When AI agents break into systems, do their weak spots line up like a break-in playbook, or not?

This explores whether the five vulnerability classes for cyber-capable AI agents (multi-step offensive chains, objectives that clash with sandbox boundaries, supply-chain and credential exposure, persistent command-and-control, and automated action speed) tend to appear together in a recognizable order, like stages of a break-in. The corpus doesn't show that they do, and the way the five are defined suggests why. What vulnerabilities emerge where AI agents meet their evaluation sandbox? sorts them by where an agent meets its environment, not by attack type. That makes the list a map of places things can go wrong, not a kill chain. Only one class, the multi-step chain, is about sequence at all. Automated speed works more like a multiplier than a stage, and conflicting objectives describe a motive more than a step.

The corpus does show that sequences are hard to catch, because each step can look harmless alone. ColluSkill plans a chain of skills and then uses scanner feedback to tone down each one. It reaches 96% average attack success across six scanners, because scanners score skills one at a time while the chain-level meaning stays intact (Can attackers evade skill scanners by refining individual skills?). The defensive mirror image is the argument that the unit of defence should be a set of actions linked by observed transfers, task authority and response history, with membership revised as evidence comes in. Reviewing executions in isolation throws away the context that spans them (Should defence units span multiple executions and agents?).

Whether defenders can find these sequences before they finish is the open part. The corpus calls prospective episode discovery, meaning grouping actions before anyone tells you which belong together, the central unsolved defense problem. The paper it comes from reports no conclusive result on whether this can be done at an acceptable false-alert cost (Can defenders discover agent episodes without knowing membership in advance?). Until it can, "predictable" is a hope, not a finding. Operators can still act now by preserving relationships across executions, constraining shared resources and tying responses to persistent state (How can operators stop coordinated agent intrusions now?).

Two more gaps make cross-study patterns hard to read. First, one framework argues that adversary position, meaning where the attacker sits in the system, is a missing axis. Existing notes vary it without naming it, which makes their results hard to compare (Can adversary position unify fragmented multi-agent attack models?). A sequence that works from one position may not exist from another. Second, exploitation, the step where a vulnerability becomes a real attack, is largely unmeasured in cybersecurity benchmarks (Do cybersecurity benchmarks actually measure exploitation?). Typical sequences are hard to learn from benchmarks that skip the middle step. Even the layer that picks which model handles a request is its own attack surface, sitting beneath prompt-level defenses (Can attackers manipulate which model handles a request?). Nothing here says where it falls in a sequence.

So the honest answer is that the corpus supports the idea that chains matter and that defenses fail when they look at pieces. It has no evidence yet for a canonical ordering. A natural guess would be credentials first, then a chain, then a persistent foothold, but that is a hypothesis these notes don't test.