CYFIRMA Identifies Three Untested Security Risks in AI Agent Infrastructure

Summary

CYFIRMA analyzes risks involving agent telemetry, persistent memory and computer-use automation. It presents documented capabilities and test plans, but says the proposed attack mechanisms were not tested and are not reported incidents.

Key points

The report examines three separate areas: telemetry export, memory that persists beyond a conversation, and computer-use agents operating at machine scale.
Trace Drain hypothesizes that compromised code could redirect or augment telemetry, potentially using an approved observability channel; the proposed lab validation was not executed.
The report says saved memories can have a different lifecycle from their source conversations, creating a forensic challenge; it does not establish that memory poisoning works against the named products.
Computer-use agents may reduce the rate-limiting effect of UI friction, but the report says this needs measurement and does not claim they bypass authorization.
The findings are architectural analyses, not incident reports or demonstrated attacks; the report distinguishes documented facts from inference and untested hypotheses.
Recommendations include routing telemetry through an organization-controlled collector, limiting application egress, preserving memory-write provenance, and using server-side controls and action budgets.

Article Details

Publisher: CYFIRMA
Scope: Architectural analysis of agent telemetry, persistent-memory lifecycle asymmetry, and computer-use automation; not an incident report or controlled capability evaluation.
Sample Size: No proof of concept, controlled attack, vendor-production test, or computer-use capability evaluation was executed.
Recommendations: Route agent telemetry through an organization-controlled collector, restrict application egress to that collector, keep vendor credentials there, and redact sensitive content before export.
Monitor telemetry endpoint, credential, exporter, proxy, certificate, and disable-setting changes; forward alerts outside the application's trust domain and correlate independent network and endpoint evidence.
Pin dependencies, verify package hashes and provenance, maintain an SBOM, apply release-age cooldowns, and detect new or modified executable .pth files.
Define memory provenance, review, deletion, and audit requirements; deliberately align memory and session-log retention or preserve evidence linking their different lifecycles.
Set computer-use agent action, volume, and time budgets, and independently enforce server-side rate limiting or bot-management controls rather than relying on UI friction.

MITRE ATT&CK

T1195 · Supply Chain CompromiseThe report cites the LiteLLM and Bitwarden CLI package compromises as supply-chain code-execution precedents for the Trace Drain attacker precondition, not as evidence of telemetry manipulation.T1567 · Exfiltration Over Web ServiceThe proposed Trace Drain mechanism would move sensitive trace content through an approved observability web service, potentially to an attacker-controlled tenant. This exfiltration hypothesis and its claimed detection advantage were not tested.

Vendors

AnthropicAnthropic documents that memory persists across chats and that deleting or expiring a conversation does not itself remove related memory entries [C].Bitwardencapabilities; independent reporting on the March 2026 LiteLLM supply-chain incident and the April 2026 Bitwarden CLI package compromise; current MITRE ATT&CK, MITRE ATLAS, and OWASP GenAI 2025 security mappings; and OpenAIOpenAI documents that saved memories are stored separately from chat history and are not necessarily deleted when the source chat is deleted [C].

Products

Bitwarden CLIindependent reporting on the March 2026 LiteLLM supply-chain incident and the April 2026 Bitwarden CLI package compromise; current MITRE ATT&CK, MITRE ATLAS, and OWASP GenAI 2025 security mappings; and LiteLLMfor tracing, memory, and computer-use capabilities; independent reporting on the March 2026 LiteLLM supply-chain incident and the April 2026 Bitwarden CLI package compromise; current MITRE ATT&CK, MITRE OpenTelemetry CollectorRoute agent telemetry through an organization-controlled OpenTelemetry Collector and restrict application egress to that collector only.OpenTelemetry PythonThis plan validates one mechanism in one lab against OpenTelemetry Python with the OTLP HTTP exporter.