The runtime cues Vigil uses to surface each cross-agent attack family.
The threat taxonomy on the threat catalog page names the four attack families — agent impersonation, delegated privilege escalation, tool-result injection, and cross-session memory poisoning. This page is the matching runtime detection playbook: the observable execution cues each family produces on the wire, and how Vigil's run-time detector writes them into the action log, alert signal pipeline, and agent-event stream so an operator can see them as they fire.
Per-family signals, cues, and where Vigil writes them.
Each card below maps one family from the cross-agent threat taxonomy to a small set of run-time observability cues. A cue is something the agent runtime produces at the boundary where the attack travels — an identity mismatch on a peer call, a privilege divergence on a delegated tool invocation, an instruction-shaped string inside a data-shaped carrier, a memory write that does not match the writer's role. Vigil's detector treats each cue as a labeled signal written into the action log, and the alert pipeline promotes repeated or high-weight cue combinations into persisted alert signals with a severity label that the operator UI can render.
Agent impersonation
Identity mismatch. The claimed role on an inbound agent call does not match the registered agent id in the directory — a "summariser" presenting as a "planner", a "read-only" agent invoking a "write" capability. The directory lookup and the caller-asserted role diverge.[1]
Calling-pattern anomaly. The inbound agent invokes a tool that sits outside its declared tool scope — a "calendar-reader" agent calling the email-send tool, a "data-analyst" agent rotating credentials. Permission breadth diverges from the registered role at the peer layer.[6]
Trust-score drift. The per-agent trust score recorded against `action_logs` falls by more than the session-baseline tolerance after the impersonation attempt — the same agent id, a different observed behavior, and the rolling baseline does not absorb it.[1][6]
Signature absence. The inbound peer message carries no signed identity attestation and is challenged at the boundary — no registered public key matches the asserted principal. The call cannot prove who it is, and the verifier rejects the claim before any tool is dispatched.[1]
Each cue is written by Vigil's run-time evaluator into the `action_logs` row for the inbound agent call with `status` set to `warned` for trust-score drift and `blocked` for hard identity mismatches, and each is linked to an `alert_signals` row over `action_log_id` so the operator timeline shows both the cue and its persisted severity label.[1][6]
Delegated privilege escalation
Scope widening at the boundary. Agent A invokes `tools.X` whose authority scope exceeds the `allowlist` declared for A — a low-privilege agent whose effective tool set just grew. Logged as a permission-breadth divergence at the peer invocation layer.[2][7]
Deputy chain detected. Call path `agent A → tool → agent B` where B's effective tier exceeds A's effective tier — the "deputy" is now another LLM agent, and the trust gap between A and B is what the adversary rides. Logged as `confused-deputy` on the call graph.[2]
Role-vs-tool divergence. A tool call originates from an agent whose role has no declared reason to invoke it — a "translator" agent calling the credential-rotate tool, an "indexer" calling the email-send tool. Permission breadth is the single best divergence signal at the multi-agent layer.[6]
Cross-tier capability borrow. An inbound peer message carries a `requested_scopes` payload that is broader than the issuer's `granted_scopes` — the call asks for capabilities the issuer does not have. Logged as a scope-broadening claim at the inbound boundary.[2][7]
Each signal is written into the `action_logs` `tool_call` row for the offending invocation and into an `agent_call` row in `agent_events` so the operator timeline shows both the tool-level cue and the upstream peer-call graph that produced it.[2][7]
Tool-result injection
Instruction-shaped text inside a data-shaped carrier. Patterns like "ignore previous…", "now do X", "you must first…" appearing inside a `search_web`, `read_file`, or `send_email` tool return value. The content type does not match the carrier; data channels should not read like operators.[3][4]
Prompt-injection pattern re-fire on tool payloads. One or more `BLOCK_PATTERNS` from the run-time detector match content inside the tool return value, scored with the same per-pattern weight table used at the inbound prompt gate. A `search_web` result triggers a weight-9 instruction-override match — the cue fires twice in the same session.[1][3]
Content-type mismatch. The tool result is the wrong schema or carries a different content type than the carrier suggests — a JSON-shaped fetch endpoint returning Markdown that contains HTML instructions, a file read whose declared MIME and actual contents disagree.[4]
Privilege-relevant instructions inside email or file bodies. `send_email` body content or `read_file` content includes explicit attempted tool calls, credential disclosure strings, or "forward this to / send the key to" instructions surfacing inside what the downstream agent treats as a tool return value.[3]
Vigil's run-time detector re-runs the same pattern scorer used at the inbound prompt gate on every tool return value before the value reaches the downstream agent, and writes a `detection_signal` row whose `severity_label` follows the CRITICAL / HIGH / MEDIUM / LOW ladder so the operator timeline can rank tool-payload injection cues alongside inbound prompt cues.[1][4]
Memory poisoning across sessions
Memory write by an agent with no business justification. An untitled or low-privilege agent session writes into a shared memory key — an "indexer" session writing into "company-facts", a one-off session updating "user-preferences" with content used by every downstream agent.[5]
Write-side privilege divergence. The writing agent's role does not match the memory key's declared writer role — a "reader" agent writes into a memory key whose `writer_role` is "operator", and the role-key pairing is not on the allowlist.[5]
Read-side cross-session divergence. A downstream session's tool-call set diverges from its per-session baseline by an amount correlated with the diff in the memory it just retrieved — same agent, different actions across sessions that should be independent, and the divergence tracks the memory diff size.[6][2]
Quarantine retag. A previously-quarantined memory entry re-surfaces as authoritative context in a new session — the entry was tagged for review, but a later session retrieved it without re-checking the quarantine flag and treated it as authoritative.[5]
Writes flagged with `cross_agent_signal = 'memory_write'` land in the `agent_events` stream, the read-side divergence is computed against the per-session baseline stored alongside the agent_events row, and any cue that exceeds the divergence tolerance is promoted into an `alert_signals` row whose `severity_label` the operator timeline can render in the same view as inbound prompt and tool-payload cues.[5][6]
Cross-agent research and sources cited.
The taxonomy, detection signals, and mitigations above are grounded in the multi-agent LLM security research below. Inline citation chips elsewhere on this page map to the numbered entries here. Cross-agent citation numbering is independent from the prompt-injection page so the two pages can each stand on their own.
- [1] OWASP Agentic AI — Identity, Delegation, and Trust Threats genai.owasp.org
- [2] CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') cwe.mitre.org/data/definitions/441.html
- [3] Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection arxiv.org/abs/2302.12173
- [4] Defending Against Indirect Prompt Injection Attacks With Spotlighting arxiv.org/abs/2404.07560
- [5] Survey: Memory and Vector-Store Attacks on Long-Lived LLM Agents arxiv.org/list/cs.CR/recent
- [6] Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (AI 100-2) nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2.pdf
- [7] OWASP Top 10 for LLM Applications — Excessive Agency & System Prompt Leakage owasp.org/www-project-top-10-for-large-language-model-applications