Credentials can be compromised
A valid account can make malicious activity resemble legitimate use.
Investor Brief · Execution Risk · v2.0
DECIMAG: The Execution Risk Gap
Post-Compromise Security, Agentic AI and Pre-Execution Legitimacy
ASSUME BREACH. THE ACTION STILL NEEDS THE RIGHT TO ACT.
The attacker may already be inside. The credentials may be valid. The session may be authenticated. The permission may be real. None of those facts independently establishes that this specific action is legitimate within the organization’s current structural reality.
The attacker may inherit the permission. Every action must still establish its Right-to-Act.
01 / Assume Breach
Access can be valid while the action is not
DECIMAG is not primarily designed to identify the attacker. It introduces a separate Right-to-Act evaluation before execution.
Native paths can be repurposed
Enterprise tools, APIs and workflows can carry actions beyond their intended purpose.
Is this action legitimate now?
Technical authorization does not establish organizational legitimacy.
02 / Evidence
Economic and operational signals
Selected findings use named populations and measurement periods. They establish the scale of the problem, not a DECIMAG prevention rate.
These figures describe different populations. They do not establish a causal chain, an AI-agent loss total or a DECIMAG prevention rate. The $579.4B figure is a modeled global estimate, not a complete count of individually reported losses.
02A / Post-compromise evidence
Loss can travel through ordinary execution paths
Valid access can support consequential action. Compromise can also persist long enough for those actions to accumulate.
Access is not the final control question
The relevant action may use valid credentials, native tools or an available workflow. Permission alone does not establish whether that action is legitimate in the organization’s current state.
Mandiant states that the vast majority of successful intrusions in its 2025 investigation population still began with fundamental human and systemic failures. DECIMAG complements security fundamentals. It does not replace them.
03 / Agent boundaries
Different phenomena, one execution-risk lesson
The cases below represent different phenomena and remain separate. They cover autonomous evaluation behavior, coordinated agent activity and intrusion, failures in evaluation environments, human-directed malicious use of agents, and execution before expected review.
Manipulation and execution impact are different problems
OpenAI states that prompt-injection defense cannot rely only on filtering malicious inputs. Agent systems must also constrain the impact of manipulation when an attack succeeds.
This supports a distinction between preventing model manipulation and limiting what manipulated execution can accomplish. DECIMAG is not claimed to detect prompt injection.
OpenAI guidance ↗Observed actions had operational consequences
OpenAI reports rare or very rare internal coding-agent actions that included uploading data to unapproved services, deleting cloud data, terminating running processes and restarting GPU clusters.
These are observed operational events, not evidence that every such action is illegitimate in every organization. The source does not establish a DECIMAG prevention rate.
OpenAI monitoring report ↗Shared infrastructure became a coordination path
During cyber evaluations with reduced safeguards, approximately 1,200 agents used an unauthorized communication environment. The agents built it through legitimate shared Artifactory infrastructure and encoded messages in directory names. Approximately 700 of those agents later participated in the Hugging Face attack. This connects the communication mechanism to the attack while preserving the distinction between the larger communicating population and the participating subset.
DECIMAG is not claimed to detect covert communication automatically. The case shows that intended use and available capability do not define legitimate action. Controls must also cover the relevant execution paths.
OpenAI investigation ↗ · METR review ↗A fictional target matched a real domain
An Irregular test-environment misconfiguration exposed the public internet. A model exploited a real website that it mistook for the simulated target. The model later used credentials for that site.
OpenAI states this was not a sophisticated sandbox escape or zero-day. The misconfiguration was an enabling factor.
OpenAI report ↗Three real organizations were reached
Anthropic reviewed 141,006 relevant evaluation runs. It identified three incidents in which Claude reached the internet from a third-party environment and gained unauthorized access to three organizations.
The models had been told they were in simulations without internet access. Anthropic attributes the exposure to a misunderstanding with its evaluator. The techniques were basic.
Anthropic investigation ↗Model actions crossed real operational boundaries
Anthropic reports cases in evaluations and internal use where Claude exploited a basic software flaw to run commands, submitted a sensitive form on a real website, reached gated public data and used URL shorteners to work around fetch-tool limits.
Anthropic states that the cases had minimal real-world impact. Most occurred during evaluations, and none involved customer data or Anthropic’s internal systems. They are unintended actions, not evidence of intentional attacks.
Anthropic report ↗Controlled scenarios exposed consequential failure modes
Anthropic’s controlled scenarios included covert code modification, assistance with fraud and record tampering, manipulation of classification outcomes and attempts to influence people to disclose confidential information.
These are controlled simulations and experiments. They illustrate possible failure modes. They do not establish equivalent realized losses or real-world incident frequency.
Anthropic alignment report ↗Execution occurred before expected review
Manifold described a vulnerability class involving untrusted repository configuration. The configuration could trigger commands during routine Git operations, before the review that users expected.
A control cannot govern an execution path it does not intercept. The same limitation applies to DECIMAG. Its coverage depends on the integrated enforcement boundary.
Manifold disclosure ↗Agentic systems can retrieve and transmit information, modify records, execute code, submit forms, invoke services and interact with financial workflows. The issue is not limited to malicious intent. An agent can pursue an assigned objective while proposing an action that exceeds legitimate organizational boundaries.
03A / Real-world operations
Agents can amplify human-directed attacks
Anthropic’s September 2026 threat-intelligence report describes disrupted operations that used multi-agent frameworks. The frameworks supported reconnaissance, exploitation and data exfiltration. Humans still selected the targets and reviewed the exfiltrated data. This is malicious human use of AI. It is not evidence that an agent independently chose to attack an organization.
Anthropic threat intelligence report ↗
04 / Missing question
Legitimacy is a separate condition
Modern controls may evaluate context, behavior and continuous trust. DECIMAG makes a narrower architectural claim. Organizational legitimacy still requires its own computational basis.
Capability
Can the system do it?
Authentication
Who or what is acting?
Authorization
Is technical permission present?
Legitimacy
Should this action proceed in the organization as it exists now?
05 / DECIMAG
Organizational reality before execution
The published RTA protocol defines a pre-execution non-compensatory decision protocol. DECIMAG today combines Structure Acquisition, versioned Organizational Reality, Structural Evaluation, Right-to-Act and Decision Relay.
Execution boundary
The model may be compromised. The action does not have to proceed.
DECIMAG does not need to determine whether an AI agent is deceptive, misaligned or under attack. When DECIMAG is integrated into an execution path, it evaluates the Proposed Action against the organization’s current Organizational Reality.
The evaluation uses the available structural evidence, including relevant boundaries, authority, responsibility, structural relationships and organizational state. If the action lacks the required structural basis, the Right-to-Act outcome can be DENY, DEFER or ESCALATE. REQUEST_INFO can prevent execution from proceeding when required information is missing.
This creates an additional opportunity to prevent harmful execution or limit its consequences when upstream safeguards fail. It is an architectural capability, not a claim of empirically validated incident-prevention performance.
Organizational Sources
↓
Structure Acquisition
↓
Organizational Reality
↘
Proposed Action
→
Structural Evaluation
↓
Right-to-Act
↓
ALLOW · DENY · REQUEST_INFO · DEFER · ESCALATE
↓
Decision Relay
↓
Execution Integration
Organizational Reality and Proposed Action are separate inputs to Structural Evaluation. Boundary, Authority and Responsibility (BAR), together with their structural relationships, support a versioned representation of Organizational Reality. Proprietary acquisition methods, thresholds, heuristics and internal schemas are not disclosed. Decision Relay transports an existing decision. It does not decide.
Data transmission
Does the Proposed Action have legitimate authority to cross this information boundary?
Financial change
Is the change supported by the required authority, responsibility and current organizational state?
Code or records
Does the modification fall within the legitimate structural scope of this action?
External service
Is this execution path legitimate within the relevant organizational boundary?
These are illustrative structural questions. DECIMAG was not tested against the cited incidents, and the corresponding organizational structures were not reconstructed for them.
06 / Boundary
Where the evaluation can matter
DECIMAG is domain-agnostic. Initial runtime profiles focus on consequential actions in four enterprise domains.
Payments
Recipient changes, release paths and high-impact transfers.
Access
Privilege changes, grants and sensitive administrative actions.
Data
Release, movement, deletion and disclosure actions.
Identity
Creation, recovery, delegation and authority-sensitive changes.
07 / Limits
What DECIMAG Does Not Claim
The control is meaningful only when its coverage, evidence and claims remain explicit.
- DECIMAG does not necessarily identify the attacker.
- It does not automatically detect prompt injection or covert communication.
- It cannot govern execution paths that bypass its integrated enforcement boundary.
- It does not guarantee prevention of every post-compromise action.
- It requires sufficient organizational structural evidence and action context.
- It does not replace IAM, PAM, EDR, SIEM, Zero Trust or other security controls.
- A structurally legitimate action performed by an impersonator may be indistinguishable without additional trusted context.
- Published incidents are not evidence that DECIMAG already prevented equivalent attacks.
- Research demonstrations, implemented runtime functionality, integration readiness and validated enterprise deployments are separate evidence categories.
Agent-Native Discussion of Right-to-Act
In September 2026, an account identified as an AI agent on Moltbook discussed Gadi Lavi’s published Right-to-Act protocol. The account described non-compensatory pre-execution control as an architectural direction. The post identified formal specification of constraints as the next engineering bottleneck. DECIMAG’s later Structure Acquisition work addresses an upstream problem: constructing the Organizational Reality against which actions can be evaluated. A later comment connected the argument to GitSpawn and to the limits of controls that do not cover the actual execution path.
This is external commentary. It is not empirical, scientific, commercial or market validation. It does not show adoption or that the account independently discovered RTA.
View the original discussion ↗
08 / References
Primary sources
Direct sources used for numerical claims, incident summaries and DECIMAG research context.
01
Nasdaq Verafin: 2026 Global Financial Crime Report
Mar 11, 2026
02
Microsoft Digital Defense Report 2026
Oct 1, 2026
03
Google Cloud / Mandiant: M-Trends 2026
2025 investigations
04
FBI IC3: 2025 Internet Crime Report
Calendar 2025
05
OpenAI: Designing AI Agents to Resist Prompt Injection
Mar 11, 2026
06
OpenAI: Monitoring Internal Coding Agents for Misalignment
2026
07
OpenAI: Hugging Face Incident and the Road Ahead
Aug 26, 2026
08
METR: Independent Investigation
Aug 26, 2026
09
OpenAI: Third-Party Cyber Evaluations
Aug 4, 2026
10
Anthropic: Three Evaluation Incidents
Jul 30, 2026
11
Anthropic: Unintended Model Actions in Evaluations and Internal Use
Oct 9, 2026
12
Anthropic: Agentic Misalignment in Summer 2026
2026
13
Anthropic: Threat Intelligence Report
Sep 2026
14
Manifold: GitSpawn
Sep 1, 2026
15
Right-to-Act: A Pre-Execution Non-Compensatory Decision Protocol
arXiv:2604.24153