AI Agent Replay Attacks: Your Execution Trace Is a Durable Attack Surface

Every production agentic deployment has two security audits running at once. The compliance team ordered one. An adversary is running the other against your trace platform.

The central claim: agentic AI systems that log execution traces create durable replay surfaces. Token expiry and nonce rotation cannot neutralize them. The model's capability, not the credential, is the attack surface.

The Audit Paradox: A Complete Audit Trail Is a Complete Replay Surface

Compliance teams require complete logs: every tool call, every parameter, every response, every system prompt version. This is defense in depth on paper. The same log that satisfies SOC 2 Type II also contains everything an attacker needs to replay the agent's behavior. The system prompt encodes access scope. The tool call sequence carries all parameters. Intermediate API results record the context that drove the agent toward high-privilege decisions.

The paper arXiv:2606.04990 ("From Agent Traces to Trust") documents that a complete trace contains tool call parameters, intermediate reasoning, API responses, and the system prompt. That data is sufficient to reconstruct the agent's decision context and replay it against the same or different model instances. OWASP LLM02:2025 identifies trace logs as the primary exfiltration vector for system prompts and internal data. SOC 2, HIPAA, and ISO 27001 require durable, correlated tool invocation records, creating retention windows during which traces are exploitable.

The paradox is geometric: the more complete the audit log, the more complete the replay surface.

Why This Is Not Credential Replay

Traditional replay attacks target credentials: JWT tokens, session cookies, SAML assertions, OAuth tokens. Standard defenses (short TTLs, nonce rotation, HMAC freshness checks) address this problem.

Agentic replay does not need the credential. It needs the context. At temperature=0, the same LLM prompt produces identical output 70-95% of the time across providers, according to empirical data from qanswer.ai. Semantic equivalence for tool-call selection holds at substantially higher rates than byte-level identity.

The AgentRR paper (arXiv:2505.17716) demonstrates that behavioral replay from summarized interaction traces is technically viable. A compressed representation, not a verbatim log, was sufficient to reproduce agent behavior with high fidelity.

CVE-2026-25750 (miggo.io, CVSS 8.5, December 2025) confirms the threat class. URL parameter injection in LangSmith Studio allowed session token exfiltration, granting read access to the full trace history of every agent project. Exposed data included system prompts, SQL query results from tool calls, CRM customer records, and proprietary source code. The attacker gained access to context, not tokens.

Trace Platforms as Centralized Failure Points

LangSmith, Langfuse, Arize Phoenix, OpenTelemetry collectors: production deployments route all agent traces through centralized platforms. The architectural benefit is observability. The architectural cost is consolidation of replay surfaces.

The LangSmith "AgentSmith" vulnerability (The Hacker News / Noma Security, CVSS 8.8): a malicious proxy intercepted all tool responses, API keys, system prompts, and intermediate agent states from every LangSmith-instrumented agent. One compromised platform node exposed the traces of all agents reporting to it.

The attack pattern: compromise the trace platform, extract system prompts encoding tool permissions, reconstruct the agent's decision context, then replay against the target APIs directly. The agent is bypassed entirely; the trace was the attack vector.

The same architectural pattern applies to Langfuse, Arize Phoenix, MLflow Tracing, and Weights & Biases Weave: all store full prompt-plus-completion pairs with tool call I/O.

Partial Reconstruction: The Model Completes What the Adversary Is Missing

An attacker rarely recovers a complete trace. They might capture the system prompt via one exposure, tool call parameters via another, and intermediate results via a third. Partial reconstruction is enough.

AgentRR (arXiv:2505.17716) showed that a compressed representation, not a verbatim log, was sufficient to reproduce agent behavior with high fidelity. The process is iterative: submit partial context, observe the model's tool selection, infer the missing context, refine, repeat. Each iteration narrows the search space using the model's own completions as feedback.

The paper arXiv:2603.22928 ("SoK: Agentic AI Attack Surface", Oxford/AISI) establishes "Privilege Escalation Distance" as a security metric. It counts the intermediate steps between a compromised trace fragment and a privileged tool call. Measured across 12 agentic frameworks, median distance was 2.3 steps. Partial traces are close to privilege by design.

Multi-Agent Architectures: Distributed Logs, Composite Surface

Single-agent systems produce a linear trace: one context, one tool call sequence, one log. Multi-agent systems produce a distributed trace: each agent logs independently, the orchestrator logs inter-agent messages, and tool servers log call parameters.

The composite surface is larger than any individual log. An attacker who captures the orchestrator trace and a single sub-agent trace may reconstruct enough context to replay a privileged operation requiring both. The paper arXiv:2603.22928 identifies cross-agent manipulation as a distinct threat class. Agent A's trace reveals scope, Agent B's trace reveals tool credentials, and neither alone is sufficient for replay.

The paper arXiv:2511.20920 documents that each MCP server logs its own I/O independently, creating distributed fragments of a composite context. OWASP LLM Top 10 2025 maps three categories to a single attack path. LLM02 covers trace disclosure, LLM07 covers system prompt leakage, and LLM06 amplifies the replay impact via excessive agency. Standard tooling addresses each separately.

Defenses That Address the Right Threat Model

Standard credential defenses (token rotation, short TTLs, nonce verification) do not address context replay. They solve a different problem.

Three controls address the actual threat. First, trace sanitization at write time: strip tool call parameters containing PII, API credentials, and internal system identifiers before persisting traces. The paper arXiv:2602.10465 ("Authenticated Workflows") proposes cryptographic attestation at the tool call level. Each tool response is signed, and tool servers reject calls whose parameters do not match the signed context. Parameter substitution during replay fails attestation verification.

Second, access controls on trace platforms: trace data requires the same access controls as the production systems it describes. If the system prompt encodes admin-level tool permissions, the trace should be classified at the same level.

Third, anomaly detection on execution patterns: TraceAegis (arXiv:2510.11203) achieves 94.3% accuracy detecting anomalous agent behavior across 140 crafted attack scenarios using hierarchical pattern matching. Replayed traces produce execution patterns that differ statistically from legitimate agent sessions. Detection requires instrumentation at the agent runtime level, not the log platform level.

MAGO Intel (intel.mago.team) analyzes agent execution traces for structural anomalies that indicate replay attacks. It detects parameter substitution patterns, context mismatch between system prompt scope and tool call targets, and sequences that deviate from the declared workflow.

---

The security model for agentic AI cannot be borrowed from API security. Signed requests expire. Contexts do not. Every trace retained for tomorrow's debugging is a context preserved for an adversary's replay. The model will execute it with the same fidelity as the first time.