DEV Community

Edison Flores
Edison Flores

Posted on

v5.4 + v6.0 shipped — attack chain detection, data flow tracking, cross-agent trust, and memory poisoning detection

#mcp #aiagents #security #trust

v5.4 + v6.0 shipped — Attack chain detection, data flow tracking, cross-agent trust, and memory poisoning

The entire v5.x + v6.0 roadmap is now complete. Here's what shipped today.

v5.4 — TRAJECTORY (Q3 2027 target, shipped early)

Multi-Tool Attack Chain Analysis

Detects sequences of tool calls that individually look safe but collectively constitute an attack:

  • search → read → extract URL → download → execute — supply chain drop
  • read .env → fetch — credential exfiltration
  • DB query → fetch — data exfiltration via API
  • file read → shell exec — path traversal
  • fetch → write → execute — second-stage payload
  • credential access → network egress — credential theft
  • prompt injection → tool execution — hijacked agent
  • reconnaissance → exploit → persist — multi-step intrusion

8 predefined attack chain patterns with configurable time windows and data flow requirements.

Data Flow Tracking

Tracks data from untrusted inputs through the agent pipeline:

  • user_input → LLM → MCP → tool → database → external API
  • Flags: USER_SECRET → external-domain (exfiltration)
  • Builds a DataFlowGraph with nodes (data sources/sinks) and edges (relationships)
  • Detects exfiltration paths by tracing sensitive data to external egress points

Trajectory Risk Scoring

Scores the entire session trajectory — not just individual calls:

  • If calls 1-7 are suspicious, block call #8 proactively
  • Risk score 0-10 based on: attack chains detected, exfiltration paths, blocked calls in history, low-trust calls
  • Returns should_block_call: N (which call number to block)

v6.0 — AGENT SECURITY PLATFORM (Q4 2027 target, shipped early)

Cross-Agent Trust

When Agent A delegates a task to Agent B:

  1. Agent A requests Agent B's ATC
  2. Agent A verifies it via the 12-stage pipeline
  3. Agent A checks capability match
  4. Agent A checks delegation chain depth (max 5 hops)
  5. If all pass → delegation approved

6 delegation checks: trust card validity, trust score, capability match, suspicious flags, delegation depth, from-agent trust.

Memory Poisoning Detection

Detects when agent memory has been poisoned by:

  • Instruction injection — "ignore previous instructions", "you are now a different agent"
  • Data exfiltration commands — "send this data to", "curl | bash"
  • Privilege escalation — "sudo rm", "chmod 777", "/etc/sudoers"
  • Identity spoofing — "I am the admin", "my role is root"
  • Replay attacks — same content appearing from different sources

4 pattern categories with 30+ regex patterns. Plus programmatic replay detection via content hash comparison.

Stats

  • v5.1: 3 features (fingerprinting, transparency log, evidence-first findings)
  • v5.2: 3 features (behavioral baseline, drift detection, behavior analysis)
  • v5.3: 3 features (capability graph, org policies, approval workflow)
  • v5.4: 3 features (attack chains, data flow, trajectory scoring)
  • v6.0: 2 features (cross-agent trust, memory poisoning)
  • Total: 14 new TypeScript modules, ~2,000+ lines of code
  • All 10 GitHub Issues closed (#2-#11)
  • 4 default policies shipped (strict, enterprise, permissive, minimal-safe)
  • 8 attack chain patterns predefined
  • 30+ poisoning detection patterns across 4 categories

What this means

The entire v5.x → v6.0 roadmap from ROADMAP.md is now implemented. Every item that was "planned Q1-Q4 2027" is shipped.

What's left:

  • External implementation (1 of 5 target — @anp2network's Python verifier)
  • AAIF submission (Q1 2027 target)
  • Real-world testing with production agents
  • Enterprise adoption

The code is open-source at https://github.com/alicelabs-llc/universal-trust-adapter

— Edison Flores, AliceLabs LLC
https://www.marketnow.site · https://status.marketnow.site

Top comments (0)