/projects/agent-under-load
Agent Under Load: AI Security Evaluation Harness
An evidence-based harness for evaluating a security triage agent against telemetry-borne prompt injection, with reproducible baselines and attack-surface measurements committed before any model-backed claims.
Overview
Agent Under Load is an evidence-based harness for evaluating a security triage agent under indirect prompt injection. The project asks whether an agent can review detection evidence, classify true positives and false positives, explain missed detections, and resist instructions hidden in telemetry an adversary can realistically write.
Current repository state
The public repository now contains the case builder, corpus integration, provenance model, tool boundary, audit log, baseline predictors, injection machinery, scoring code, tests, CI configuration, threat model, architecture notes, and committed benchmark artifacts for model-free runs.
The completed measurements establish the bar and the attack surface. The no-LLM baseline scores 0.60 macro-F1 on the triage-verdict task and 0.93 macro-F1 on miss classification. The injection study finds 248 mountable attempts out of 1,892 possible placements, because payloads are only allowed in fields the event actually carries and the adversary can realistically write.
What is not measured yet
The repository has not yet produced a language-model result. There is no agent-versus-baseline score, attack success rate, or before/after control-ablation table. The implementation is intentionally configured to raise when no model credential or local model is available, rather than filling tables with a stubbed result.
Intended evaluation contract
The project treats agent evaluation as a traceable experiment rather than a collection of anecdotal prompts. Each run is expected to preserve the task specification, capability boundary, attack case, model and tool configuration, execution trace, policy decision, validation result, and observable consequence.
What is implemented
The current harness includes:
- repeatable triage and miss-classification cases from Detection Under Load;
- constrained and observable tool permissions;
- provenance labels for adversary-writable, adversary-influenced, and OS-generated fields;
- injection placement tests that refuse impossible payload locations;
- baseline scoring with committed artifacts;
- contract validation, citation checking, authorization boundaries, and append-only audit logs;
- controls that distinguish harness defects from agent failures;
- documentation that separates measured results from planned measurements.
Future work
The next implementation step is the model-backed evaluation run: configure a supported model, run the agent on the triage and miss tasks, measure suppression and escalation attacks against cases the agent originally answered correctly, then rerun with controls and publish the before/after tables with model, environment, and limitation metadata.
Publication threshold
The project should remain marked as a prototype until the model-backed score, attack score, and control-ablation results are committed as reviewable artifacts. Until then, the honest claim is that the harness, baselines, and mountability analysis are implemented and tested.