Agent Security: Methodology & Sources

This simulation is grounded in "AI Agent Traps" by Matthew Franklin, Nemanja Tomasev, Joshua Jacobs, Joel Z. Leibo, and Simon Osindero, published by Google DeepMind in 2025.[1] The paper introduces the concept of an Agent Trap — adversarial content engineered into web pages or digital resources to misdirect or exploit an interacting AI agent. Unlike traditional adversarial attacks that target the model during training, agent traps target the agent at inference time by manipulating the information environment the agent operates in.

The paper organises traps into six categories, each targeting a different stage of the agent's operational cycle: perception, reasoning, memory, action, multi-agent dynamics, and human oversight. This simulation demonstrates five of the six categories through a single procurement scenario. The sixth — Systemic Traps — is reserved for a dedicated second experiment because it requires a fundamentally different architecture: multiple independent agents sharing an environment rather than a single agent pipeline.

The simulation is an original work that applies the paper's framework to a fictional scenario with fictional vendors. All statistics cited in the simulation are drawn from the paper's evidence base and its referenced publications. The paper is the structural blueprint — not background reading.

The procurement scenario was chosen because it is the simplest context that exercises all five demonstrated trap categories. A single agent pipeline — task receipt, research planning, source discovery, content ingestion, reasoning, recommendation writing, and human review — maps directly to the paper's operational cycle (perception → reasoning → memory → action → human oversight). Each stage of the pipeline becomes a stage where a specific trap category can activate.

The three-act structure (Trust → Corruption → Consequence) is designed to make the paper's taxonomy experiential rather than taxonomic. Act I establishes what "normal" looks like — clean sources, accurate parsing, reliable reasoning. Act II introduces traps in the order the paper presents them, so the viewer experiences cumulative contamination rather than isolated examples. Act III shows the consequences: a compromised recommendation, a human approval, and then the forensic reveal that traces the full contamination chain.

All vendors, company names, and scenario details are fictional. The attack mechanisms, success rates, and defence frameworks are drawn directly from the paper and its cited research. Where the simulation extrapolates beyond the paper's explicit claims, the evidence panel flags this distinction.

This is not a live penetration test. No actual agents are browsing the web during the simulation. The scenario is a structured walkthrough that demonstrates the paper's mechanisms through a fictional procurement narrative. The attack success rates are drawn from the paper's cited research — they are not measured during the simulation itself.

This is not a comprehensive security audit framework. The paper identifies six trap categories; this simulation demonstrates five. The sixth — Systemic Traps targeting multi-agent dynamics — is reserved for a dedicated second experiment. The defence framework in Step 16 is illustrative, not prescriptive. Organisations deploying agents should consult the full paper and engage specialised security teams.

This is not a criticism of any specific AI system. The paper's findings apply broadly to the architecture of agentic AI — any system that autonomously consumes web content is potentially vulnerable to the mechanisms described. The simulation uses fictional vendors to avoid implying that any real product is specifically vulnerable.