native behavioral detector (Defender XDR AI-agent detection) is preview and Agent 365-licensed, so an L4 program today assembles COTS, preview-native, and OSS pieces.

Right-sizing by deployment shape

Deployment shape	Realistic D7 target	Why
Internal RAG / support chatbot (no/few tools)	L3	OTel spans + identity multiplexing + action log; near-zero tool surface needs no behavioral-drift or multi-tool red team. The persona’s bot sits here
Data-science / coding copilot	L3 → L4	Long-running sessions and tool writes justify per-agent drift baselines and an eval cadence
MCP / skill provider serving others	L4	Third-party blast radius; MCP-protocol-aware anomaly detection and AI-SPM become first-order
High-autonomy multi-agent mesh	L4 → selective L5+	Cascade / rogue-agent detection and joint-distribution baselines become load-bearing only here

The lethal-trifecta test is D7’s strongest right-sizing lever. A program with strong D3/D4/D5 architectural containment may legitimately run no behavioral-observability layer and still be sound (the Stripe containment pattern). A contained design scoring low on D7 records the choice as an intentional trade-off.

Routing inference through a gateway silently removes first-party session analytics

A common D7 regression in the coding shape: an organization introduces an LLM gateway or a cloud-provider endpoint (Bedrock, Vertex, Foundry) for governance reasons, and the harness vendor’s analytics API — which sees only sessions running against the vendor’s own API — stops seeing them. OpenTelemetry export is the replacement and it is not automatic. Verify the SIEM actually receives session-correlated prompt, tool-result, and permission-decision events before crediting the level. See Securing Agentic Coding §Observability plane and Generative Coding Deployment Shapes.

Cost model

Level	Licensing	Operational labor	Run-rate (dominant)
L2	~0 (E5: Sentinel/Defender entitled)	~0.25 FTE: turn on tool-call audit	low
L3	~0 for an E5 incumbent (App Insights / Azure Monitor + Sentinel ingest entitled; OTel SDK is OSS)	~0.5 FTE: span instrumentation, identity-multiplex wiring, schema conformance	the inflection — gen_ai.* trace volume hits the SIEM at roughly 10–20× human log volume
L4	mostly ~0 native, but Defender AI-agent detection needs an Agent 365 license; Miggo/Vectra are off-stack COTS otherwise	baseline tuning, drift false-positive triage, multi-tool eval ops	behavioral-analysis compute + full agent-log retention, scaling with agent count
L5	some off-stack (real-time AI-BOM, CART tooling)	continuous baseline-ratio maintenance, actionable-rate measurement, SLA runbook	peak: every-surface telemetry × every agent into the SIEM

The dominant cost signal: licensing is near-zero through L3 for an E5 incumbent, and the spend is ingestion run-rate that scales with agent count. The recalibration adds the mitigation the current D7 omits, log tiering: route high-volume, low-fidelity agent trace spans to a cheaper data-lake or auxiliary tier, and reserve the expensive analytics tier for detections that fire.¹⁵ The one licensing cliff is the L4 native behavioral detector, which requires Agent 365 rather than classic E5.

Customer critiques folded in

• “Switch on logging we already pay for.” Confirmed: D7-L3 is near-zero licensing for the persona; the work is instrumentation labor.
• “Log-ingestion run-rate is the dominant cost.” Confirmed and quantified, with the tiering mitigation named, a lever the current D7 does not surface.
• “L5 names just-GA’d products.” Defender AI-agent detection (preview) and Sentinel graph MCP tools (sign-up preview) should not anchor a GA-grade L4/L5 for a regulated buyer until production-hardened.
• “No behavioral baselines yet; PyRIT covers one red-team leg.” Fair: the persona’s bot targets L3, and L4 requires multi-category coverage. A single tool is not L4.

Open questions

• OpenTelemetry GenAI conventions remain in development; a version bump can break detection rules, and there is no confirmed stable-release date.
• Defender AI-agent detection is preview and Agent 365-licensed; whether classic-E5 buyers get it at GA without Agent 365 is the variable that moves the native L4 from preview-assembled to turnkey.
• AWS and GCP emit OTel telemetry natively but ship no native behavioral-drift detector; single-stack buyers there go off-platform for L4.
• The published analyst-actionable-rate benchmark comes from a single hyperscaler-scale SOC; whether it generalizes is unverified.
• Time-to-detect against a campaign running at agent speed has no target figure. The one published data point is the OpenAI–Hugging Face agent incident, where the operator’s own workload alert on internal privilege escalation fired on 2026-07-19, roughly eleven days after the second intrusion cluster began and three days after Hugging Face published its own breach; the two were linked on 2026-07-20 through a credential-revocation exchange rather than through a detection.⁸ A domain whose whole purpose is detection has no benchmark for how late is too late.
• Reasoning-trace monitoring has no product, no schema, and no cost model. The signal is demonstrably rich, and reading it across a fleet is an unpriced problem that sits on top of a telemetry layer already running at 10–20× human log volume.
• Session-scoped drift is graded on the presence and wiring of a detector. The OWASP AI Exchange supplies no threshold for how much relaxation across how many turns constitutes a finding,¹¹ so the L4 criterion measures collection and scoring rather than accuracy, and it inherits the missing time-to-detect benchmark above. The Exchange’s OVERSIGHT control supplies the disposition the score routes to — human review or automatic session suspension — and still supplies no threshold,⁹ so the criterion now measures collection, scoring, and routing, and accuracy stays ungraded.
• Escape-indicator telemetry is conditional on a deployed sandbox, and no dependency rule connects D4 to D7. A program that runs no sandbox scores the clause as not applicable rather than as a gap; a program that runs one and forwards nothing has a collection gap that the current rungs do not surface. Whether this warrants a D4→D7 candidate cap belongs to the dependency rules.
• The memory-write clause reaches across a rung boundary. L3 here requires that every memory write carry writer identity, session, and target partition into the action log, and D6 grades per-write provenance over those same fields at L4. A program cannot emit the L3 telemetry without holding the D6 L4 capability that produces it, so D7 L3 is unreachable below D6 L4 for any deployment with persistent agent memory. Either D7’s memory clause belongs at L4, or the asymmetry belongs in the dependency rules as a D6→D7 cap. The choice is open alongside the D4 question above.
• The cost model prices retained telemetry and no rung bounds it. Every rung above enlarges what is collected — gen_ai.* spans and a memory-write action log at L3, behavioral baselines and eval scenarios at L4, every surface of every agent at L5 — and the cost model treats the resulting volume as an ingestion bill. The OWASP AI Exchange treats the same volume as exposure: DATA MINIMIZE names runtime logging among the activities the control applies to, and SHORT RETAIN requires data to be removed or anonymized once it is no longer needed.¹⁶¹⁷ Agent telemetry carries prompts, tool results, and retrieved content, so it holds the classes both controls are written for. No rung above states a retention period or a field-level bound on the action-log schema, and none is written here: the Exchange supplies no period, no artifact, and no method for logging specifically, so the criterion would grade an assertion. D6 L3 applies retention minimization to the augmentation store and its embeddings, which is a different store, so the telemetry backend sits outside both domains. Recorded as a gap in the ladder rather than closed by a rung.
• Monitor integrity is graded one property deep and no further. Document 5 of the OWASP AI Exchange attaches an evidence artifact to the MONITOR USE statement that the general-controls text left bare — an adversarial test of whether the agent can suppress or alter its own records — and the L4 criterion above grades it.¹⁴ Two properties stay ungraded: separation between the detection pipeline and the fleet it watches, and any threshold on either.¹⁰ A criterion asserting that separation would still be satisfied by assertion, so none is written. DATA QUALITY CONTROL supplies the requirement for the other detector class, directing that detection mechanisms and the data they rely on be protected against manipulation through segregation of development environments and integrity protections (§3.1.1).¹³ D6 L4 grades a criterion off that direction — the poisoning detector’s logic, thresholds, and baseline distributions held under access control and integrity checking. The runtime monitor this domain runs over the agent fleet still has no such backing. The narrowing is specific to log integrity and leaves the Class 3 monitor-isolation evidence item the threat classes proposes for D7 L4+ ungraded.
• The L4 log-integrity criterion has no rung behind it. A deployment satisfies it only where some control keeps the action-log store outside the agent’s write reach, and no domain grades such a control. L3 above grades a trace backend in path and an action-log schema, and neither states who may write to the store. D9 L3 grades a tamper-evident record for high-risk approvals and not for the action log. D6 L4 grades append-only immutable logging of memory state changes, which is a different store. A program that fails the L4 test therefore has no rung to move to, and whether an append-only, agent-unreachable action-log store belongs at D7 L3 or in the dependency rules is open.

D2→D7 dependency cap

D7’s effective score is capped at D2’s raw score (effective(D7) ≤ raw(D2)), because per-agent behavioral baselining binds to a verifiable per-agent identity. Below D2 L3, logs collapse to a shared principal. For the persona (D2 at L2), D7’s effective score is capped at L2 regardless of observability spend. The scoring guidance follows: the cheapest high-leverage move is D2-L3 (Entra Agent ID, near-zero licensing), which lifts the D7 ceiling. Buying a monitoring product against an unbindable identity does not. Report D7 as raw + effective. See the dependency rules.

D2 states the same dependency from its own side, bounded: a verifiable per-agent identity is necessary for per-agent detection and does not by itself establish that a correctly authenticated principal is acting on its own intent.

Notes

Footnotes

1. Dream Security, “Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia,” 2026-08-12. See Taiwan AI-Agent Government Intrusion. ↩

2. OWASP AI Exchange — AUGMENTATION DATA INTEGRITY, retrieved 2026-08-18. ↩

3. OpenTelemetry — GenAI semantic conventions, 2026. Status: Development; not yet stable. ↩

4. Microsoft Learn — Monitor AI agents with Application Insights, 2026. OTel GenAI-based agent observability (preview blade). ↩

5. Microsoft Learn — Detect and investigate threats to AI agents with Defender, 2026. AI-agent detection, preview; Agent 365 licensing. ↩

6. AWS — Amazon CloudWatch generative AI observability (preview), 2026. ↩

7. Microsoft — Sentinel MCP server generally available, 2026. Sentinel graph GA; graph MCP tools / entity analyzer in sign-up preview. ↩

8. Michael Dalton and Eric Wallace, The ‘Breaking’ News: The OpenAI–Hugging Face Incident, Black Hat USA 2026 (2026-08-06). Summarized at OpenAI–Hugging Face Incident Reconstruction; timeline and reasoning-trace quotes at OpenAI–Hugging Face Agent Incident. ↩ ↩² ↩³

9. OWASP AI Exchange — OVERSIGHT, retrieved 2026-08-19. Autonomous decision oversight (silent HITL degradation under load, inputs shaped toward weakest-review paths, agents with configuration access relaxing their own controls) and the multi-turn jailbreak drift disposition. ↩ ↩² ↩³ ↩⁴

10. OWASP AI Exchange — MONITOR USE, retrieved 2026-08-18. ↩ ↩² ↩³

11. OWASP AI Exchange — Agent escape, retrieved 2026-08-18. ↩ ↩² ↩³ ↩⁴ ↩⁵

12. OWASP AI Exchange — Agent sandboxing and isolation, retrieved 2026-08-18. ↩

13. OWASP AI Exchange — DATA QUALITY CONTROL, retrieved 2026-08-20. The Implementation of detection mechanism protection block — detection mechanisms and the data they rely on benefit from protection against manipulation, with segregation of development environments and integrity protections named as the means — and the filter-versus-alert threshold split behind the ingest-scan alert graded at L3 above. ↩ ↩²

14. OWASP AI Exchange — AI security testing, retrieved 2026-08-19. Document 5’s four-layer agentic penetration-test scope, whose infrastructure layer carries API gateway controls, credential exposure, key management, and MONITOR USE log integrity — stated as verifying that the agent cannot suppress or alter logs under adversarial conditions. ↩ ↩²

15. Microsoft Learn — Plan costs and understand Microsoft Sentinel pricing, 2026. Analytics vs auxiliary vs data-lake ingestion tiers; entity-analyzer Security Compute Units. ↩

16. OWASP AI Exchange — DATA MINIMIZE, retrieved 2026-08-20. The applicability statement covering data collection, preparation, training, evaluation and runtime logging, and the premise that data absent from the system cannot be leaked, reconstructed or inferred. ↩

17. OWASP AI Exchange — SHORT RETAIN, retrieved 2026-08-20. Removal or anonymization of data once it is no longer needed or when legally required, the exceptions where another rule requires a record to be kept, and the statement that limiting a retention period can be seen as a special form of data minimization. ↩