ADVERSARIAL RESILIENCE OF AGENTIC INFRASTRUCTURE-AS-CODE SYSTEMS: THREAT MODEL, ATTACK TAXONOMY, AND MULTI-LAYERED DEFENSE ARCHITECTURE

Abstract

The integration of large language models (LLMs) and agentic components into Infrastructure as Code (IaC) workflows significantly expands the attack surface of cloud automation environments. This paper proposes a threat model for agentic IaC systems in the form of the structure S_IaC = (Agents, Environment, Configurations, Outcomes), which makes it possible to identify the critical points of influence: agent input data, configuration state, agent intents and goals, inter-agent communication channels, the execution process, authorization mechanisms, and system availability. Based on this model, a taxonomy of 40 attack vectors grouped into 7 categories is developed: prompt injection, configuration state poisoning, agent intent manipulation, attacks on inter-agent communication, exploitation of execution failures, attacks on authorization and access control, and attacks on integrity and availability. A multi-layered (compositional) defense architecture is proposed that combines input validation, agent intent verification, coordination and consensus mechanisms, and self-healing capabilities. The research methodology comprises three stages: threat modeling based on literature synthesis and a preliminary expert review (a formal Delphi study with an external panel is left to future work); design of the compositional defense architecture; and empirical validation in a reproducible software package on 2,157 scenarios — 1,441 synthetic domain-specific scenarios covering all 7 taxonomy categories (each represented by more than 100 scenarios) and 716 scenarios from public datasets (deepset/prompt-injections and labelled Terraform fixtures from the KICS project, both Apache-2.0) — under 1-, 3-, and 5-agent cluster configurations. The defense mechanisms are implemented as deterministic checks (rules, policies, cryptographic integrity), ensuring full reproducibility. The aggregate detection rate on the synthetic scenarios is 79.9% (95% CI 77.3–82.3%) with a false positive rate of 0.7%; effectiveness differs across categories, with the lowest results for agent intent manipulation (A3, 64.7%) and inter-agent communication (M4, 66.7%). On an independent real-world injection set (deepset) the domain-tuned rules detect only 14.4% of attacks, and non-English injections are not detected at all, which demonstrates the limited cross-domain transferability of static rules. Conversely, in a live LLM-agent loop (AgentDojo) on a domain-specific IaC benchmark the defense reduces the attack success rate from 50.0% to 16.7% and raises utility under attack from 66.7% to 91.7%, confirming its effectiveness within the target domain. All 40 attack vectors are additionally mapped to the MITRE ATT&CK, MITRE ATLAS, CWE, CVSS 4.0, NIST CSF 2.0, and OWASP frameworks; ATT&CK and ATLAS prove complementary (92.5% combined coverage), as the LLM-agent-specific vectors are covered by ATLAS. We formally prove composition properties (detection monotonicity, a union bound on false positives) and consensus correctness restoration under up to f < n/2 compromised agents. Future work includes a fully machine-checked verification of these properties and expansion of the attack scenario set.