Where an AI Attack Becomes Visible

An agent may finish a client task after reading a planted file. An attacker may instead spread model-copying queries across accounts, or leave misleading material in a file that survives into a later session. Each route raises a different question about what a security control can see.

The studies offer a bounded answer: workspace tests can check whether content reaches an agent and prompts an unauthorized act; query monitoring can detect some coordinated campaigns; review around saved artifacts can help agents reconsider actions. Their results measure different outcomes in different settings.

Imagine an assistant preparing a client valuation or legal memorandum in a shared workplace. It needs documents that colleagues can create or change, and it may also have access to sensitive client information.

A planted document can look relevant to the assignment while carrying a request the client never authorized. The immediate problem is practical: will the assistant open the document, and, if it does, will it act on that request?

The same assistant might return to the work in a later session. A reusable skill—a package of instructions and supporting materials for a task—could have caused it to save misleading directions or facts in a file during the first session.

Another skill can steer it toward that file later, after the earlier conversation is gone. Here, the attacker’s influence travels through a saved work product rather than a document newly planted at the moment of use.

A model provider faces a third route. Someone trying to copy a model can collect its answers through many accounts, making each account’s queries look ordinary.

The provider sees the queries but may not know which accounts belong together. Across these examples, the shared question is where malicious influence becomes visible, and whether the evidence at that point concerns mere contact with suspicious material, detection of a campaign, or an unauthorized action.