Sequential Agent Architecture

Overview

A sequential agent architecture represents the most straightforward pattern, where a single agent processes tasks through a linear workflow. This design typically uses a single KC1.1 (Large Language Model) as its cognitive core, guided by a KC2.1 (Sequential workflow) and KC3.3 (Chain of Thought) reasoning. Its memory is usually a volatile KC4.1 (In-agent session memory), and its interaction with the outside world is through limited capabilities like KC6.1.1 (Limited API access).

Key components

• KC1.1 Large Language Models (LLMs)
• KC2.1 Workflows
• KC3.3 Chain of Thought (CoT)
• KC4.1 In-agent session memory
• KC5.1 Flexible Libraries / SDK Features
• KC6.1.1 Limited API Access

Threats this pattern exposes

T6 (Intent Breaking) & T15 (Human Manipulation)

The primary attack vector is manipulating the agent's core KC1 (LLM) through prompt injection. An attacker can craft inputs to bypass safety instructions, break the intended goal, or trick the agent into performing unintended actions.

T2 (Tool Misuse)

Even with limited API access (KC6.1.1), an attacker can exploit this capability. For example, a deceptive prompt could cause the agent to generate malicious parameters for a legitimate API call, leading to parameter pollution or unauthorized operations within the API's allowed scope.

T1 (Memory Poisoning)

While the KC4.1 memory is session-specific, it can still be poisoned by malicious input. This can corrupt the agent's immediate context, causing it to generate flawed or harmful outputs for the duration of the session.

T11 (Unexpected RCE)

If the agent is granted KC6.2 (Code Execution) capabilities, even in a limited form, it creates a direct risk of remote code execution if an attacker can successfully inject malicious code for the agent to run.

Mapped threats: T1 Memory Poisoning, T2 Tool Misuse, T6 Intent Breaking & Goal Manipulation, T11 Unexpected RCE and Code Attacks, T15 Human Manipulation.

Recommended controls

• M1 Memory Validation & Sanitization

  Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.

• M4 Prompt Hardening & Jailbreak Prevention

  Implement multiple layers of prompt security including structural defenses, behavioral constraints, runtime detection, and advanced techniques to prevent prompt injection, model manipulation, and jailbreaking attempts.

• M5 Multi-Stage Reasoning Validation

  Implement comprehensive validation of agent reasoning processes using multiple checkpoints, external validators, consistency checks, and fact verification to ensure goal alignment, prevent manipulation, and detect hallucinations.

• M6 Comprehensive Security Monitoring & Auditing

  Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.

• M11 Content Security & Output Filtering

  Implement comprehensive filtering and validation of agent outputs to prevent harmful content generation, data leakage, manipulation attempts, and ensure compliance with security policies and regulatory requirements.

• M12 Secure Model Training & Validation

  Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

Attack walkthroughs

• T6 (Intent Breaking) & T15 (Human Manipulation) in Sequential: The primary attack vector is manipulating the agent's core KC1 (LLM) through prompt injection.
• T2 (Tool Misuse) in Sequential: Even with limited API access (KC6.1.1), an attacker can exploit this capability.
• T1 (Memory Poisoning) in Sequential: While the KC4.1 memory is session-specific, it can still be poisoned by malicious input.
• T11 (Unexpected RCE) in Sequential: If the agent is granted KC6.2 (Code Execution) capabilities, even in a limited form, it creates a direct risk of remote code execution if an attacker can successfully inject malicious code for the agent to run.
• Autonomous data exfiltration after indirect prompt injection: After encountering a poisoned web instruction, the agent continues independently scanning and transmitting sensitive files even after the malicious source is removed.

References

• OWASP Agentic AI Threats
• LangChain Agent Architectures