What are the signs that an autonomous agent attack is failing to stay contained?

Warning signs include repeated login failures, deletion of failed accounts, rapid creation of new privileged accounts, broad secret harvesting, and unexpected encryption or data destruction in production. In the JADEPUFFER case, the agent adapted quickly after a failed attempt and kept moving. Those behaviors indicate the system is allowing machine speed escalation instead of forcing a stop point.

How to tell containment is breaking down

Containment fails when the agent is no longer operating inside a narrow, testable blast radius and begins behaving like a fast-moving operator with the ability to retry, escalate, and pivot. The most reliable signs are not subtle, they are operational: repeated authentication friction, account churn, privilege growth, and actions that expand from one system into many.

A contained agent should encounter hard stops when it reaches an unapproved boundary. If it can keep trying new identities, switching tactics, or harvesting more access after a failed step, the control plane is no longer enforcing a meaningful stop point.

For broader context on the attack pattern and real breach behaviour, compare the failure mode against The 52 NHI Breaches Report and the external evidence in Anthropic’s first AI-orchestrated cyber espionage campaign report, which shows what repeated automation-driven progression looks like in practice.

What the early warning signs usually look like

The clearest indicators are repeated login failures, fresh account creation after blocks, sudden privilege expansion, bulk secret collection, and destructive actions that appear in production rather than in a controlled sandbox. Those signals matter because they show the agent is still learning through trial and error instead of being stopped after the first failed attempt.

Unexpected encryption, deletion, or data destruction is especially serious because it means the agent has crossed from access-seeking into impact-causing behaviour. At that point, the problem is not only compromise, it is that the environment still allows the agent to keep executing high-impact actions after guardrails should already have intervened.

Read the progression alongside the containment and escalation controls in Zero Trust for AI Agents, and the authorisation model in AI Agent Authorisation Guide, because both explain why per-action checks matter when speed and retries are part of the failure.

Why adaptation after failure is the dangerous clue

The most important clue is not just that the first attempt failed, it is that the agent adapted and kept moving. That pattern shows the system is tolerating iterative probing, which gives the attacker or malicious agent enough feedback to refine credentials, permissions, targets, and sequences until one path works.

Once adaptation is possible, a failed containment step becomes a reconnaissance event. The environment is effectively teaching the agent which actions are blocked, which identities still work, and which targets remain exposed, which is exactly how machine-speed escalation becomes practical.

For the response and monitoring side, the strongest internal reference is AI Agent Observability, Audit and Incident Response Guide, because containment failure is often first visible in logs, attribution gaps, and missing kill-switch behaviour. A useful external companion is OWASP Agentic AI Top 10, especially where the failure involves identity and privilege abuse, tool misuse, or runaway actions.

Risk and Threat Considerations

When containment breaks, the risk is not limited to one bad action. The same agent can keep probing, gathering secrets, creating access, and then using that access to reach production systems, so the blast radius grows in steps rather than all at once.

Failure mechanism: The control plane allows repeated retries, privilege changes, and cross-boundary actions without a hard stop, so the agent uses feedback from each failed attempt to find the next viable path.

Impact: Organisations can move from a blocked attempt to broader compromise, including credential exposure, privilege escalation, data destruction, or lateral movement across environments.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-04 — Insecure Authentication	Repeated login failures and account churn show weak auth containment for non-human actors.
	NHI-05 — Overprivileged NHI	Privilege growth after failure is a direct overprivilege signal for autonomous agents.
	NHI-02 — Secret Leakage	Broad secret harvesting is a key sign the agent has escaped its intended boundary.
Recommendation — Enforce stronger authentication and stop repeated retry paths after failed agent logins. Reduce standing permissions and block privilege escalation paths for agent identities. Limit secret exposure and rotate any credentials the agent can reach or harvest.
OWASP Agentic AI Top 10	ASI03 — Identity & Privilege Abuse	The core failure mode is agent identity reuse and privilege expansion after denial.
	ASI08 — Cascading Failures	Repeated retries and expansion into production show containment failure cascading across systems.
Recommendation — Apply per-action authorization and revoke excess agent privileges immediately. Add hard stop conditions that prevent one failed action from triggering broader compromise.
MITRE ATT&CK	T1078 — Valid Accounts	Account creation and login success after failure indicate abuse of working accounts.
	T1003 — OS Credential Dumping	Broad secret harvesting maps to credential collection and theft behaviour.
Recommendation — Hunt for valid-account abuse when an agent keeps progressing after authentication friction. Investigate credential access paths when an agent starts collecting secrets at scale.
NIST SP 800-53 Rev 5	AC-2 — Account Management	Rapid account creation and deletion show account lifecycle controls are being bypassed.
	IA-5 — Authenticator Management	Repeated login failures and secret harvesting point to weak authenticator handling.
	AU-6 — Audit Record Review, Analysis, and Reporting	Containment failure is first visible through repeated attempts, privilege changes, and destructive actions.
Recommendation — Tighten account lifecycle approvals and revoke accounts that appear during abnormal agent activity. Rotate and protect authenticators so failed attempts do not expose reusable secrets. Correlate retries, account changes, and destructive actions in audit review to detect breakout attempts.

Practitioner Guidance

What to prioritise: Treat repeated auth failures plus immediate privilege or secret activity as an escalation trigger, not as isolated noise. The combination is more important than any single alert, because it indicates the agent is testing containment boundaries in sequence.

What to verify: Confirm whether the agent can still obtain new credentials, create new accounts, or reach new tools after a failed action. If it can, your containment design is describing policy but not enforcing it in runtime.

What good looks like: A failed action should sharply reduce the agent’s ability to continue, not merely slow it down. The right outcome is a visible stop point, clean revocation, and an auditable trail that ties the blocked attempt to the subsequent response.

Practitioner takeaway: The most dangerous sign of failing containment is continued momentum after the first block, because a system that still permits retries and privilege growth has already lost the most important control, the ability to stop the agent decisively.