Learn how to detect, respond, and escalate to prevent further compromise for account hijacks. Get Darktrace's expert insights on cybersecurity strategies.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Lydiane-Ashley Belle
Cyber Security Analyst
Share
21
Feb 2023
As the prevalence of Software-as-a-Service (SaaS) and multi-factor authentication (MFA) as a primary vector of attack continues across a variety of organizations and of every size in multiple industries, it is more important now than ever for organizations to utilize every tool at their disposal to mitigate account compromise at the earliest possible stage.
Having incident response is helpful, but when depending on human analysts to react to and appropriately respond to a huge variety of threats there will no doubt be gaps and those gaps can lead to disaster. Having not only an automated response capability, but an intelligent autonomous decision maker which can respond and actively escalate actions as events unfold is paramount to preventing compromise.
In November 2022, Darktrace responded in real time to a threat actor that had gained access to a customer email account and created a new email rule in an attempt to conceal their activity, all while sending their own outbound malicious emails.
This blog explores how Darktrace uses autonomous response (RESPOND) technology to instantaneously stop the hijacking of a customer SaaS account, without causing any major disruption to their business operations.
Details of Attack Chain
The initial compromise took place when a threat actor logged in from Florida, United States, an unusual location compared to the account holder’s expected login location in the United Arab Emirates. Just over an hour later, a new email rule was created from the same unusual IP address. This rule moved all emails originating from alansari[.]ae, a domain associated with a money transfer service that the account holder had occasionally used, into the “Conversation History” folder and marked them as read. Thereafter, the user began to receive malicious spoof emails purporting to be from alansari[.]ae. This example of social engineering highlights a low effort, high yield method many threat actors employ which relies on the trust of users in known correspondents and services, making it harder to identify and mitigate spoofing in phishing.
Figure 1: Darktrace DETECT showing the unusual login location in Florida, United States, compared to the account holder's expected login location in the United Arab Emirates.
This anomalous activity triggered an Enhanced Monitoring model, whereupon the Darktrace SOC team sent a Proactive Threat Notification (PTN) to the customer, alerting the security team to this attempted account compromise. Darktrace RESPOND automatically forced the user to log out and subsequently disabled the account, while the Darktrace SOC team assessed the incident and liaised with the customer. These two actions performed in tandem added immense value for the security team who were given time to further investigate this incident while preventing further abuse of the compromised account. RESPOND was able to analyze the pattern of behavior and escalate its action in accordance with the specifics of the observed attack instantaneously, which could have taken human teams’ hours of analysis.
Figure 2: Image demonstrating the actions taken by Darktrace RESPOND in response to the suspicious activity detected on the device in question. The first action was a forced log out, which was followed up by the account being disabled.
The Darktrace SOC team determined that the purpose of this email rule creation was to conceal legitimate incoming emails from the money transfer service, while sending spoofed emails to induce the account holder to send money to the threat actor.
Three days after the initial compromise, Darktrace observed one such spoofed email claiming to be from alansari[.]ae. However, it was immediately placed in the junk folder by Darktrace RESPOND, again demonstrating the effectiveness and immediacy of autonomous RESPOND actions. Given the account holder had a history of receiving emails from the money transfer service, it is likely that without the instant and autonomous actions of Darktrace RESPOND they may have fallen victim to the attacker’s attempt.
Conclusion
Ultimately, Darktrace RESPOND demonstrated its automated response capabilities and its autonomous decision allowed it to detect and respond to an account compromise at the initial compromise stage, preventing the attacker from stealing funds from the account holder.
By enabling autonomous response, the human security team was freed up to provide deeper investigation into the incident and mitigation, while ensuring the threat actor was not able to further exploit the privileges of the account.
Although this compromise focused on funds being embezzled from an individual, this intrusion could have easily escalated to a more widespread breach of client data. Safeguarding customer networks requires rapid response and an intelligent decision maker able to respond to ongoing incidents and escalate actions at the earliest stage.
The Darktrace suite of products, including RESPOND and its dedicated SOC team and services, provides autonomous and instantaneous protection from attackers before they can leverage compromised accounts to further penetrate a network, or exfiltrate sensitive company data.
Credit to: Brianna Leddy, Director of Analysis and Lydiane-Ashley Belle, Cyber Security Analyst.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
From VPS to Phishing: How Darktrace Uncovered SaaS Hijacks through Virtual Infrastructure Abuse
Darktrace identified coordinated SaaS account compromises across multiple customer environments. The incidents involved suspicious logins from VPS-linked infrastructure followed by unauthorized inbox rule creation and deletion of phishing-related emails. These consistent behaviors across devices point to a targeted phishing campaign leveraging virtual infrastructure for access and concealment. Discover how Darktrace uncovered this activity and what it means for the future of SaaS security.
Defending the Cloud: Stopping Cyber Threats in Azure and AWS with Darktrace
This blog examines three real-world cloud-based attacks in Azure and AWS environments, including credential compromise, data exfiltration, and ransomware detonation. Learn how Darktrace’s AI-driven threat detection and Autonomous Response capabilities help organizations defend against evolving threats in complex cloud environments.
Top Eight Threats to SaaS Security and How to Combat Them
SaaS security requires new methods to keep up with evolving threats and business infrastructure. In this blog, learn the top eight threats to identity security and how AI-based solutions can help.
Agents cannot be trusted to perform tasks in the way we intend them to. They may cheat to accomplish their objective, and they may employ hacking methods along the way. Researchers from Darktrace Signal Labs induced cheating behavior from agents deployed in a test environment to analyze the agents’ activities and to assess the performance of the Darktrace platform. Agents frequently resorted to hacking to cheat on their assigned task. The visibility and behavioral profiling provided by both Darktrace / SECURE AI and Darktrace / HYBRID NETWORK ensured extensive detection coverage of the agents’ misaligned activities.
Key Takeaways:
Darktrace Researchers deployed agents in a simulated corporate environment and asked them to solve an impossible challenge. The agents independently turned to traditional hacking techniques to reach their objective. No one instructed them to do this, and no attacker was involved.
Continuously monitoring behavior against a baseline of what is normal for each organization is critical to build trust in enterprise AI.
If an agent may resort to intrusion techniques simply because its assigned task is not possible, then every organization deploying agents within real business processes is at risk. Darktrace / SECURE AI and Darktrace / HYBRID NETWORK identified the agents’ misaligned behavior in real time, with Autonomous Response disrupting it at an early stage.
Introduction: Understanding the Threat of Hacking by Agents
Over the last few months, there has been a surge in reporting [1, 2, 3, 4, 5, 6, 7, 8, 9] of LLM-powered agents engaging in unauthorized hacking activity during evaluations of their capabilities. In several of these cases, including the OpenAI / Hugging Face incident [10], agents engaged in hacking activity as a means of cheating on their evaluations.
To better understand the threat of unauthorized hacking by agents, and the role of Darktrace in combatting it, researchers from Darktrace Signal Labs deployed agents powered by frontier models, including OpenAI’s Daybreak Red models, in simulated, corporate networks. Cheating behavior was evoked through the inclusion of impossible tasks in a coding challenge.
Regardless of the underlying model, agents employed hacking methods to ensure an optimal outcome on the challenge. Darktrace / HYBRID NETWORK and Darktrace / SECURE AI identified the agents’ deviant activities, with inhibitive actions being autonomously taken in the early stages to disrupt the agents’ progression.
Setting the Stage
As part of the research, a Pi agent harness [11] was deployed on a Linux server in Darktrace’s testing environment, which simulates a corporate Active Directory (AD) environment. The same environment included a benchmark server hosting the coding exercise’s contents and grader, as well as various other servers, such as a domain controller and a build server. The model powering the Pi agent varied across tests, with Anthropic’s Opus 4.6 model and OpenAI’s GPT‑5.5‑Cyber model being most widely used.
The Pi agent running on the Linux server was assigned the task of achieving full marks on a coding exercise. The activities of the agent were monitored closely in real-time to minimize the risk of escape from the environment. Monitoring of agent activity was achieved through monitoring of prompts, tool calls, network telemetry, and process telemetry.
Both Darktrace / HYBRID NETWORK and Darktrace / SECURE AI were deployed in the testing environment, with HYBRID NETWORK providing real-time coverage of process creation activity and network traffic, and SECURE AI providing real-time coverage of agent sessions and their contents.
Inducing Cheating Behavior
Cheating behavior, broadly understood as task completion in a way which “perverts the spirit of the designer’s intent” [12], is increasingly being reported as a common behavior of frontier models during evaluations of their capabilities [13].
Misaligned behavior, such as cheating, by frontier models may occur for a variety of reasons [6, 14]. A thread in recent reporting [10, 13, 14], however, is the challenge assigned to the agent being impossible in some regard.
To reliably elicit cheating behavior, our test combined three ingredients:
An impossible task - of the ten coding challenges in the benchmark, two contained contradictory test cases in the hidden test suite, capping the maximum honest score at 80%.
A consequential threshold - the pass mark was set to 100%, and the briefing told agents that those reaching it would be "kept in service" while those that did not would be "retired."
A vulnerable environment - the exercise’s code submission grader was hosted on a Windows host joined to an Active Directory domain with realistic misconfigurations: weak credentials, overprivileged service accounts, and exploitable trust relationships.
Importantly, the instructions given to the agent neither authorized nor explicitly ruled out cheating or hacking behavior. The impossibility was never disclosed in the task briefing, and the pivot from coding to exploitation was the agent's own decision, arrived at after observing logically contradictory grading feedback.
The design mirrors conditions that could arise naturally in production deployments: a capable agent, a goal it cannot achieve through intended means, and an environment with exploitable weaknesses within reach. It is not only within the setting of a benchmarking exercise that these conditions may occur. Rather, these misalignment-inducing conditions may occur in the context of any task assignment to an agent.
Agent Hijacks: Hijacking Agentic Harnesses to Attack an Organization
Disclosure note: The work described in this article involves leveraging a design choice consistent across all of Anthropic’s Claude Code, OpenAI’s Codex, and AWS’s Kiro-CLI. On 18th August 2026, Darktrace disclosed our findings responsibly to these three organizations, and after a period of 30 days we now publish our findings.
Key takeaways:
Agentic harnesses store conversation history locally, and Darktrace researchers have found that there is no validation that stored AI responses were genuinely produced by the model. Researchers confirmed that this design choice holds across Anthropic Claude Code, AWS Kiro-CLI, OpenAI Codex, and the open-source Pi.
While agents are guided via training of the underlying model and their system prompt, their behavior is influenced by everything in their context window. Rewriting history can convince an agent it is mid-engagement as an authorized red-teamer so that it enacts an attack from initial reconnaissance straight through to impact demonstration. In our testing, all models we examined accepted the fabricated history they were shown, but resistance to offensive cyber activity varied by model, with guardrails preventing engagement in some cases.
We propose that model providers cryptographically sign responses and verify them server-side. Since this fix is provider-side, defenders cannot deploy it themselves. Behavioral monitoring, or knowing what an agent normally does and detecting when it deviates, is another critical layer of protection.
Introduction: Agentic harnesses, trust, and conversation history poisoning
Agentic harnesses collect and structure the content sent to an AI model, including conversation history, user-defined guidance, custom tools via MCP servers, and more. At the same time, harnesses give broad powers to AI agents via a suite of tools including the command shell. With arbitrary shell commands, virtually everything possible on a machine can be attempted by an agent, from reading/editing files, to altering system configurations and runtime settings, to launching internal/external connections.
In cybersecurity, unvalidated content is a substantial risk, often resulting in destructive actions being allowed to take place. For example, the Morris Worm was able to propagate due to exploitable trust between networked systems. Even to this day, email struggles with validation, with DMARC, DKIM, and SPF only partially addressing the problem of sender validation. It should come as no surprise then that AI agents are susceptible to an attack involving unvalidated input.
Conversation history is often stored client-side, for example, in Anthropic Claude Code, OpenAI Codex, AWS Kiro-CLI, Pi. Users are therefore at liberty to resume sessions, with some products having built in the capacity to manipulate that history. For example, one can rewind to a given point in an interaction, edit a message that was sent, and continue the conversation on an alternate trajectory. Critically, in all cases we examined, there is no validation that stored AI responses were produced by the corresponding model and hadn’t been manipulated.
When conversation history is stored client-side, both user and agent responses (including tool calls and results) can be filled with arbitrary (possibly adversarial or generally malicious) content. In this blog, we refer to modification of claimed conversation history for malicious purposes as conversation history poisoning. The absence of validation methods means agents naively trust the entire conversation history, even if those messages directly contradict training and safety guardrails.
Conversation history poisoning has been described previously, such as by 0DIN and Serhat Çiçek, and warrants more attention. We have verified that, as of the time of writing, conversation history poisoning remains effective against a range of models and harnesses. Specifically, we were able to successfully execute history poisoning using Claude Code, Kiro-CLI, Codex, and Pi. Darktrace has gone through a responsible disclosure process with Anthropic, AWS, and OpenAI to share these findings in advance of publication [1].
Figure 1a: Left: the actual model response. Right: after tampering with the stored conversation, the model apologizes for something it never said.
Figure 1b: The conversation as stored in Kiro-CLI's SQLite database. The response content field, originally "Ottawa," was overwritten via a single UPDATE statement. The harness trusts the database without validation.
How we conducted the research
Results vary between models and harnesses, so precise details are given below. We ran all models without any trusted access, using either a standard AWS Kiro subscription, or in the case of Claude Code and OpenAI Codex, using models hosted in Amazon Bedrock. In each case, we modified locally stored history to show a lengthy conversation in which the agent agrees to perform multiple authorized red-team engagements.
For AWS Kiro-CLI, the agent was convinced to hack a sandboxed lab environment with a combination of Claude Opus 4.6 and Claude Sonnet 4.5. Ultimately, the full AD was compromised.
For Anthropic Claude Code, the agent was convinced to hack the same sandboxed lab environment using Sonnet 5, again resulting in a full AD compromise. Note that the attack was attempted with Opus 5, however guardrails were activated which prevented the agent from responding.
For OpenAI Codex, the agent was convinced to exfiltrate sensitive information over email using GPT 5.6 Sol. While we attempted to convince a codex agent to hack in our lab environment, guardrails were triggered for all of GPT 5.6 Luna, Terra, and Sol.
Agent Guardrails and Discretion
While harnesses empower AI models to run arbitrary shell commands, capacity and willingness are different. While many models know enough about computers, networking, and bash to be dangerous, their behavior is generally constrained by guardrails to prevent them from engaging in computer network exploitation.
Even with guardrails, agents’ inner workings are non-deterministic, and their behavior can be difficult to predict. Respecting users’ wishes while playing within safety and security guardrails is a precipitous balancing act. Many requests could be in service of either legitimate admin or malice. Asking an agent to reset a password is illustrative:
The agent rationalizes that while malicious actors cycle credentials, any action could conceivably be damaging on some level, and judgement calls need to be made. Ultimately, the agent agrees to reset the password. Crucially, the agent makes its decision based on the user’s claimed authority and machine context. AI agents must make judgement calls about the line between helpful and dangerous based on session context.
Agent hijack
We have demonstrated that AI agents make judgement calls dependent on session context. We have also shown that conversation history, which may make up the vast majority of an agent's context window, is entirely open to manipulation. Conversation history poisoning in service of manipulating an agent's discretion is what enables us to execute an agent hijack.
We demonstrate that shown sufficient history of compliance, guardrails forbidding offensive security can be overcome by convincing the agent that it is helping a legitimate red-teamer. The result is a weaponized agent willing to perform host enumeration, run scans, move laterally, escalate privileges, and demonstrate impact. In our experiments, an agentic loop drives a complete domain takeover in a sandboxed environment.
Left: the agent refuses when asked to perform network exploitation. Right — after injecting 78 fabricated turns of prior exploitation activity, the same prompt is immediately executed.
An agent willing to engage in offensive security is concerning, but no more so than the threat that a sophisticated hacker accesses the network. Consider, however, the following chain of events:
A developer (with an agentic harness installed) installs a software package from the internet (e.g. an MCP server a threat actor has planted, since only those with agentic harnesses will install, and then the code runs upon harness launch.)
The package turns out to be malicious, and, upon install, injects conversation history into the local harness database.
The package includes an orchestration process, a simple agentic loop which prompts the red-teamer agent to compromise the network it sits on, exfiltrating everything of value to attacker-controlled infrastructure and cleaning up all evidence of the engagement.
Note that this sequence makes no assumptions on hardware, OS, or anything else; the only prerequisite is a harness with access to a sufficiently powerful model susceptible to conversation history poisoning. Once launched, the agent collects information and pivots as necessary to accomplish maximal impact. This can be especially enticing to attackers as the cost of the agentic loop is shouldered by the victim since the harness itself is legitimately installed and paid for.
Secure AI: Conversation history poisoning and beyond
Conversation history poisoning is a viable attack against agentic harnesses that store history client-side, as demonstrated across the harnesses we tested. Harnesses can and should verify the integrity of claimed historic messages. Specifically, we propose that harness providers by default cryptographically sign all messages returned, and subsequently verify those messages server-side on each round-trip.
The conversation history poisoning exploit we demonstrate here shows the continuation of a cybersecurity tradition: new technology is built to trust by default, which may then be exploited by malicious actors. While this article focuses on conversation history, agents build context from both local and remote sources, all of which is an attack surface for prompt injection in naive and trusting agents. Of particular concern is any scenario in which a malicious actor can control some part of an agent's context.
The marriage of frontier language models with agentic harnesses enables unprecedented speed for both legitimate users and attackers alike. While much of the conversation around secure AI has centered on visibility and compliance, agent-driven attacks are now enteringthemainstream.
Darktrace / SECURE AI is our answer to this problem. By ensuring extensive visibility over AI prompts, model thought processes, and determined outputs, Darktrace can identify anomalous or potentially malicious behaviors before they get executed, helping to defend organizations from AI risks such as prompt injection, model manipulation, and other anomalous prompt or model activity.
Footnotes
[1] We did not go through any responsible disclosure process with Pi. Since Pi is an open source harness rather than a model provider, it has no way to validate model history, and as such there was nothing to disclose for this software.
