Queen's University Belfast team asks if zero-trust can secure AI agents
IEEE Spectrum published an article brought to readers by Queen's University Belfast (QUB). It speaks for a QUB research group and ends with a bio of Vishal Sharma, a Reader in the School of Electronics, Electrical Engineering, and Computer Science at QUB. The piece is mostly a set of open questions about whether zero-trust architecture (ZTA) can hold up when AI agents are orchestrated at scale.
It opens with a scenario: teams are building task forces of agents managed by an orchestrator, for risk assessment, client profiling, match making and similar work. These systems are expected to keep checkpoints where agents are prompted to delete historic context, so past decisions do not skew new ones. The article says a later prompt could still make the agents bring back the information that was supposed to be deleted, and could trick them into revealing more. It calls this a classic context recovery attack, and asks: how can we trust that our instructions have been followed, and where is the proof?
ZTA, the article explains, means every agentic interaction follows the principle of "never trust, always verify." But ZTA includes a policy enforcement point (PEP) that itself has to be trusted. So the group asks where the zero-trust component really is, and whether the policies a PEP enforces can be trusted. Relying on one PEP to scale to all agentic interactions, it says, underestimates the problem space.
The article warns that opening systems to random agents trained on off-the-shelf models, and relying on them blindly, can pose significant cyber risks. Its example is vibe coding: handing an entire codebase to an untrusted outside entity can spread vulnerability across multiple surfaces. It also notes that in an autonomous web of agents with low tolerance of failure, verifying every query in real time could be computationally expensive, a trade-off between memory and execution. A zero-day attack raises the question of whether the system could cope without a total infrastructure breakdown; with only one trusted layer, a failure could expose the whole ecosystem.
The one empirical item is an in-house QUB experiment on de-authentication attacks. The team says that with agentic orchestration, the rate of such attacks could go as low as 2 to 3 seconds, which it says leaves little to no time to react and decide on patching.
The group then turns to trust under asynchronous autonomy: how to ensure that all agents working toward a common goal are aligned and understand the delays tied to their goals. Its team first demonstrated that the problem exists. It says solutions can be simplified by keeping an AI bill of material or using distributed ledger technology, which can give traceability and immutability and keep trust vectors independent of the platform. It also flags "horizontal anomalies", meaning agents that interact differently with various sources under different settings. An agent that behaves correctly on one task does not necessarily deserve trust across all components, and how to detect such anomalies remains open.
On recovery cost, the article says agents with semi to low trust governance offer high short-term benefits, but the cost of recovery when the system fails is yet to be explored. A supply chain problem caused by a rogue agent would not stay contained and would need a sweep across all touch points of the affected agents. That, it says, points to computationally expensive trackers for every agent.
The group's stated hypothesis is that sovereignty and trust need to be governed together, because the onus of provenance is high on the host of agents. It also says there is a vital difference between missed information and missed instructions, with different impacts on accountability. In stateless systems with high agentic autonomy, it says, convergence and reliability toward trust-provenance decrease significantly, which brings it back to the question of whether a true zero-trust architecture exists.
The article describes the group's work in the Cyber AI hub with companies building agentic applications. It says the organizations it works with, where trust is a prerequisite, secure their systems through internal policies rather than trusting third-party agentic service providers, and track agent activity through logs, including a token revocation list to avoid replay attacks. It also mentions formal verification of trust, including balancing adversarial accuracy with certified adversarial robustness to judge how far a model can be trusted. It closes by asking whether anything less than foolproof is acceptable for real-world agents, how much impact can be controlled, and who is responsible for the rest.
Key facts
- A QUB research group argues zero-trust architecture is under strain from orchestrated AI agents, because the policy enforcement point (PEP) must itself be trusted.
- An in-house QUB experiment on de-authentication attacks found that with agentic orchestration the rate could go as low as 2 to 3 seconds, leaving little to no time to react.
- Even with checkpoints that tell agents to delete historic context, a later prompt could bring the deleted information back, which the article calls a classic context recovery attack.
- The article suggests an AI bill of material or distributed ledger technology for traceability, but offers no concrete fix for the PEP problem and ends with open questions.
- It flags unexplored risks: horizontal anomalies in agent behaviour, and the cost of recovery when a low-trust agentic system fails.
Why it matters
Zero-trust, with its rule of "never trust, always verify", is the standard answer to securing systems, and this article asks whether it still works once autonomous agents are orchestrated at scale. Its core objection is circular: the policy enforcement point that is supposed to create trust has to be trusted itself. The one number it offers, 2 to 3 seconds for agentic de-authentication attacks, is used to argue that the window for human reaction or patching could shrink to almost nothing.
Who it affects
The article is aimed at organizations building or adopting agentic applications, such as the risk assessment, client profiling and match making systems it describes, and at teams that give agents or outside AI services access to code and data. It singles out vibe coding with an untrusted outside entity, and industries where trust is a prerequisite and that rely on internal policies rather than third-party agentic providers.
How to use it
The piece is a set of questions rather than a method, but it names some measures. These include an AI bill of material or distributed ledger technology for traceability and immutability, logs that track agent activity, token revocation lists against replay attacks, internal policies instead of trust in third-party agent providers, and formal verification of model trust, including balancing adversarial accuracy with certified adversarial robustness. It also says computationally expensive trackers may be needed for all agents. It describes these in a sentence or two each, so treat them as pointers for further reading, not implementation guidance.
How solid is it
This is an essay brought to readers by Queen's University Belfast, speaking as the research group, not an independent news report. The in-house QUB experiment is described in one paragraph only: no number of runs, test setup, target systems or published paper is given. The 2 to 3 seconds figure is stated as "could go as low as", not as a measured average or median. No named company or product is identified as having suffered an attack or a failure. The reference list points to the group's conference papers and a preprint, but the article does not tie the experiment to any of them.
Risks and caveats
The article states its own limits: horizontal anomalies are "not well explored", how to detect them is an open question, and the cost of recovery after a failure is yet to be explored. No concrete fix is offered for the PEP or zero-trust problem. The broader claim that trust reliability falls in stateless, high-autonomy systems is asserted without supporting data in the text. Read the 2 to 3 second figure as a lower bound from one internal test, not as a typical attack speed.
“How can we trust that our instructions have been followed? And where is the proof?”
— IEEE Spectrum article brought to readers by Queen's University Belfast