Machines Leave Footprints

I keep coming back to the same image from this week's reports: not a faster attacker disappearing into the distance, but a machine crossing wet concrete. The obvious risk from agent-assisted attacks is compression. Google's campaign connected scanning, troubleshooting and IP rotation into a job completed in less than six hours. Anthropic described workflows that watched for malware detection, rebuilt the tools and tried again. Humans still chose targets and reviewed results, but the pauses between operational steps became shorter. That speed matters because it reduces the defender's response window. It does not prove that AI was responsible. A skilled operator with good automation can also work quickly, repeat the same commands and stay active at unusual hours. Timing is weak evidence when it stands alone. The stronger signal is the shape of the sequence. An agent follows instructions through tools. It retries when a call fails. It may rebuild an artifact, rotate infrastructure, hand work to another agent or cross from the requester's identity into a more privileged service account. Each step can be ordinary. The ordered combination can be much more informative: rapid retries after detection, the same tool chain across several targets, abrupt privilege transitions, parallel activity and repeated handoffs with little human delay. This is where DriftNet is useful without asking it to prove too much. Its benchmark results show that a model trained on logged tool-call trajectories can detect and localize behavior that changed after prompt injection. It does not identify an attacker as human or AI, and it has not demonstrated the same performance in production networks. It does show that the path an agent takes can contain information that the final output hides. Identity adds another footprint. Noma's workflow example starts with a low-trust requester and ends with a privileged workflow retrieving data. The model may follow its instructions perfectly. The detectable event is the authority change: who influenced the action, whose credentials executed it and whether the original requester had the right to cause it. So I would not build an “AI attacker” alert from speed, operating hours or one strange request. I would instrument the workflow around them. Preserve action order. Measure retries. Record delegation. Keep the initiating identity attached to every tool call. Flag privilege changes and coordinated actions that do not match the normal shape of the job. Machines leave footprints because they act in sequences. Defenders do not need to prove who, or what, made every step before using that sequence as additional telemetry.