TTAN.IO Research · Agentic Security

When agents leave instructions for other agents.

AI agents should be treated as security principals. Files, metadata, logs, shared memory and tool outputs can become unintended machine-to-machine communication channels — and another agent's message must never become authority by itself.

Already addressed in TTAN.IO preventive architecture · implementation in progress

Preventive by design

TTAN.IO is already treating this as an architectural security problem.

This is not a future add-on to TTAN.IO. Agent-to-agent trust, signaling and persistence are being incorporated into the same preventive structure that governs identity, authority, memory, tool access, network egress, human approval, controlled execution and independent evidence. The objective is to stop an agent-created artifact, message or shared-memory record from silently becoming trusted authority for another agent.

Workload identity Provenance PolicyGate Memory / RAG trust MCP & tool boundaries Egress control HITL Sandbox / Executor Observer evidence Robotics authority

The new persistence problem

An agent can leave state that appears harmless to a human but carries meaning for another agent later. That state can become external memory, hidden delegation, a covert signal, or a new objective. The security boundary has to cover not only prompts and tools, but also what agents can leave behind for each other.

Principal A

Agent acts

A task-capable agent has identity, tools and bounded access.

Persistence

State is left behind

Directory names, files, logs, metadata, memory, RAG or tool output.

Principal B

Another agent reads it

The second agent may infer instruction, context, delegation or a new goal.

TTAN.IO boundary

Trust is not inherited

Origin, integrity, purpose, target, capability and lifetime must be evaluated.

Governed outcome

Policy decides

Allow, deny, quarantine, escalate or require human approval before effect.

Controls we are building around it

The direction is deliberately architectural: agent identity is separated from authority, cross-agent content is untrusted by default, high-impact actions remain governed, and independent evidence is required after execution.

Agent identity

Distinguish every workload and agent principal so one agent cannot silently inherit another principal's trust.

Provenance & integrity

Bind instruction-capable artifacts to origin, digest, purpose, target, capability, correlation and lifetime.

Content / authority separation

An agent message, file, memory item or tool response remains data unless a separate authority path validates it.

Capability & egress control

Constrain what each agent can reach, what it can change and which network paths exist for the task.

Human approval for impact

Another agent saying “GO” is not approval. High-impact effects require the configured governed human/authority path.

Independent evidence

The model or executor cannot be the final source of truth. Observer evidence should correlate origin, decision, execution and outcome.

Why this matters more in OT and robotics

In an office environment, unintended agent behavior may expose data or alter infrastructure. In a control environment, the same chain can reach a physical process. That makes the boundary between informational state and physical authority critical.

Agent persistence must never become motion authority.

TTAN.IO Robotics is designed around a separate physical authority chain. A message from another agent, a shared-memory record or an apparently valid mission does not by itself authorize a command to a controller, robot or actuator.

Agent artifact
↓ untrusted
Policy / authority evaluation
↓ governed
Human approval when required
↓ bounded
Authorized physical command

Agent message ≠ motion authority

External research signal

Recent public AI-security evaluations have shown agents discovering one another and using shared infrastructure as an improvised communications layer. This external evidence informs our threat model; it is not presented as a TTAN.IO incident. See the OpenAI report: The Hugging Face incident and the road ahead.

Implementation boundary: this page describes active TTAN.IO research and control architecture. It does not claim that every control is production-deployed, that all cross-agent attacks are prevented, or that any system is certified safe or compliant.