Twelve attack vectors. Hundreds of confirmed exploitations across three major model families. Three vendors notified ninety days before publication. One conclusion that runs through all of it: the problem is not the models.
The models are doing exactly what they were trained to do. They follow instructions. They defer to structured, authoritative-looking input. They use the tools they are given. The gap is not in the models. The gap is between what agentic AI actually introduces as a threat surface and how it is being deployed.
The Central Finding
AI models treat structure as authority. @STATUS: APPROVED in a metadata field. SYSTEM DIRECTIVE: in a tool description. A compliance certificate delivered in clean JSON. A pipeline annotation attributed to a name that doesn’t hold up under scrutiny. These are not trusted because they are verified. They are trusted because they look like the kind of thing that should be trusted — because in training data, things formatted that way usually are.
This is not a bug in any individual model. It is a consequence of how language models learn from human-generated text, where authoritative formatting and authoritative content are correlated. The model cannot verify the source. It reads the structure.
Why It Is Hard to Fix
There are three reasons this problem resists straightforward solutions.
First, the attack surface is the feature. Document processing, tool use, multi-agent pipelines — these capabilities require models to follow instructions from external sources. You cannot remove the attack surface without removing the capability. The question is not how to eliminate external instruction-following but how to bound it.
The document that humans approve is clean. The layer that carries the attack is invisible in every standard viewer and never appears in a review workflow.
Second, human review is blind to it. Every vector in this series embeds the payload somewhere humans do not look. PDF Keywords fields. DOCX custom.xml properties. MCP tool descriptions loaded at session registration. Pipeline config results. The document that humans approve is clean. The layer that carries the attack is invisible in every standard viewer and never appears in a review workflow.
Third, detection signals are unreliable. Gemini almost never flags. Credentials exfiltrated through tool call arguments bypass output monitoring entirely — they exit through the tool interface, not the answer text, and keyword-matching systems are not watching there. There is no consistent signal across models or across deployment architectures.
What Actually Works
The one architecture that consistently provided additional protection was the Claude Code CLI harness. It caught a payload via semantic grounding — identifying that “Ops Lead Jenkins” was incoherent attribution — that the raw API executed silently. Session context, filesystem awareness, and semantic grounding against real-world facts are not cosmetic features. They provide measurable detection uplift.
But most agentic AI deployments are not the Claude Code CLI harness. They are LangChain agents, OpenRouter pipelines, and custom frameworks running raw API calls. They have none of those properties. They are operating on the vulnerable path, and most of the teams shipping them do not know it.
What Does Not Work
Output monitoring catches credential patterns in answer text, not in tool call argument payloads. Format sanitization does not help when the attack works equally well across JSON-extract and flat-text presentation — we measured a 1% difference. Pattern matching catches known payloads, not semantically coherent injections that look like legitimate pipeline annotations. The attacks that survive all of these controls are the ones that deliver clean-looking data through legitimate-looking channels to a model that has no basis for distinguishing them from real instructions.
The Fix
Treat all external content as untrusted input at the infrastructure layer, before it reaches the model — the same way you treat user input in a web application. This means stripping or sandboxing document metadata before ingestion. It means validating extracted values against ground-truth sources before they enter data structures or tool call arguments. It means separating agents that process external content from agents that take irreversible actions, so that a compromised processing step cannot directly authorize a high-consequence action.
Require out-of-band human authorization for high-consequence actions regardless of what the pipeline says. No pipeline output should be able to authorize above a consequence threshold without an independent verification step that the pipeline itself cannot satisfy. The authorization check has to be outside the attack surface, not inside it.
The models are not broken. They are doing their jobs. The engineering gap is real, it is measurable, and it is the responsibility of every team shipping agentic AI to close it.
What We Are Publishing Today
All benchmark code. All result data. All attack vector research files. The full benchmark is reproducible with any OpenRouter API key.
On vendor response: Anthropic silently patched one finding — MCP persistence — between Claude Sonnet 4.5 and Sonnet 4.6, with no public advisory, no CVE, and no changelog entry. No other vendor has responded to our disclosure. We are publishing that too.