As organizations increasingly turn to artificial intelligence to drive automation, a new frontier of cybersecurity challenges is emerging. Across the globe, engineering and research teams are leveraging AI by creating specialized task forces of agents managed by central orchestrators. These systems are deployed to support complex operational tasks, including risk assessment, client profiling, matchmaking, and information yield, while maintaining a high-level overview of decision-making processes. However, as these autonomous networks grow more sophisticated, they are pushing the boundaries of traditional security paradigms, raising fundamental questions about accountability, data provenance, and the true efficacy of zero-trust architectures in modern digital ecosystems.
One of the foundational components in managing these multi-agent ecosystems is ensuring that operational logs are carefully managed and that historic relevance is actively discarded to prevent algorithmic skewing. In many standard configurations, systems are designed to keep periodic checkpoints in place where individual agents are systematically prompted to delete historic contextual data. The goal is to prevent the agents from falling into repetitive behavioral loops or becoming biased toward the same historical decision-making patterns over time.
Yet, despite these methodological safeguards being in place, cybersecurity researchers have observed that a future or maliciously crafted prompt can compel agents to unearth and bring forward information that was theoretically supposed to be permanently deleted. This vulnerability exposes systems to a classic context recovery attack, wherein an external input tricks the model into revealing sensitive data that should no longer exist within its active memory. This glaring security gap forces security architects to confront a deeply unsettling question: How can we truly trust that our deletion instructions have been strictly followed, and where is the verifiable proof?
To combat these unpredictable behaviors, many organizations turn to zero-trust architectures (ZTA) to orchestrate and manage agentic activity. At its core, ZTA relies on the strict operational principle of "never trust, always verify." Within a standard zero-trust framework, components such as a policy enforcement point (PEP) are heavily relied upon to maintain security and trust across the entire system. However, this introduces another critical architectural dilemma. If the entire security posture relies on a policy enforcement point to maintain trust, security teams must ask where the ultimate boundary of zero-trust lies, and whether they can blindly trust the static policies enforced by the PEP itself.
Embracing a pro-agentic approach can yield massive operational benefits, provided that rigorous guardrails are implemented from the outset. Opening corporate networks and internal systems to random agents trained on off-the-shelf models, while blindly relying on their native capabilities, poses monumental cyber risks. A prime example of this danger is the rising trend of vibe coding, where developers use AI models to rapidly generate and build software. When a development team hands over an entire proprietary codebase to an untrusted external AI entity outside the organization, it can introduce widespread vulnerabilities that sweep silently across multiple operational surfaces.
This phenomenon opens critical discussions regarding how vibe coding can severely interfere with the positioning and implementation of trusted execution for agentic queries. Consider an autonomous web of agents that relies entirely on peer inputs to drive day-to-day operations. When a system operates under a low tolerance for failure and utilizes non-tracking-based agentic workflows, it becomes computationally prohibitive to trust and verify every single query in real-time. This introduces the classic engineering trade-off between memory retention and rapid execution speed.
Another looming threat is the zero-day attack. When an unprecedented vulnerability is exploited in the wild, the critical question is how an autonomous agentic system will react. Would such an emergency event be manageable without triggering a total infrastructure breakdown? The sheer scale of potential impact can be observed from the systemic risks of over-relying on agentic ecosystems that feature only a single trusted layer. If that single foundational layer fails or is compromised, the entire ecosystem is exposed in a cascading collapse—much like how an autonomous network loses its functionality entirely if the backbone communication network goes down, leaving no remaining layer upon which trust can be anchored.
How quickly can de-authentication attacks occur?
An in-house experiment conducted at Queen’s University Belfast (QUB) provided a sobering initial understanding of just how narrow the window of vulnerability can be in large-scale agentic attacks. The research team focused on widely studied de-authentication attacks. By introducing agentic orchestration into the attack vector, the team discovered that the swift rate required to execute successful de-authentication attacks could drop as low as two to three seconds. This compressed timeline leaves human administrators and automated defense systems with little to no reaction time to detect the breach, assess the damage, and deploy a patch.
This vulnerability highlights another complex layer of large-scale agentic systems: the challenge of establishing trust under asynchronous autonomy. Trust serves as the critical foundation for traceability in any enterprise network. Security leaders must ask how they can guarantee that numerous autonomous agents working toward a common goal remain properly aligned, and how they account for the inevitable communication delays associated with achieving those objectives.
Researchers at QUB have worked extensively in this problem space, initially demonstrating that the threat is real and that its impact and scale can be catastrophic when organizations attempt to prove trust within the boundaries of asynchronous autonomy. Potential solutions to these systemic issues can be simplified by introducing standardized frameworks like an AI bill of materials, or by leveraging distributed ledger technology. Distributed ledgers can provide a resilient underlying infrastructure for trust through verifiable traceability and cryptographic immutability, keeping agentic activity and its associated trust vectors entirely platform-agnostic.
Another critical factor that remains poorly explored and urgently demands thorough investigation is the concept of horizontal anomalies. This phenomenon describes how individual AI agents may behave correctly and interact securely with specific data sources under one set of settings, while acting entirely differently when placed in new environments or exposed to different sources. Just because an agent operates reliably and aligns with architectural expectations for one specific task does not automatically mean it can be trusted when deployed across all other interconnected system components. Identifying these horizontal anomalies and developing reliable methods to isolate or restrict such agents without breaking the broader workflow remain open questions and vital topics for ongoing research.
The harsh reality is that the short-term utility of agents governed by semi-trust or low-trust frameworks offers high initial rewards, but the ultimate cost of recovery when these systems inevitably fail has yet to be fully calculated. Furthermore, a failure in these environments will rarely remain a contained issue. Modern systems are increasingly characterized by agents sweeping across multiple corporate entities and microservices, meaning a compromised agent may prevent complete system recovery. For instance, a routine supply chain disruption caused by a rogue agent is no longer a small, containable task; it requires sweeping remediation across every single touchpoint affected by those agents. This demonstrates that regardless of how many proxy-agents are deployed—many of which may not even be directly linked to the wider enterprise ecosystem—organizations must implement computationally intensive trackers for every active agent.
Other relevant doctoral research carried out within academic research groups focuses on the sovereignty of AI, exploring the intricate intersections of trust and accountability. The foundational hypothesis driving this work is that digital sovereignty and trust must be governed simultaneously, because the onus of data and execution provenance rests heavily upon the host of the agents. Consequently, organizations must develop a deep understanding of the legal and regulatory frameworks governing trust-based executions of AI. A major challenge in this domain is recognizing the vital operational difference between missed information and missed instructions, as both carry vastly different consequences when attempting to establish trusted accountability after an incident.
Does true zero-trust architecture exist?
The persistent real-world issue with these complex systems lies in the industry’s failure to adopt robust approaches that historically relied on state-based modeling for governing trust. In modern stateless systems where agentic autonomy is high, the convergence and reliability of trust-provenance decreases significantly. This brings security professionals back to the foundational question: Does a true zero-trust architecture even exist in practice?
Can security policies themselves truly be trusted? If so, how should these policies be managed without falling directly into the operational trap of policy-based accessibility and control bottlenecks? Despite the prevailing argument that a policy enforcement point can effectively manage access permissions between interacting agents, placing that entire burden on a single entity and expecting it to scale seamlessly across every agentic interaction fundamentally underestimates the complexity of the problem space.
Formal verification of trust represents another essential pillar for building a secure, trust-based agentic ecosystem. When dealing with complex AI models, understanding structural robustness is vital for determining how much faith an organization can place in the system.
To address these challenges and tackle the complexities of embedding trust into agentic AI, initiatives like the Cyber AI hub are actively exploring opportunities to help companies securely scale their operations while building resilient pipelines of agentic applications tailored for commercial viability. However, the core elements governing routine engineering work and high-level decision-making must remain centered around the sheer scale of the problem, the volume of active agentic deployments, continuous anomaly detection across workflows, ongoing evaluation of attack surfaces and vulnerability assessments, and a clear understanding of the operational differences between pure agentic AI and task-driven multi-agent systems.
Researchers are actively collaborating with enterprise sectors where trust is an absolute operational prerequisite. These organizations treat trust as a strict guardrail managed primarily through internal corporate policies, focusing on securing their internal systems through rigid policy enforcement rather than placing blind trust in third-party agentic service providers. Additionally, trust in external services is established by enforcing strict constraints around service models, ensuring that all agentic activities are meticulously tracked and managed via comprehensive logs. This includes the rigorous management of token revocation lists to prevent replay attacks, depending on the specific requirements of the application.
Simultaneously, the formal verification of trust remains a cornerstone of secure agentic ecosystems. When evaluating AI models, assessing robustness helps organizations determine the degree of trust a model deserves. Factors such as balancing adversarial accuracy alongside certified adversarial robustness can help quantify how much reliance a particular model can sustain under pressure.
Yet, as autonomous agents become deeply embedded in enterprise infrastructure, the overarching question remains: Can the technology sector settle for anything less than foolproof security when deploying autonomous agents into the real world? And if compromises must be made, how much of the resulting systemic impact can actually be controlled, and who bears the ultimate responsibility for the remaining vulnerabilities?
