From Rogue Employees to Rogue Agents

Research presentation title slide — Your AI Safety System Has a 20-Year-Old Blind Spot

The Question

Most people assume insider threat detection and AI agent monitoring are separate disciplines. I wasn't sure they were. Both profile a baseline of "normal" behavior. Both flag deviations from that baseline. Both encode assumptions about trust, authority, and what counts as legitimate action. The detection systems are structurally identical. The governance questions they raise are the same. So I tested it. I took three anomaly detection models from my MSc thesis (Isolation Forest, LSTM Autoencoder, Deep Clustering, validated on the CMU-CERT insider threat dataset, best AUC-ROC 0.799) and applied them to AI agent execution traces through a unified feature schema. Then I mapped the detections to the OWASP Top 10 for Agentic Applications. The models transfer. Not all of them, and not equally. That's the interesting part.

The Bridge: UBFS

The core contribution is the Unified Behavioural Feature Schema: a 20-dimensional feature space that maps both insider threat indicators and agent trace signals into the same representation. Seven categories: temporal patterns, frequency, volume, scope, sequence entropy, peer deviation, and privilege level. Both feature extractors output vectors in this space. The anomaly detection models operate on those vectors without knowing which domain they came from. The lossy compression costs something. CMU-CERT through the UBFS achieves 0.731 AUC-ROC (Isolation Forest), down from 0.799 with the thesis's full 24-feature pipeline. You trade detection fidelity for cross-domain portability. That trade is worth making if the portability works.

The Transfer

It works. An Isolation Forest trained entirely on insider threat data (329,000 employee user-days from CMU-CERT) achieves 0.711 AUC-ROC on agent execution traces. A drop of only 0.019 from its within-domain performance. The UBFS bridge retains 97% of detection power across the domain boundary. The unexpected result: training Deep Clustering on 517 reward-hacking trajectories produces a model that outperforms within-domain training on insider detection by +0.223 AUC-ROC. More training data from any domain helps, even across the insider/agent boundary. Not everything transfers. Reward hacking (TRACE dataset) sits at random chance regardless of training domain. It's structurally identical to normal behavior. The deviation is semantic, not behavioral. Anomaly detection catches structural deviations, not clever ones.

I trained a detector on employee behavior. Then I showed it AI agent behavior. It recognized suspicious agents almost as well as suspicious employees, because the structural shape of "something is wrong here" looks the same in both domains. A 3% drop in detection power across a complete domain switch is noise. The signal transfers.

But so do the blind spots. An employee who uses their real credentials for the wrong purpose looks identical to one doing their job. An AI agent that calls the right tool with the right syntax but escalated privileges looks identical to one operating normally. This isn't a bug in the model. It's a fundamental limit of behavioral monitoring, and it's the exact gap that the most sophisticated attackers, human or artificial, exploit.

The Blind Spots

I mapped detections to the OWASP Top 10 for Agentic Applications. Memory Poisoning (ASI05) is highly detectable at 0.944–0.969 AUC-ROC. Excessive Agency (ASI09) is catchable at 0.824–0.844. Tool Misuse (ASI02) is a blind spot: 0.57–0.59 AUC-ROC. Both models fail because tool misuse changes parameters without changing structural patterns. The tool is called correctly, with correct sequencing. It just uses escalated privileges. This is the AI equivalent of an employee using their legitimate access to do something illegitimate. This has direct governance implications: any monitoring system built purely on behavioral patterns will miss the most sophisticated attacks. The security field learned this decades ago. The AI governance field is about to learn it again.

The Governance Audit

Every anomaly detection system encodes assumptions about what "normal" means. I audited six assumptions embedded in the UBFS: After-hours activity is treated as suspicious, but that penalizes shift workers and scheduled agents equally. Broad resource access is flagged, but that penalizes cross-functional employees and multi-tool agents who are doing their jobs. High entropy in action sequences is anomalous, but that penalizes creative and exploratory behavior while rewarding routine.

Who decides what "normal" means, and what does that decision exclude? This is not a technical question. It's a governance question that masquerades as a technical one.

Why This Matters

The AI governance field is building agent monitoring from scratch. The security field has been building behavioral monitoring for decades. The structural analogy between "rogue employee" and "rogue agent" isn't a metaphor. It's an architectural identity. Same models. Same features. Same blind spots. Here's what that means concretely: every lesson the security industry learned the hard way over the past 20 years (that behavioral patterns catch structural deviations but miss semantic ones, that normality assumptions encode biases, that the most dangerous actors operate within legitimate boundaries) applies directly to AI agent monitoring. We don't have to rediscover these lessons. We just have to transfer them. This project demonstrates that the transfer works, and shows exactly where it breaks down.

Extension: Anthropic Incidents and Experiments 5-8

In February 2026, Anthropic disclosed two incidents that validated the pipeline's findings: a state-sponsored espionage campaign exploiting the ASI02 tool misuse blind spot, and a distillation attack from three Chinese AI labs using "hydra cluster" architectures. I ran four new experiments.

Experiment 5: Distillation Detection Spectrum

I modeled each lab's extraction strategy as a separate distillation profile. Results confirm a detection spectrum:

Focused extraction (MiniMax pattern): 0.999 AUC-ROC. Trivially detectable via frequency spike.
Multi-capability probing (Moonshot pattern): 0.913 AUC-ROC. Clear scope anomaly.
Chain-of-thought elicitation (DeepSeek pattern): 0.909 AUC-ROC. Sequence anomaly.
Hydra-distributed (per-account after 20K-account split): 0.538 AUC-ROC. Blind spot.

The hydra result confirms a second structural limitation: behavioral monitoring designed for single entities can't detect coordinated attacks where each account's behavior is individually normal. Two blind spots: intent-based (ASI02, 0.50) and coordination-based (HYDRA, 0.538).

Experiment 6: Decomposition Detection (Boiling Frog)

Using the AgentHarm dataset (UK AISI), I compared detection of direct malicious requests vs. the same attacks decomposed into innocent subtasks. Decomposition drops detection by 5-6% (IF: 0.774→0.723; DC: 0.774→0.710). The boiling frog evasion pattern (gradual escalation defeating anomaly detection) transfers from insider threat to AI agent domain.

Experiment 7: MCP Transfer

The pipeline generalizes beyond the original datasets. TRAIL-to-ATBench transfer achieves 0.878 AUC-ROC, actually exceeding ATBench's own within-domain baseline (0.838). The UBFS bridge now spans three domains: human insiders (CMU-CERT), general agent traces (TRAIL/TRACE), and MCP-specific tool traces (ATBench).

Experiment 8: Hybrid Detection (UBFS-20 vs UBFS-28)

I added 8 semantic features using sentence-transformer embeddings: parameter meaning, intent consistency, goal drift, context-action coherence. The extended UBFS-28 dramatically improves detection for most categories:

Goal Hijacking (ASI01): 0.627 → 0.935 (+0.308)
Rogue Agents (ASI10): 0.670 → 0.939 (+0.269)
Excessive Agency (ASI09): 0.813 → 0.951 (+0.138)
Tool Misuse (ASI02): 0.537 → 0.559 (+0.023). Essentially unchanged.

Even semantic features can't close the ASI02 blind spot. This is the clearest evidence that tool misuse is a paradigm limitation, not a feature engineering problem.

Experiments 9-11: Stress-Testing the Framework

Experiment 9 (Adversarial Evasion): I tested three attack strategies against the monitoring system: feature clamping (cap anomalous features at normal thresholds), gradual escalation (slowly ramp from normal to malicious), and mimicry (copy a normal profile except the attack payload). Mimicry degrades Memory Poisoning (ASI05) detection by 25%. But ASI02 is immune to all three strategies, because there's nothing to evade. You can't degrade what's already at chance. The uncomfortable finding: gradual escalation reveals that monitoring is binary, not gradual. Either the anomaly is large enough to detect, or it's invisible. There is no early warning for subtle attacks. Experiment 10 (Temporal Windows): How much data does a detector need? Ten spans is the saturation point for Isolation Forest on both TRAIL and ATBench. More data adds noise, not signal. This parallels the thesis finding that 7-day windows outperform 30-day windows for insider detection. Simpler models extract sufficient signal from early observations. Experiment 11 (MITRE ATLAS Mapping): I mapped five ATLAS adversarial ML techniques to UBFS profiles. All five are strongly detectable: IF and LSTM achieve >0.93 AUC-ROC across the board. ATLAS techniques (model replication, extraction, adversarial crafting) have strong volume and frequency signatures. No new blind spots beyond ASI02.

Experiments 12-13: The Plot Twist

Experiment 12 (Real-Data OWASP Validation): This one changed the story. I ran all three models on 500 real ATBench trajectories per OWASP category instead of synthetic injections. The ASI02 blind spot is a synthetic methodology artifact. On real data, ASI02 achieves 0.86-0.94 AUC-ROC across all models. Compare that to 0.51-0.52 on synthetic data. The synthetic methodology was circular: I defined perturbation profiles that modified only the privilege dimension, then tested whether models could detect those modifications. Real-world tool misuse produces structurally visible anomalies (unusual parameter combinations, atypical sequences) that circular synthetic profiles can't capture. UBFS-28 improves all categories by 5-13% on real data. Spearman rank correlation between synthetic and real detection rankings is 0.20. Synthetic profiling is a useful lower bound but poor absolute calibration.

I spent months treating ASI02 as a fundamental limitation of behavioral monitoring. It's not. It's a limitation of testing behavioral monitoring with synthetic data you designed yourself. The real limitation is subtler: some attacks will always fall below any monitoring threshold, but tool misuse isn't one of them.

Experiment 13 (Distillation Sensitivity): I scaled distillation attack intensity in feature space at 0.25x, 0.5x, 1.0x, and 2.0x. FOCUSED, BROAD, and COT degrade monotonically as expected. FOCUSED remains highly detectable even at quarter intensity (0.959 AUC-ROC). HYDRA shows non-monotonic behavior. At 1.0x (original profile), it's near chance (0.52). At 0.25x (even closer to normal), detection paradoxically improves to 0.68 because the samples cluster tightly around the centroid, creating an unusual density. At 2.0x, HYDRA overshoots normal bounds entirely (0.85). The practical implication: 1.0x is HYDRA's optimal evasion point. The attackers, by accident or design, chose the profile that maximally defeats single-entity monitoring.

What Comes Next

A workshop paper (likely IEEE S&P AI Security or NeurIPS Red Teaming) covering the full pipeline: thirteen experiments spanning cross-domain transfer, OWASP detection, adversarial evasion, real-data validation, and the synthetic methodology critique. The narrative shifted during the work. I started with "behavioral monitoring has two structural blind spots." I ended with "one blind spot was real, and the other was an artifact of how we test." The paper is published as a preprint (DOI: 10.5281/zenodo.18797847). The code, all thirteen experiments, and governance report are public. Built on top of the insider threat detection thesis. I also built a 31-slide interactive presentation that walks through the full pipeline: from the CMU-CERT dataset through the UBFS bridge, cross-domain transfer results, OWASP mapping, and the synthetic-vs-real methodology critique. Built with React and Vite, with custom data visualizations for the ROC curves, domain bridge diagrams, and detection spectra. The deck is designed for conference talks and the video explainer I'm producing for the research.