delegation depth vs Context accumulation

[skizzy1xjn]

Former sec researcher here. A LOT of the failures right now aren't about an agent doing anything wrong. More like agent that's getting to seeing too much

mail -> search -> docs -> agent

3 hops, now the agent has vaccumed up context that no human could have gathered manually, all in seconds hooked right into the Graph (yes, copilot, talking about u)

Delegation depth for sure, next add context accumulation because it deserves its own ctageory for study

Feels like one of those few benchmarks measuring smth fundamentally different vs adding more prompt injection samples. Will share around

[freyzo]

yeah this is the whole point. the scary part isn't the agent doing something wrong, it's it quietly slurping mail + search + docs into one window. stuff no human would pull together by hand. every hop looks fine alone, the damage is the pile.
half of it's already in btw: a CAS metric (breadth_ratio = accessed/available per hop) and a context_budget defense. but you're right it should be its own attack class, not just a metric. thinking DXPIA-009: context harvesting, where the payload is just the breadth, no injected instruction at all.