{"resourceId":"arxiv-statefence-evidence-chain-contamination-blue-team-llm-agents-20261102","versions":[{"version":"external-542585a9d9ac74d0db95ac2e8fe8b88f0a584fe23642b5900e216cbc4378aa1c","resource":{"id":"arxiv-statefence-evidence-chain-contamination-blue-team-llm-agents-20261102","title":"Preprint: StateFence shows poisoned telemetry can corrupt SOC LLM agents' triage and response, and that task-aware defenses beat generic filtering","organization":"Haowen Dai and Alejandro Guerra-Manzanares, arXiv","sector":"SOC AI agents and prompt-injection defense research","geography":"Not location-specific (controlled and public SOC benchmarks)","publishedAt":"arXiv preprint 2611.02605v1, submitted Nov. 2, 2026","publicationDate":"2026-11-02","eventDate":null,"sourceName":"arXiv","sourceLabel":"StateFence: Task-State Protection Against Evidence-Chain Contamination in Blue-Team LLM Agents (Preprint, not peer reviewed)","sourceUrl":"https://arxiv.org/abs/2611.02605","evidenceClass":"academic-research","outcomeClass":"mixed","topics":["developers-agents","data-security","operating-model"],"finding":"Preprint, not peer reviewed. The authors show that malicious instructions embedded in telemetry, tickets, retrieval results or memory can propagate through SOC LLM agent tasks (alert triage, incident summaries, response recommendations, IOC extraction). On a controlled benchmark of 64 attacked cases per task-model setting across four models (Claude Opus 4.5, Gemini 3 Flash Preview, Grok 4 Fast, Qwen3-32B), undefended triage attack success exceeded 50% for the two weakest model conditions. Their task-aware defense cut Claude summarization attack success from 23.44% to 6.25%, and on a public SOC validation set reached 91.41% task success with 8.59% attack success. Generic filtering applied to IOC extraction removed real indicators (51-75% recall versus 93.75-98.44% with the task-aware route), and sanitization alone was counterproductive for triage. Authors note results come from fixed benchmarks and depend on model and schema.","sledRelevance":"Independent evidence relevant to agentic SOC products such as Cortex XSIAM and AgentiX that state SOCs, regional/joint SOCs and university security operations are adopting. Interpretation: logs and tickets that agents read are attacker-controllable, so agentic triage needs per-task safeguards; a generic prompt filter may strip the indicators analysts need. Transferability caveat: benchmark cases, not a live public-sector SOC, and Palo Alto products were not tested.","evidence":"Opened the arXiv abstract page (v1, submitted Nov. 2, 2026, DOI pending registration) and read the HTML full text, including datasets, target models, Tables 2-5 and the Limitations section.","architectureImplications":"Agent pipelines should tag evidence with source and trust tier, route defenses per task and keep deterministic post-processing for severity and response decisions.","governanceImplications":"Interpretation: high-risk response actions should require multiple cited sources or human approval when evidence is untrusted.","securityPrivacyImplications":"Telemetry and tickets become an injection channel; poisoned memory can persist across tasks.","caveats":"Preprint, not peer reviewed; controlled benchmarks; manually defined task mappings; results vary by model; no vendor SOC products evaluated; no public-sector sample.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: this preprint gives SOC leaders a concrete risk to raise when buying agentic triage: attackers can plant instructions in the logs the agent reads. It supports a conversation about testing, not a claim that any product is safe or unsafe. A bounded engagement could be a poisoned-telemetry red-team exercise on a pilot agentic SOC workflow. The paper did not test Palo Alto or any commercial SOC platform, so avoid implying it did.","engineering":"Engineering framing: the paper shows defenses must match the task. Generic sanitizers can delete real indicators during IOC extraction, while severity decisions need deterministic guards. Engineers evaluating Cortex agentic features should ask how ingested telemetry is separated from instructions, whether evidence carries source and trust metadata, and whether high-risk actions need multiple cited sources. A proof of value should replay seeded poisoned alerts and measure both attack success and lost indicators.","delivery":"Delivery framing: agentic SOC rollouts should include adversarial acceptance testing with poisoned logs, tickets and memory before agents influence triage or response. Delivery would build a small seeded test set from the entity's own telemetry formats, run it each release, and track attack success and indicator recall. Proposed acceptance criteria include a maximum tolerated attack success and no loss of seeded indicators. Risks include persistent memory poisoning and over-aggressive filtering hiding real threats."},"roleDetails":{"sales":{"customerProblem":"SOC teams adopting AI agents face attacker-controlled data inside the logs and tickets those agents read.","stakeholders":["SOC manager","CISO","Joint or regional SOC leads","Detection engineering team"],"discoveryQuestions":["Do agents read untrusted ticket text, email or web content?","Can agents trigger response actions without analyst approval?","Has the vendor tested indirect prompt injection through telemetry?","Do agents keep memory across incidents?"],"valueHypothesis":"Interpretation: adversarial testing before agent go-live may prevent poisoned evidence from downgrading real incidents.","potentialEngagement":"A poisoned-telemetry red-team exercise on one agentic triage workflow.","unsupportedClaims":["Effectiveness of any specific commercial product","Results on live public-sector SOC data","Peer-reviewed confirmation"]},"engineering":{"fit":"Relevant to any agentic SOC deployment, including Cortex XSIAM/AgentiX, but evidence is product-neutral.","architectureIntegration":"Evidence provenance tagging, per-task defense routing and deterministic post-processing around a single model call.","prerequisites":["Structured agent outputs","Evidence source metadata","Seeded test cases in local log formats"],"constraints":["Benchmark-only results","Model-dependent operating points","Manual task mappings"],"security":"Injection through telemetry, tickets, retrieval and memory; filtering can remove true indicators.","proofOfValue":["Replay seeded poisoned alerts and measure attack success","Measure IOC recall with and without filtering","Test persistence of poisoned memory across incidents"]},"delivery":{"work":"Build a seeded poisoned-evidence test suite and run it before go-live and after each agent update.","dependencies":["Agent platform test hooks","Detection engineering capacity","Representative telemetry samples"],"ownership":"The SOC manager owns agent acceptance testing; detection engineering maintains the test suite.","skillsAdoption":"Analysts need training to check agent-cited evidence and recognize injection.","governanceCheckpoints":["Red-team results reviewed before agents act on triage","Human approval required for containment actions","Re-test after model or prompt changes"],"acceptanceCriteria":["Proposed: attack success below an agreed threshold on seeded cases","Proposed: no seeded IOC lost to filtering","Proposed: all high-risk actions cite at least two sources"],"risks":["Severity downgrades from poisoned evidence","Persistent memory contamination","Over-filtering hiding true indicators"]}},"retrievedAt":"2026-11-05T04:08:52Z","enrichedAt":"2026-11-05T04:11:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Analysts must review agent-cited evidence, not just verdicts; training on injection indicators is needed.","procurementImplications":"Buyers of agentic SOC tools can ask vendors how they defend against indirect prompt injection in ingested telemetry, with test results.","operatingModelImplications":"SOCs should red-team their agents with poisoned logs as part of acceptance and periodic testing.","sourceVerification":{"openedUrl":"https://arxiv.org/abs/2611.02605","referenceExcerpt":"a suspicious string may be malicious control text for summarization but essential evidence for IOC extraction.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}