> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Chains

> Common AI agent attack chains and how Hexr's defense-in-depth architecture breaks each one.

## Attack Chain 1: Credential Theft

**Traditional:** Agent stores API keys → compromised agent exfiltrates keys → attacker uses keys forever

**Hexr breaks this at:**

1. ✅ **No stored keys** — agents never have cloud credentials, only SPIFFE SVIDs
2. ✅ **Short-lived tokens** — even if intercepted, STS tokens expire in 15 minutes
3. ✅ **Per-process scope** — a compromised researcher can't use writer credentials
4. ✅ **Audit trail** — every credential exchange is traced

***

## Attack Chain 2: Prompt Injection → Lateral Movement

**Traditional:** Malicious prompt → agent executes unintended tool call → accesses other services → data exfiltration

**Hexr breaks this at:**

1. ✅ **LLM Guard** blocks injection attempts before they reach the LLM
2. ✅ **OPA policies** restrict which tools a specific role can access
3. ✅ **Credential scoping** — even if a tool call succeeds, it only has role-specific permissions
4. ✅ **Namespace isolation** — agents in one tenant can't reach another tenant's services

***

## Attack Chain 3: Supply Chain Compromise

**Traditional:** Malicious PyPI package → installed in agent → exfiltrates secrets at runtime

**Hexr breaks this at:**

1. ✅ **`hexr audit`** scans dependencies for known vulnerabilities
2. ✅ **SBOM generation** tracks every component
3. ✅ **Vault isolation** — secrets are SPIFFE-scoped, not in environment variables
4. ✅ **Network policies** — Envoy proxy + OPA restrict outbound traffic

***

## Attack Chain 4: Agent-to-Agent Exploitation

**Traditional:** Compromised agent A sends malicious tasks to agent B → B escalates privileges

**Hexr breaks this at:**

1. ✅ **mTLS** — all A2A communication is SPIFFE-authenticated
2. ✅ **OPA A2A policies** — only authorized agent pairs can communicate
3. ✅ **Per-process identity** — agent B validates A's exact SPIFFE ID
4. ✅ **Task validation** — A2A sidecar validates request format before delivery

***

## Summary

| Attack Vector          | # of Hexr Barriers                           |
| ---------------------- | -------------------------------------------- |
| Credential theft       | 4 layers                                     |
| Prompt injection       | 4 layers                                     |
| Supply chain           | 4 layers                                     |
| Agent-to-agent exploit | 4 layers                                     |
| Data exfiltration      | 3 layers (OPA + Envoy + audit)               |
| Model abuse            | 3 layers (rate limits + OPA + cost tracking) |