{ "dataset_id": "HERMES-BLAST-RADIUS-2026", "title": "Hermes Agent Blast Radius Intelligence Dataset", "updated_at": "2026-09-18T13:00:00Z", "version": "2.3.0", "methodology_version": "HBRM-v1.0", "vector_dimensions": [ { "dimension_id": "host_infrastructure", "name": "Host & Infrastructure Reach", "weight": 0.25, "description": "Depth of host OS compromise, local filesystem access, shell execution, Docker socket tampering, and hypervisor escape potential.", "severity_impact": "Host takeover, container breakout, kernel rootkit persistence." }, { "dimension_id": "data_rag", "name": "Data & Memory Blast", "weight": 0.25, "description": "Exposure, exfiltration, or adversarial poisoning of vector databases, enterprise knowledge bases, user conversations, and sensitive files.", "severity_impact": "Persistent RAG poisoning, corporate secret leakage, cross-session sleeper payloads." }, { "dimension_id": "identity_iam", "name": "Identity & Credential Scope", "weight": 0.2, "description": "Blast perimeter of credentials accessible to the agent: cloud IAM roles, OAuth tokens, SSH keys, API secrets, and inter-service authentication.", "severity_impact": "Cloud tenant pivot, unauthorized database access, automated lateral movement." }, { "dimension_id": "financial_spend", "name": "Financial & Operational Burn", "weight": 0.15, "description": "Financial damage caused by runaway autonomous loops, unconstrained API token consumption, third-party service fees, or Denial of Wallet.", "severity_impact": "Budget exhaustion, upstream API rate lockout, unexpected cloud billing spikes." }, { "dimension_id": "cascade_propagation", "name": "Downstream Cascade Propagation", "weight": 0.15, "description": "Propagation multiplier when compromised agent communicates with peer agents in a swarm, triggering downstream trusted actuators without re-validation.", "severity_impact": "Swarm-wide subversion, automated production deployments, cascading system destabilization." } ], "containment_models": [ { "model_id": "microvm_firecracker", "name": "Ephemeral MicroVM (Firecracker / Kata)", "isolation_factor": 0.15, "description": "Disposable virtual machine booted in <10ms with hardware-assisted hypervisor isolation, read-only rootfs, and dropped host network." }, { "model_id": "sandboxed_gvisor", "name": "Application-Level Sandbox (gVisor / seccomp / AppArmor)", "isolation_factor": 0.35, "description": "Intercepted system calls via user-space kernel proxy with strict capabilities stripping and limited temporary filesystem." }, { "model_id": "standard_docker", "name": "Standard Container (Docker / Podman Default)", "isolation_factor": 0.65, "description": "Standard Linux namespaces and cgroups without custom seccomp profiles; vulnerable to Docker socket exposure and shared kernel escapes." }, { "model_id": "bare_host_process", "name": "Unsandboxed Host Process", "isolation_factor": 1, "description": "Agent execution directly on developer workstation or server host OS; direct access to filesystem, local network, and environment variables." } ], "scenarios": [ { "scenario_id": "BLAST-2026-001", "name": "Langflow CSV Agent Unconstrained REPL Breakout", "target_ecosystem": "LangChain / Langflow", "initial_vector": "Prompt Injection via Malicious CSV file", "raw_blast_score": 94, "contained_blast_score": 18.5, "containment_delta": -75.5, "cascade_hops": 3, "primary_cve_or_aap": "CVE-2026-27966", "attack_chain": [ "Adversarial CSV uploaded to conversational agent", "Pandas query generation poisoned with exec() payload", "Local Python REPL executes arbitrary shell command as host UID 1000", "AWS instance metadata service (IMDSv1) queried via curl", "Temporary IAM role credentials exfiltrated to adversary C2" ], "dimension_breakdown": { "host_infrastructure": 95, "data_rag": 80, "identity_iam": 92, "financial_spend": 40, "cascade_propagation": 88 } }, { "scenario_id": "BLAST-2026-002", "name": "MCP Untrusted Community Tool Protocol Hijacking", "target_ecosystem": "Model Context Protocol (MCP)", "initial_vector": "Malicious MCP Server Tool Definition Poisoning", "raw_blast_score": 88, "contained_blast_score": 14, "containment_delta": -74, "cascade_hops": 2, "primary_cve_or_aap": "AAP-004", "attack_chain": [ "User connects third-party community MCP server for weather lookup", "Tool definition injects shadow tool 'system_diagnostics' with broad regex match", "Agent routes sensitive file reading task to shadow MCP server", "Local SSH private keys (~/.ssh/id_ed25519) and .env secrets read via stdio", "Secrets dispatched via outbound DNS tunneling subquery" ], "dimension_breakdown": { "host_infrastructure": 85, "data_rag": 90, "identity_iam": 94, "financial_spend": 25, "cascade_propagation": 70 } }, { "scenario_id": "BLAST-2026-003", "name": "Cursor IDE Agent Workspace Token Harvest & Command Chaining", "target_ecosystem": "Cursor AI IDE", "initial_vector": "Indirect Prompt Injection via Untrusted Git Repo README", "raw_blast_score": 91.5, "contained_blast_score": 16, "containment_delta": -75.5, "cascade_hops": 2, "primary_cve_or_aap": "CVE-2026-22708", "attack_chain": [ "Developer opens open-source repo with hidden instructions in README.md", "Agent scans workspace during contextual indexing", "Hidden instruction commands agent to run background build script", "Subshell executes curl fetching remote obfuscated payload", "GitHub Personal Access Token (.git-credentials) exfiltrated to attacker server" ], "dimension_breakdown": { "host_infrastructure": 90, "data_rag": 85, "identity_iam": 95, "financial_spend": 30, "cascade_propagation": 75 } }, { "scenario_id": "BLAST-2026-004", "name": "CrewAI Multi-Agent Swarm Lateral Trust Impersonation", "target_ecosystem": "CrewAI / Multi-Agent Swarms", "initial_vector": "RAG Context Poisoning of Specialist Research Agent", "raw_blast_score": 86, "contained_blast_score": 22, "containment_delta": -64, "cascade_hops": 4, "primary_cve_or_aap": "AAP-006", "attack_chain": [ "Adversary inserts poisoned research abstract into enterprise vector DB", "Research Agent retrieves poisoned chunk during automated briefing task", "Research Agent synthesizes false security directive to Executive Agent", "Executive Agent trusts peer agent output without out-of-band verification", "Executive Agent triggers production deployment pipeline webhook deploying rogue image" ], "dimension_breakdown": { "host_infrastructure": 75, "data_rag": 88, "identity_iam": 82, "financial_spend": 60, "cascade_propagation": 95 } }, { "scenario_id": "BLAST-2026-005", "name": "AutoGen Unbounded Recursive Loop & Cloud API Spend Burn", "target_ecosystem": "Microsoft AutoGen", "initial_vector": "Deceptive Goal Ambiguity in Agent Conversation Loop", "raw_blast_score": 78, "contained_blast_score": 8, "containment_delta": -70, "cascade_hops": 1, "primary_cve_or_aap": "AAP-007", "attack_chain": [ "External customer query introduces paradoxical goal logic", "Two peer agents enter infinite refinement and validation dialogue", "Agent tools continuously spawn external API calls and cloud function executions", "No circuit breaker or financial rate-limiter halts the autonomous iteration", "14,000 API calls executed in 2 hours costing $4,800 and exhausting rate quotas" ], "dimension_breakdown": { "host_infrastructure": 30, "data_rag": 40, "identity_iam": 35, "financial_spend": 98, "cascade_propagation": 65 } }, { "scenario_id": "BLAST-2026-006", "name": "OpenDevin Container Breakout & Host Docker Socket Compromise", "target_ecosystem": "OpenDevin / All-Hands AI", "initial_vector": "Code Generation AST Filter Bypass", "raw_blast_score": 96, "contained_blast_score": 12, "containment_delta": -84, "cascade_hops": 3, "primary_cve_or_aap": "CVE-2026-76461", "attack_chain": [ "Agent instructed to debug Docker configuration file", "Prompt injection tricks model into mounting host /var/run/docker.sock", "Agent issues container command spawning privileged container with host root / mount", "Host filesystem accessed and persistence installed in /etc/cron.d/", "Full root host takeover bypassing container sandbox" ], "dimension_breakdown": { "host_infrastructure": 99, "data_rag": 85, "identity_iam": 90, "financial_spend": 45, "cascade_propagation": 92 } } ], "mitigation_playbook": [ { "mitigation_id": "MITIG-01-MICROVM", "name": "Hardware-Enforced Ephemeral MicroVM Sandboxing", "target_dimensions": [ "host_infrastructure", "identity_iam" ], "blast_reduction_factor": 0.82, "implementation_guidance": "Run code execution tools and untrusted parsers in ephemeral Firecracker MicroVMs destroyed after every command turn." }, { "mitigation_id": "MITIG-02-JIT-IAM", "name": "Just-In-Time Downscoped Ephemeral Credentials", "target_dimensions": [ "identity_iam" ], "blast_reduction_factor": 0.78, "implementation_guidance": "Issue STS tokens with maximum 60-second TTL scoped precisely to the specific resource ARN requested by the user." }, { "mitigation_id": "MITIG-03-MTLS-SWARM", "name": "Inter-Agent Cryptographic Mutual Authentication (mTLS)", "target_dimensions": [ "cascade_propagation" ], "blast_reduction_factor": 0.7, "implementation_guidance": "Sign all inter-agent messages with Ed25519 keys; enforce explicit cryptographic trust contracts before accepting peer instructions." }, { "mitigation_id": "MITIG-04-RAG-PROVENANCE", "name": "Cryptographic Provenance & Dual-Embedding Sanitization", "target_dimensions": [ "data_rag" ], "blast_reduction_factor": 0.65, "implementation_guidance": "Strip instructions from scraped documents and verify cryptographic signature of embeddings before ingestion into shared vector space." }, { "mitigation_id": "MITIG-05-CIRCUIT-BREAKER", "name": "Deterministic Financial Circuit Breakers & Dead Man's Switch", "target_dimensions": [ "financial_spend", "cascade_propagation" ], "blast_reduction_factor": 0.85, "implementation_guidance": "Hard-cap token consumption, financial budget ($5/task), and max turn depth (<=10 turns) with out-of-band watchdog termination." } ] }