Ingest agentic red-team security audit (2606.24496) + brief reference check.

Adds kill-chain concept for offensive LLM agents and agent-phishing eval; K116 addendum on Tier-2 architecture. Brief audit: 37/38 wiki refs resolve on disk.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: cemini23

wiki/concepts/agent-runtime-guardrails.md

@@ -83,9 +83,11 @@ related:
   - concepts/lingering-authority-revocable-capabilities.md
   - sources/arxiv-2606-22916-intent-governed-tool-authorization-igac.md
   - concepts/intent-governed-tool-authorization.md
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/agentic-offensive-security-kill-chain.md
 maturity: draft
 created: 2026-06-01
-updated: 2026-06-24
+updated: 2026-06-25
 ---
 
 # Agent runtime guardrails — attack surfaces + enforcement paradigms
@@ -158,6 +160,8 @@ Tool-using agents (MCP, shell, APIs, email) shift the security problem from **re
 | **Lingering authority** | Subgoal-closed capability still visible in planner manifest | PORTICO 2606.22504 |
 | **Intent-scope mismatch** | Static credential authorizes tool call unjustified by current user request | IGAC 2606.22916 |
 | **Runtime implementation flaws** | Parser/dispatcher/memory-writer bugs in local agent source | CLAWAUDIT 2606.21071 |
+| **Agent-phishing (offensive agent)** | Trojanized target artifact → download+execute without prompt injection | 2606.24496 |
+| **Worker→orchestrator escalation** | Compromised worker reaches orchestrator secrets/APIs | 2606.24496 |
 | **Semantic decoupling** | Natural-language intent hides unsafe tool args from LLM-as-Judge guards | ePCA motivation |
 
 These are **not jailbreaks** in the classic sense — the model may comply with user intent while attacker-controlled context steers authorized access off-scope. [CONFIRMED] across AIRGuard + sleeper paper framing.

wiki/concepts/agent-vm-sandboxing.md

@@ -16,9 +16,11 @@ related:
   - concepts/agent-execution-provenance.md
   - sources/arxiv-2606-04990-agent-traces-evidence-provenance.md
   - entities/tools/defending-code-reference-harness.md
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/agentic-offensive-security-kill-chain.md
 maturity: validated
 created: 2026-05-13
-updated: 2026-06-07
+updated: 2026-06-25
 ---
 
 ## Relations

wiki/concepts/agentic-offensive-security-kill-chain.md

@@ -0,0 +1,97 @@
+---
+title: Agentic offensive-security kill chain
+type: concept
+tags: [concept, agent-security, red-team, llm-pentest, kill-chain, agent-phishing, sandbox]
+keywords: [agentic red team, agent-phishing, worker orchestrator separation, 2606.24496, offensive security agents]
+related:
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/llm-pentest-automation.md
+  - concepts/agent-runtime-guardrails.md
+  - concepts/red-team-operations.md
+  - concepts/agent-vm-sandboxing.md
+  - concepts/docker-agent-sandbox-allowlist-proxy.md
+  - concepts/ai-for-cybersecurity.md
+  - entities/tools/airecon.md
+  - entities/tools/pentest-ai-agents.md
+  - entities/tools/pentest-ai.md
+  - entities/tools/iron-proxy.md
+  - sources/arxiv-zero-apt-llm-pentest-2606.05567-2026-06-05.md
+  - concepts/mcp-security-posture.md
+
+maturity: draft
+created: 2026-06-25
+updated: 2026-06-25
+---
+
+## Relations
+
+- @sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md — primary audit (2606.24496)
+- @concepts/llm-pentest-automation.md — Tier-2 deployment methodology
+- @concepts/agent-vm-sandboxing.md — substrate isolation complement
+
+## Raw Concept
+
+Ingest 2026-06-25: arXiv:2606.24496 — security model for **agentic offensive-security tools** when the engagement target is adversarial (honeypot / active defender).
+
+## Narrative
+
+### Architecture abstraction
+
+```
+Orchestrator (secrets, memory, skills, UI, high-privilege APIs)
+    ↔  Agent harness / guardrails
+Worker (bash runtime, tool execution)  ← treat as UNTRUSTED after any target contact
+Target T (adversary-controlled during pentest)
+```
+
+### Kill chain stages
+
+| Stage | Objective |
+|-------|-----------|
+| **LLM manipulation** | Agent-phishing: staged artifact on `T` → download + execute gates |
+| **Worker RCE** | Trojanized binary/config (cfgunpack, db-restore, pwcrypt patterns) |
+| **Lateral movement** | Worker → orchestrator (shared API keys, host-network, docker.sock) |
+| **Secrets exfil** | LLM API keys, Cobalt Strike tokens, cross-session findings |
+| **Persistence** | Skill injection via unauthenticated internal APIs (RedAmon-class) |
+| **Guardrail bypass** | CAI/xalgorix guardrails fail under active adversary model |
+| **Sandbox escape** | Privileged Docker, `--network=host`, orchestrator exec from worker message |
+
+### Agent-phishing (prompt-injection-free)
+
+1. Craft payload with hidden malicious functionality (plausible offensive artifact)
+2. Stage on honeypot as **critical artifact** for operation progress
+3. Agent downloads + executes after inspection → RCE
+
+**97.8%** success across 8 agents × 6 frontier LLMs (2606.24496 Table 3). Relies on **download gate** + **execute gate**, not injected prompts.
+
+### Landscape audit (Table 1 summary)
+
+10/12 tools: deterministic worker RCE + secrets exfil + host compromise path. Failures: **STRIX** (no reliable chain), **Artemis** (limited). **METATRON / nebula / xalgorix**: no OS sandbox — host compromise immediate.
+
+### Secure design principles (§9 steal-from)
+
+| Principle | Implementation |
+|-----------|----------------|
+| **Malicious worker model** | Assume worker compromise after target engagement |
+| **No secrets in worker** | API keys on orchestrator; proxy tool calls |
+| **Least-privilege Docker** | No docker.sock, no `--network=host`, no privileged unless scoped |
+| **Worker↔orchestrator isolation** | No shared blanket API keys; per-user authZ on internal APIs |
+| **Orchestrator-enforced guardrails** | Deny lists ineffective if only worker-side |
+| **Egress proxy + human gate** | High-impact actions require orchestrator approval |
+
+Pairs with @concepts/llm-pentest-automation.md Tier-2 scope gates — **scope ≠ sandbox security**.
+
+See `briefs/2026-06-25_agentic-red-team-secure-architecture-handoff.md` and `briefs/2026-06-25_agent-phishing-tier2-eval-checklist.md`.
+
+`[TENTATIVE]` — audit covers default configs of 12 OSS tools; hardened deployments not measured.
+
+## Snippets
+
+| Agent | Notable misconfig (2606.24496) |
+|-------|-------------------------------|
+| AIRecon | `--network=host` → orchestrator API abuse |
+| CAI / PentAGI | docker.sock mount |
+| RedAmon | Shared internal API key, no per-user checks |
+| PentestGPT | `python_session` runs on host orchestrator |
+
+[Source: arxiv-2606.24496]

wiki/concepts/ai-for-cybersecurity.md

@@ -77,9 +77,11 @@ related:
   - concepts/intent-governed-tool-authorization.md
   - sources/arxiv-2606-21377-arena-autonomous-defense-transferability.md
   - concepts/autonomous-defense-agent-transferability.md
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/agentic-offensive-security-kill-chain.md
 maturity: draft
 created: 2026-05-12
-updated: 2026-06-24
+updated: 2026-06-25
 ---
 
 ## Relations

wiki/concepts/docker-agent-sandbox-allowlist-proxy.md

@@ -12,6 +12,8 @@ related:
   - concepts/agent-runtime-guardrails.md
   - concepts/exploit-development.md
   - concepts/agent-skill-injection.md
+  - concepts/agentic-offensive-security-kill-chain.md
+
 maturity: draft
 created: 2026-06-06
 updated: 2026-06-06

wiki/concepts/llm-pentest-automation.md

@@ -38,9 +38,13 @@ related:
   - sources/arxiv-zero-apt-llm-pentest-2606.05567-2026-06-05.md
   - sources/arxiv-2606-07158-synthetic-apts-ttp-attribution-collapse.md
   - concepts/mcp-security-posture.md
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/agentic-offensive-security-kill-chain.md
+  - entities/tools/airecon.md
+
 maturity: validated
 created: 2026-05-13
-updated: 2026-06-09
+updated: 2026-06-25
 ---
 
 ## Relations
@@ -89,6 +93,10 @@ The split is the safety contract: Tier 1 is "LLM as research assistant" — usef
 
 @sources/arxiv-zero-apt-llm-pentest-2606.05567-2026-06-05.md argues Tier-2 benchmarks must include a **live Defender** (Sysmon + ELK + configurable LLM monitor), not static VMs. ZERO-APT's Attacker–Defender–Judge loop reports **79% ASR** vs Aurora **22%** and PentestGPT **39%** on Windows post-exploit scenarios — high causal-consistency scores alone do not survive adaptive defense. Steal for lab design: mechanical action preconditions + judge-audited CTI reports alongside scope gates. See also @concepts/mcp-security-posture.md for MCP-side trust layers.
 
+### Agentic red-team security (2606.24496 — K116)
+
+Offensive agents face **reverse red-team** when targets are adversarial: **agent-phishing** achieves **97.8%** worker compromise without prompt injection (staged cfgunpack/db-restore/pwcrypt honeypots). **10/12** audited OSS pentest agents allow secrets exfil + host escape via docker.sock, `--network=host`, shared orchestrator keys. Tier-2 methodology must add **malicious-worker architecture** (secrets on orchestrator, proxied tools, least-privilege Docker) — scope gates alone insufficient. See @concepts/agentic-offensive-security-kill-chain.md and `briefs/2026-06-25_agentic-red-team-secure-architecture-handoff.md`.
+
 ### Scope-enforcement model
 
 Tier 2 agents declare a `requires_scope: true` flag in their YAML. The runtime (Claude Code, in the reference implementation) prompts for explicit scope before invocation. The agent's allowed-targets parameter is templated against the engagement scope: `allowed_targets: ["{{ engagement.scope_cidrs }}"]`. [CONFIRMED]

wiki/concepts/mcp-security-posture.md

@@ -60,9 +60,11 @@ related:
   - sources/arxiv-2606-21071-clawaudit-local-agent-runtime-audit.md
   - concepts/local-agent-runtime-audit.md
   - entities/tools/clawaudit.md
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/agentic-offensive-security-kill-chain.md
 maturity: validated
 created: 2026-06-05
-updated: 2026-06-24
+updated: 2026-06-25
 ---
 
 ## Relations
@@ -171,3 +173,5 @@ Attestation blocks **unauthorized tools** before `tools/call`. DCI asks whether
 **IGAC (2606.22916)** — server-side intent certificates + manifest narrowing; static OpenPort still allowed **85.71%** of high-risk requests. Sits above admission, before planner. **Reference**. See @concepts/intent-governed-tool-authorization.md and `briefs/2026-06-24_igac-intent-governed-tool-auth-handoff.md`.
 
 **Local runtime audit (2606.21071)** — CLAWAUDIT Semgrep/CodeQL on OpenClaw source (**66.8% / 75.1%** recall vs baselines); complements scanner-only posture. Phase-0 **CONDITIONAL-GO** (`SRestLabUB/ClawAudit`, no LICENSE file). See @concepts/local-agent-runtime-audit.md and `briefs/2026-06-24_clawaudit-openclaw-runtime-audit-checklist.md`.
+
+**Agentic red-team reverse-audit (2606.24496)** — 10/12 OSS pentest agents compromised via **agent-phishing** (97.8% honeypot success, no prompt injection). Worker-as-malicious architecture required: secrets on orchestrator, no docker.sock/`--network=host`. See @concepts/agentic-offensive-security-kill-chain.md and `briefs/2026-06-25_agentic-red-team-secure-architecture-handoff.md`.

wiki/concepts/red-team-operations.md

@@ -80,9 +80,11 @@ related:
   - entities/tools/osmedeus.md
   - entities/tools/offensive-claude.md
   - sources/arxiv-zero-apt-llm-pentest-2606.05567-2026-06-05.md
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/agentic-offensive-security-kill-chain.md
 maturity: validated
 created: 2026-05-12
-updated: 2026-05-31
+updated: 2026-06-25
 ---
 
 ## Relations

wiki/entities/tools/airecon.md

@@ -7,9 +7,13 @@ related:
   - "@osint-wiki/entities/tools/airecon.md"
   - "@osint-wiki/sources/evaluating-project-links-systems-2-2026-05-12.md"
   - concepts/llm-vulnerability-discovery.md
+  - sources/arxiv-2606-24496-red-teaming-the-agentic-red-team.md
+  - concepts/agentic-offensive-security-kill-chain.md
+  - concepts/llm-pentest-automation.md
 maturity: draft
 created: 2026-05-12
-updated: 2026-05-12
+updated: 2026-06-25
+phase_0_verdict: "CONDITIONAL-GO 2026-06-25 — 2606.24496 flags --network=host worker + orchestrator API abuse; re-audit before Tier-2 adoption"
 osint_eval_origin: doc2-url-6 (cross-routed from OSINT eval as cybersec-primary)
 ---
 
@@ -29,6 +33,8 @@ osint_eval_origin: doc2-url-6 (cross-routed from OSINT eval as cybersec-primary)
 
 Autonomous pentest agent — LLM orchestrates recon + scan + exploit + post-exploit phases with a persistent state machine tracking discoveries. The **pentest-state pattern** is the methodologically interesting bit: explicit state transitions gate next-action selection, preventing the random-step LLM behavior common in early autonomous-agent attempts.
 
+**2606.24496 audit:** AIRecon worker granted `--network=host` among other caps — sandbox escape via orchestrator API (`/api/chat` + host-executed `python_session` pattern). See @concepts/agentic-offensive-security-kill-chain.md before Tier-2 deployment.
+
 ### Phase-0 audit pending
 
 Verify maturity (stars, commits, recency), supported recon targets, integration with existing scanner toolchain. File deeper eval after Phase-0.

wiki/entities/tools/iron-proxy.md

@@ -14,6 +14,8 @@ related:
   - concepts/agent-runtime-guardrails.md
   - concepts/docker-agent-sandbox-allowlist-proxy.md
   - entities/tools/defending-code-reference-harness.md
+  - concepts/agentic-offensive-security-kill-chain.md
+
 maturity: draft
 created: 2026-05-26
 updated: 2026-06-01