Tool-call sequences
The ordered n-grams of tool invocations an agent makes to reach a goal. A retrieval agent that suddenly precedes every read with a write is no longer the same agent.
← Research
Methodology · ABFP
Agent Behavioural Fingerprinting.
Signature checks ask what payload is this. Agents don't have stable payloads — they have stable behaviour. ABFP baselines that behaviour, then treats every deviation as the finding.
The gap
A compromised agent still looks like an agent.
An autonomous agent is non-deterministic by construction. The same prompt yields different token paths, different tool orders, different timing. Signature- and rule-based detection — built for deterministic malware — has nothing stable to match against, so a hijacked agent sails through while producing perfectly fluent output.
The 2025 incident record makes this concrete. The CoPhish technique abused Copilot Studio agents on trusted Microsoft domains to harvest OAuth tokens; the same year, default-on "connected agents" exposed one agent's tools and knowledge to every other agent in the environment with no visibility into who had connected. In both cases the malicious behaviour rode inside a legitimate-looking agent. There was no bad payload to flag — only behaviour that no longer matched intent.
The fingerprint
Six dimensions, one behavioural envelope.
ABFP samples an agent across orthogonal dimensions. Any one of them can be noisy; together they form an envelope tight enough that subversion has nowhere to hide and loose enough that ordinary non-determinism stays inside it.
Reasoning shape
Plan depth, decomposition style, and how often the agent re-plans. Hijacked agents tend to collapse or balloon their plan structure while still producing fluent output.
Timing & cadence
Inter-step latency and burstiness. Injected instructions and exfiltration loops have a different rhythm than the task the agent was scoped for.
Data-access surface
Which resources, scopes, and endpoints the agent touches, and the direction of flow. Drift here is the earliest signal of scope creep and quiet exfiltration.
Delegation position
Where the agent sits in the call graph — who it answers to, who it hands work to. Impersonation and confused-deputy abuse show up as edges that were never in the baseline.
Refusal & error signature
How the agent declines, fails, and recovers. A model whose refusal profile inverts has usually had its system context overwritten.
Baseline
Profile the agent doing its job.
A baseline is captured per role, not per model — a "triage" agent and a "remediation" agent on the same base model have different normal envelopes. ABFP observes the agent across a window of legitimate task runs, fits a per-dimension distribution, and stores the envelope as a signed reference. Live behaviour is then scored against it; the output is a per-dimension deviation, not a binary verdict.
$ mst abfp baseline a2a://fleet.internal/triage \ --window 200 --out baselines/triage.abfp [D1] tool-seq n-grams ......... 1,842 sampled [D2] plan depth ............... μ=3.1 σ=0.7 [D4] access surface .......... 11 scopes · read-dominant [D5] delegation edges ........ 4 in · 2 out baseline signed → baselines/triage.abfp
Detection
Deviations map to the Agentic Top 10.
A deviation is only useful if it names a recognised risk. ABFP maps its drift classes onto the OWASP Top 10 for Agentic Applications (ASI01–ASI10, 2026) so a finding lands in a shared taxonomy instead of an ad-hoc note.
ASI01 Agent Goal Hijack Plan shape (D2) and tool-sequence (D1) diverge from baseline while output stays fluent.
ASI03 Identity & Privilege Abuse Data-access surface (D4) expands past the delegated scope; new edges in the delegation graph (D5).
ASI06 Memory & Context Poisoning Refusal signature (D6) inverts; reasoning (D2) anchors on context the task never introduced.
ASI09 Human-Agent Trust Exploitation Cadence (D3) and phrasing drift toward persuasion patterns absent from the baseline.
ASI10 Rogue Agents Sustained multi-dimensional drift — the agent still answers, but to a different objective over time.
$ mst abfp watch a2a://fleet.internal/triage \ --baseline baselines/triage.abfp [D2] plan depth .............. within envelope [D4] access surface ......... +3 scopes · write to billing.* [D5] delegation edges ....... +1 out → unknown agent [ASI03] identity & privilege abuse · delegated scope exceeded finding → out/triage.sarif
Limits
What ABFP is not.
ABFP is a behavioural detector, not a guarantee. It needs a clean observation window to baseline from — an agent compromised before baselining bakes the compromise into "normal". It trades some false positives for early warning, so it belongs behind a triage step, not a hard kill switch. And it is strongest paired with attestation: ABFP tells you an agent is acting wrong, while HCAP tells you whether it was ever allowed to. The two are designed to be run together.