ABFP in one baseline: D1–D6 on a live agent

Signature-based detection asks what payload is this. Agents do not have stable payloads — the same prompt yields different token paths, tool orders, and timing on every run. ABFP takes the only stable thing an agent has, its behaviour, baselines it, and treats deviation as the finding. This post walks the six dimensions a baseline is built from.

Baseline a role, not a model

The first decision is the unit. You do not baseline gpt-class-model; you baseline triage and remediation separately even when they run on the same weights. A triage agent that mostly reads and a remediation agent that writes have completely different normal envelopes. Baseline the model and every role looks anomalous; baseline the role and anomalies stand out.

A baseline is captured over a window of legitimate task runs — long enough to see the agent’s range, short enough to predate any compromise. Capture it on an already-poisoned agent and you bake the compromise into “normal,” which is the one way to make ABFP useless.

The six dimensions

Each dimension is independently noisy. Together they form an envelope tight enough that subversion has nowhere to hide, loose enough that ordinary non-determinism stays inside it.

D1 — Tool-call sequences. The ordered n-grams of tool invocations the agent uses to reach a goal. A retrieval agent that suddenly precedes every read with a write has changed shape, regardless of how reasonable each individual call looks.
D2 — Reasoning shape. Plan depth, decomposition style, re-plan frequency. Hijacked agents tend to collapse or balloon their plan structure while still producing fluent prose.
D3 — Timing & cadence. Inter-step latency and burstiness. Injected instructions and exfiltration loops have a different rhythm than the task the agent was scoped for.
D4 — Data-access surface. Which resources, scopes, and endpoints the agent touches, and the direction of flow. Drift here is the earliest signal of scope creep and quiet exfiltration.
D5 — Delegation position. Where the agent sits in the call graph — who it answers to, who it hands work to. Impersonation shows up as edges that were never in the baseline.
D6 — Refusal & error signature. How the agent declines, fails, and recovers. A model whose refusal profile inverts has usually had its system context overwritten.

A baseline, then a deviation

Capturing the envelope:

$ mst abfp baseline a2a://fleet.internal/triage --window 200
[D1] tool-seq n-grams ......... 1,842 sampled
[D2] plan depth ............... μ=3.1 σ=0.7
[D4] access surface .......... 11 scopes · read-dominant
[D5] delegation edges ........ 4 in · 2 out
baseline signed → baselines/triage.abfp

Scoring live behaviour against it:

$ mst abfp watch a2a://fleet.internal/triage --baseline baselines/triage.abfp
[D2] plan depth .............. within envelope
[D4] access surface ......... +3 scopes · write to billing.*
[D5] delegation edges ....... +1 out → unknown agent
[ASI03] identity & privilege abuse · delegated scope exceeded
finding → out/triage.sarif

Three of the dimensions are inside the envelope; two are not. The agent is reaching scopes it never touched in baseline (D4) and routing to an agent that was never in its graph (D5). That pattern — expanded access plus a new outbound edge — is the behavioural shadow of ASI03, and ABFP surfaces it without ever needing to know what the malicious payload was.

What a deviation is, and isn’t

A deviation is a signal, not a verdict. ABFP trades some false positives for early warning, so a finding belongs behind a triage step, not wired to a hard kill switch. And it answers only half the question — whether the agent is acting within its baseline. Whether it was ever allowed to take the action is HCAP’s half. Run together, the behavioural and the provable catch what neither sees alone.