METHOD FOR ASSESSING THE SECURITY OF AGENTIC APPLICATIONS FOR CRITICAL INFRASTRUCTURE TASKS

Abstract

The article is devoted to the problem of assessing the security of applications that function with the involvement of artificial intelligence agents. AI agents operate on the basis of large language models and perform tasks in the area of event log analysis, processing of technical documentation of the facility, and analysis of data in databases of a critical infrastructure facility. Agents can also be involved in monitoring tasks and interactions with SOC/SIEM platforms. Among the differences that make agentic applications potentially dangerous is the ability to autonomously call external applications and perform other intelligent actions that expand the attack surface. The risks include privilege escalation, confidential data leakage, and execution of actions that were not initially provided for by the security policy. The aim of the study is to develop a method for assessing the security of agentic applications, which is oriented toward application in critical infrastructure tasks. The method is suitable for comparative analysis of different versions of large language models and configurations of agentic applications. The method includes work with a threat model, a catalogue of test scenarios, and the proposed system of quantitative metrics. The functional part of the method consists of a procedure for automated testing and the formation of recommendations regarding the policy of differentiating agents’ access to data and tools. The threat model concerns the levels of the large language model and external tools, and takes into account the following categories of the most typical attacks: 1) direct prompt injection, 2) indirect prompt injection through external data, 3) tool misuse, 4) confidential data leakage, 5) privilege escalation. The Attack Success Rate (ASR) is used as an indicator for quantitative assessment, and additionally, the indicators of tool misuse, data leakage, and privilege escalation are used. The operability of the proposed method is shown experimentally, in an isolated software environment implemented in Python using LangChain and Ollama. The agent was tested using tools that simulated reading, writing, execution of SQL queries, data search, and sending messages. The experiments were carried out for the Llama 3.1 8B, Ministral 3 8B, and Qwen 3 8B models using 50 test scenarios and tenfold repetition of each scenario; the total volume of the experiment amounted to 2,000 runs. It was established that the vulnerabilities of the models differ significantly, and the most dangerous direction for all investigated LLMs is confidential data leakage, with the value of the corresponding indicator ranging from 20% to 70%. The use of the “thinking” mode in Qwen 3 made it possible to reduce the overall attack success rate from 22% to 6.2%. However, the use of this mode does not completely eliminate the risks of data leakage and unauthorized privilege escalation. The results of the study provide grounds to formulate recommendations: to apply the principle of least privilege, where possible to use read-only mode, and to necessarily involve a human operator to confirm the execution of critical operations. The proposed method can be used for comparative assessment and preliminary testing of agentic applications that are used in information and analytical tasks of critical infrastructure.