Secure the agent, not just the model.
AI agents turn model outputs into persistent actions. This research maps where enterprise agent stacks break, the controls that close those gaps, and measured security results for Pokee-Isaac 28B v0.1 (preview).
Christopher Wu, Zhaorun Chen, Michael Cai, Bo Li, Zheqing Zhu
Benchmark
DecodingTrust-Agent
Same 12 domains and judge
8.3%
Indirect injection success
Lower is safer
30.5%
Direct attack success
Lower is safer
85.6%
Benign task success
Higher is better
~6,200
Tasks per model
Same 12 domains and judge
Model comparison
Same 12 domains · same judge
| Model | Indirect injectionLower is safer | Direct attackLower is safer | Benign task successHigher is better | Tasks per modelApproximate |
|---|---|---|---|---|
| Pokee-Isaac 28B v0.1 (preview) | 8.3% | 30.5% | 85.6% | ~6,200 |
| Claude Haiku 4.5 | 36.7% | 37.7% | 70.5% | ~6,200 |
| Nemotron 3 Super | 39.9% | 78.3% | 61.0% | ~6,200 |
| GPT-5.6 Luna | 46.0% | 52.3% | 84.9% | ~6,200 |
| Qwen3.5-122B | 46.1% | 59.8% | 77.9% | ~6,200 |
| Gemini 3.5 Flash-Lite | 49.0% | 82.9% | 82.5% | ~6,200 |
The attack surface
Traditional app security sees events. Agent security must see trajectories.
A benign request can encounter a poisoned email, accept a malicious tool return, combine two individually safe permissions, and make an irreversible change. The risk only becomes visible when the complete sequence is preserved.
- 1
User objective
The authorized task and intended outcome.
- 2
Untrusted content
External data enters the working context.
- 3
Planner decision
The agent selects a path and its next action.
- 4
Tool composition
Permissions combine across tools and steps.
- 5
Persistent action
A change lands in an enterprise system.
Model and planner
Direct harmful requests and conflicting instructions can redirect planning before a tool is ever called.
Tools and skills
Tool schemas, MCP metadata, reusable skills, parameters, and returned content all become part of the decision surface.
Retrieval and memory
Poisoned documents or persistent memories can change decisions across later steps, tasks, and sessions.
External environments
Webpages, email, chat, files, and third-party systems can carry instructions the user never authored or saw.
Serving infrastructure
Identity, batching, caches, budgets, telemetry, and model APIs create security boundaries below the application layer.
Hardened architecture
Eight controls. Two owners. One defensible system.
Three controls sit below the API and require the agent platform. Three belong to the customer’s security layer. Two are joint. Neither party can secure the deployment alone.
Policy gateway
Model-independent input classification, direct-harm refusal, parameter rejection, and identity propagation.
Injection firewall
Preserve provenance on every return, classify injected instructions, and detect drift from the user’s task.
Capability broker
Authorize composed capabilities, not just individual endpoints, with egress allowlists and trust tiers.
Output guard
Guard the stream above the sampler for degenerate output, secret leakage, and PII egress.
Isolation
Use per-caller budgets, tenant-tagged buffers and cache keys, plus application-level wall-clock bounds.
Audit plane
Redact at write time and enforce retention, residency, and access controls on the investigation record.
Supply chain
Sign skill manifests, track corpus provenance, and quarantine untrusted memory before it becomes persistent.
Configuration attestation
Compare source defaults with deployed configuration and fail builds when security controls silently diverge.
Measured results
Injection resistance without giving up the work.
Across the same 12 DecodingTrust-Agent domains and with the same judge, Pokee-Isaac 28B v0.1 (preview) beats all five comparison models on every reported measure: indirect injection success, direct attack success, and benign task success.
Read security relative to capability
A low attack-success rate is not meaningful if an agent rarely completes benign work. The report keeps BSR beside every ASR result so refusal, failure, and genuine resistance are not conflated.
- Results are from one run; the paper applies a ±3-point noise band.
- Pokee-Isaac 28B v0.1 (preview) runs in its own agent scaffold; the other five models run in the stock OpenAI SDK runner.
- All six models use the same 12 domains and the same judge, with approximately 6,200 tasks each.
Read the architecture, methodology, per-domain results, and caveats.
Cite this work
BibTeX
@techreport{wu2026enterprise,
title = {Enterprise Agent and Model Security: Threat Landscape, Hardened Architecture, and Measured Results},
author = {Wu, Christopher and Chen, Zhaorun and Cai, Michael and Li, Bo and Zhu, Zheqing},
institution = {Pokee AI},
type = {Whitepaper},
year = {2026},
month = sep,
url = {https://pokee.ai/research/pokee-ai-security-whitepaper.pdf}
}Review Pokee’s operational security posture.
The research explains the architecture. The Trust Center contains current compliance documentation and assurance materials.