Skip to main content

​
Attack Chain 1: Credential Theft

Traditional: Agent stores API keys → compromised agent exfiltrates keys → attacker uses keys forever Hexr breaks this at:
  1. ✅ No stored keys — agents never have cloud credentials, only SPIFFE SVIDs
  2. ✅ Short-lived tokens — even if intercepted, STS tokens expire in 15 minutes
  3. ✅ Per-process scope — a compromised researcher can’t use writer credentials
  4. ✅ Audit trail — every credential exchange is traced

​
Attack Chain 2: Prompt Injection → Lateral Movement

Traditional: Malicious prompt → agent executes unintended tool call → accesses other services → data exfiltration Hexr breaks this at:
  1. ✅ LLM Guard blocks injection attempts before they reach the LLM
  2. ✅ OPA policies restrict which tools a specific role can access
  3. ✅ Credential scoping — even if a tool call succeeds, it only has role-specific permissions
  4. ✅ Namespace isolation — agents in one tenant can’t reach another tenant’s services

​
Attack Chain 3: Supply Chain Compromise

Traditional: Malicious PyPI package → installed in agent → exfiltrates secrets at runtime Hexr breaks this at:
  1. ✅ hexr audit scans dependencies for known vulnerabilities
  2. ✅ SBOM generation tracks every component
  3. ✅ Vault isolation — secrets are SPIFFE-scoped, not in environment variables
  4. ✅ Network policies — Envoy proxy + OPA restrict outbound traffic

​
Attack Chain 4: Agent-to-Agent Exploitation

Traditional: Compromised agent A sends malicious tasks to agent B → B escalates privileges Hexr breaks this at:
  1. ✅ mTLS — all A2A communication is SPIFFE-authenticated
  2. ✅ OPA A2A policies — only authorized agent pairs can communicate
  3. ✅ Per-process identity — agent B validates A’s exact SPIFFE ID
  4. ✅ Task validation — A2A sidecar validates request format before delivery

​
Summary