\relax 
\providecommand\hyper@newdestlabel[2]{}
\providecommand\HyField@AuxAddToFields[1]{}
\providecommand\HyField@AuxAddToCoFields[2]{}
\citation{cve6514}
\citation{cve53773}
\citation{cvegit}
\citation{cve49596}
\citation{cve59536}
\citation{postmark}
\citation{sandworm}
\citation{pint}
\citation{mcptox}
\citation{asb}
\citation{aishell}
\citation{hacka}
\citation{tensortrust}
\citation{caibench}
\citation{mcptox}
\citation{minja}
\citation{asb}
\citation{mcptoxbench}
\citation{aisafety}
\citation{sigma}
\citation{atr}
\citation{pint}
\citation{atrscanmega}
\citation{ciscopr79}
\citation{sigma}
\citation{kim2026}
\citation{chhabra2025}
\citation{survey2026}
\citation{promptinjsurvey}
\citation{cve6514}
\citation{cve49596}
\citation{cvegit}
\citation{cve53773}
\citation{postmark}
\citation{postmark}
\@writefile{toc}{\contentsline {section}{\numberline {1}The End of Perimeter Defense}{2}{section.1}\protected@file@percent }
\newlabel{sec:perimeter}{{1}{2}{The End of Perimeter Defense}{section.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.1}Forty Years of One Assumption}{2}{subsection.1.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {1.2}The Empirical Evidence}{2}{subsection.1.2}\protected@file@percent }
\citation{sandworm}
\citation{minja}
\citation{memorygraft}
\citation{mspoison}
\citation{aixbt}
\citation{servicenow}
\citation{nist}
\citation{owaspllm}
\citation{owaspagentic}
\citation{mitreatlas}
\@writefile{toc}{\contentsline {section}{\numberline {2}The Trust Architecture Gap}{3}{section.2}\protected@file@percent }
\newlabel{sec:trustgap}{{2}{3}{The Trust Architecture Gap}{section.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Three Pillars, One Standing}{3}{subsection.2.1}\protected@file@percent }
\citation{grayswan}
\citation{rlinject}
\citation{rlinject}
\citation{mcptoxbench}
\citation{mcptoxbench}
\citation{kim2026}
\citation{chhabra2025}
\@writefile{lot}{\contentsline {table}{\numberline {1}{\ignorespaces Trust Pillar Analysis: Traditional Systems vs.\ AI Agents}}{4}{table.1}\protected@file@percent }
\newlabel{tab:pillars}{{1}{4}{Trust Pillar Analysis: Traditional Systems vs.\ AI Agents}{table.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Why Model Improvement Doesn't Fix This}{4}{subsection.2.2}\protected@file@percent }
\citation{kim2026}
\citation{securitymodeling}
\citation{galileo}
\citation{anthropicrates}
\citation{checkmarx}
\citation{cosai}
\citation{aisafety}
\citation{trendmicro}
\citation{checkmarx}
\citation{paloalto}
\citation{checkmarx}
\citation{checkmarx}
\citation{gartner}
\citation{kim2026}
\citation{chhabra2025}
\citation{promptkillchain}
\citation{youraishell}
\citation{grayswan}
\citation{rlinject}
\citation{mcptoxbench}
\citation{asbbench}
\citation{invariant}
\citation{sandworm}
\citation{supabase}
\citation{docker}
\citation{cve6514}
\citation{cve49596}
\citation{minja}
\citation{memorygraft}
\citation{mspoison}
\citation{galileo}
\citation{servicenow}
\citation{postmark}
\citation{sandworm}
\citation{aishell}
\citation{cve53773}
\citation{cve6514}
\citation{asana}
\citation{memorygraft}
\citation{aixbt}
\citation{grayswan}
\citation{rlinject}
\citation{pint}
\citation{hacka}
\citation{tensortrust}
\citation{pint}
\citation{hacka}
\citation{tensortrust}
\citation{mcptox}
\citation{asb}
\citation{aishell}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.3}The Scaling Dynamics}{5}{subsection.2.3}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {3}The Complete Attack Surface Map}{5}{section.3}\protected@file@percent }
\newlabel{sec:attacksurface}{{3}{5}{The Complete Attack Surface Map}{section.3}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.1}Ten Data Flow Points}{5}{subsection.3.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2}What's Defended vs.\ What Isn't}{5}{subsection.3.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Why Current Benchmarks Mislead}{5}{subsection.3.3}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {2}{\ignorespaces Complete Attack Surface Map: 10 Structural Data Flow Points}}{6}{table.2}\protected@file@percent }
\newlabel{tab:attacksurface}{{2}{6}{Complete Attack Surface Map: 10 Structural Data Flow Points}{table.2}{}}
\@writefile{lot}{\contentsline {table}{\numberline {3}{\ignorespaces Current Defense Coverage by Data Flow Point}}{6}{table.3}\protected@file@percent }
\newlabel{tab:defense}{{3}{6}{Current Defense Coverage by Data Flow Point}{table.3}{}}
\@writefile{lot}{\contentsline {table}{\numberline {4}{\ignorespaces Benchmark Coverage of Attack Surface Points}}{6}{table.4}\protected@file@percent }
\newlabel{tab:benchmarks}{{4}{6}{Benchmark Coverage of Attack Surface Points}{table.4}{}}
\citation{invariant}
\citation{cyberark}
\citation{antiy}
\citation{sandworm}
\citation{postmark}
\citation{postmark}
\citation{invariant}
\citation{sandworm}
\citation{postmark}
\citation{sandworm}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.4}The Most Exposed Attack Surface: Agent Skill Marketplaces}{7}{subsection.3.4}\protected@file@percent }
\newlabel{sec:marketplaces}{{3.4}{7}{The Most Exposed Attack Surface: Agent Skill Marketplaces}{subsection.3.4}{}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.4.1}Root Privilege, Zero Defense}{7}{subsubsection.3.4.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.4.2}The Numbers}{7}{subsubsection.3.4.2}\protected@file@percent }
\citation{antiy}
\citation{sandworm}
\citation{postmark}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.4.3}Why This Is the Defining Battleground}{8}{subsubsection.3.4.3}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {5}{\ignorespaces Vulnerability Manifestation in Skill Marketplaces}}{8}{table.5}\protected@file@percent }
\newlabel{tab:skillvuln}{{5}{8}{Vulnerability Manifestation in Skill Marketplaces}{table.5}{}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {3.4.4}What Defense Looks Like Here}{8}{subsubsection.3.4.4}\protected@file@percent }
\citation{hacka}
\citation{promptinjsurvey}
\citation{pint}
\citation{anthropicrates}
\citation{checkmarx}
\citation{anthropicrates}
\citation{cve53773}
\citation{checkmarx}
\citation{cosai}
\citation{promptkillchain}
\citation{kim2026}
\@writefile{toc}{\contentsline {section}{\numberline {4}Why Static Defenses Cannot Keep Pace}{9}{section.4}\protected@file@percent }
\newlabel{sec:staticdefense}{{4}{9}{Why Static Defenses Cannot Keep Pace}{section.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}The Paraphrase Problem}{9}{subsection.4.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}The 3--6 Month Half-Life}{9}{subsection.4.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.3}The Capability-Vulnerability Coupling}{9}{subsection.4.3}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {6}{\ignorespaces Defense Decay: Empirical Evidence}}{10}{table.6}\protected@file@percent }
\newlabel{tab:decay}{{6}{10}{Defense Decay: Empirical Evidence}{table.6}{}}
\@writefile{toc}{\contentsline {section}{\numberline {5}Requirements for a Defense Architecture That Scales}{11}{section.5}\protected@file@percent }
\newlabel{sec:requirements}{{5}{11}{Requirements for a Defense Architecture That Scales}{section.5}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.1}Requirement 1: Multi-Point Interception}{11}{subsection.5.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.2}Requirement 2: Below-Reasoning-Layer Detection}{11}{subsection.5.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.3}Requirement 3: Cascade Economics}{11}{subsection.5.3}\protected@file@percent }
\citation{pint}
\citation{sigma}
\citation{sigma}
\citation{mitreatlas}
\citation{nist}
\@writefile{toc}{\contentsline {subsection}{\numberline {5.4}Requirement 4: Evolutionary Capability}{12}{subsection.5.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {5.5}Requirement 5: Open Auditability}{12}{subsection.5.5}\protected@file@percent }
\citation{sigma}
\citation{mitreatlas}
\citation{sigma}
\citation{owaspagentic}
\citation{owaspllm}
\citation{mitreatlas}
\@writefile{lot}{\contentsline {table}{\numberline {7}{\ignorespaces Historical Security Standards and Their Success Factors}}{13}{table.7}\protected@file@percent }
\newlabel{tab:standards}{{7}{13}{Historical Security Standards and Their Success Factors}{table.7}{}}
\@writefile{toc}{\contentsline {section}{\numberline {6}The Standard Question}{13}{section.6}\protected@file@percent }
\newlabel{sec:standard}{{6}{13}{The Standard Question}{section.6}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {6.1}What Made Previous Standards Succeed}{13}{subsection.6.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {6.2}What AI Agent Security Needs}{13}{subsection.6.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {6.3}Properties the Standard Must Have}{13}{subsection.6.3}\protected@file@percent }
\citation{pint}
\citation{atr}
\citation{atrscanmega}
\citation{sigma}
\@writefile{toc}{\contentsline {section}{\numberline {7}ATR: Implementation and Empirical Validation}{14}{section.7}\protected@file@percent }
\newlabel{sec:atr}{{7}{14}{ATR: Implementation and Empirical Validation}{section.7}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.1}Architecture}{14}{subsection.7.1}\protected@file@percent }
\citation{owaspllm}
\citation{owaspagentic}
\citation{mitreatlas}
\citation{owaspagentic}
\citation{safemcp}
\citation{owaspllm}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.2}Rule Design}{15}{subsection.7.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {7.3}Coverage}{15}{subsection.7.3}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {8}{\ignorespaces ATR Rule Coverage by Threat Category}}{15}{table.8}\protected@file@percent }
\newlabel{tab:coverage}{{8}{15}{ATR Rule Coverage by Threat Category}{table.8}{}}
\citation{pint}
\citation{sigma}
\citation{atrscanmega}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.4}Benchmark Results}{16}{subsection.7.4}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {9}{\ignorespaces ATR Benchmark Results}}{16}{table.9}\protected@file@percent }
\newlabel{tab:benchresults}{{9}{16}{ATR Benchmark Results}{table.9}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.5}Why the Recall Gap Is a Feature, Not a Bug}{16}{subsection.7.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {7.6}Mega Scan: Agent Skill Ecosystem}{17}{subsection.7.6}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {10}{\ignorespaces Mega Scan: Agent Skill Ecosystem (53,577 skills)}}{17}{table.10}\protected@file@percent }
\newlabel{tab:megascan}{{10}{17}{Mega Scan: Agent Skill Ecosystem (53,577 skills)}{table.10}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.7}Threat Crystallization: Validated}{17}{subsection.7.7}\protected@file@percent }
\citation{ciscopr79}
\citation{snykinvariant}
\@writefile{toc}{\contentsline {subsection}{\numberline {7.8}Adoption}{18}{subsection.7.8}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {7.9}Known Limitations}{18}{subsection.7.9}\protected@file@percent }
\citation{gartner}
\citation{gartner}
\citation{trendmicro}
\citation{galileo}
\citation{cisco}
\citation{antiy}
\citation{checkmarx}
\citation{paloalto}
\citation{checkmarx}
\citation{cosai}
\citation{galileo}
\citation{glasswing}
\citation{grayswan}
\citation{anthropicrates}
\citation{minja}
\citation{invariant}
\citation{sandworm}
\citation{cve6514}
\citation{kim2026}
\citation{anthropicrates}
\citation{checkmarx}
\citation{aisafety}
\citation{gartner}
\citation{checkmarx}
\@writefile{toc}{\contentsline {section}{\numberline {8}The Road Ahead: What Happens If We Don't Act}{19}{section.8}\protected@file@percent }
\newlabel{sec:roadahead}{{8}{19}{The Road Ahead: What Happens If We Don't Act}{section.8}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {8.1}The 2026--2027 Threat Trajectory}{19}{subsection.8.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {8.2}The Gap}{19}{subsection.8.2}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {9}Conclusion}{19}{section.9}\protected@file@percent }
\newlabel{sec:conclusion}{{9}{19}{Conclusion}{section.9}{}}
\citation{atr}
\citation{pint}
\citation{atrscanmega}
\citation{ciscopr79}
\citation{snykinvariant}
\citation{cve6514}
\citation{cve53773}
\citation{cvegit}
\citation{cve49596}
\citation{sandworm}
\citation{postmark}
\citation{minja}
\citation{servicenow}
\citation{aixbt}
\citation{atr}
\bibcite{kim2026}{1}
\bibcite{chhabra2025}{2}
\bibcite{survey2026}{3}
\bibcite{acmsurvey}{4}
\bibcite{protocol2025}{5}
\bibcite{promptinjsurvey}{6}
\bibcite{securitymodeling}{7}
\bibcite{promptkillchain}{8}
\bibcite{youraishell}{9}
\bibcite{rlinject}{10}
\bibcite{minja}{11}
\bibcite{memorygraft}{12}
\bibcite{agentpoison}{13}
\bibcite{pint}{14}
\bibcite{mcptox}{15}
\bibcite{asb}{16}
\bibcite{aishell}{17}
\bibcite{hacka}{18}
\bibcite{tensortrust}{19}
\bibcite{caibench}{20}
\bibcite{cisco}{21}
\bibcite{ibm}{22}
\bibcite{trendmicro}{23}
\bibcite{paloalto}{24}
\bibcite{crowdstrike}{25}
\bibcite{checkmarx}{26}
\bibcite{cyberark}{27}
\bibcite{gartner}{28}
\bibcite{aisafety}{29}
\bibcite{owaspllm}{30}
\bibcite{owaspagentic}{31}
\bibcite{owaspmcp}{32}
\bibcite{mitreatlas}{33}
\bibcite{nist}{34}
\bibcite{cosai}{35}
\bibcite{sigma}{36}
\bibcite{cve6514}{37}
\bibcite{cve53773}{38}
\bibcite{cvegit}{39}
\bibcite{cve49596}{40}
\bibcite{cve59536}{41}
\bibcite{postmark}{42}
\bibcite{sandworm}{43}
\bibcite{antiy}{44}
\bibcite{docker}{45}
\bibcite{invariant}{46}
\bibcite{mspoison}{47}
\bibcite{aixbt}{48}
\bibcite{servicenow}{49}
\bibcite{supabase}{50}
\bibcite{asana}{51}
\bibcite{grayswan}{52}
\bibcite{mcptoxbench}{53}
\bibcite{asbbench}{54}
\bibcite{aishellbench}{55}
\bibcite{anthropicrates}{56}
\bibcite{galileo}{57}
\bibcite{atr}{58}
\bibcite{atrscanmega}{59}
\bibcite{ciscopr79}{60}
\bibcite{safemcp}{61}
\bibcite{snykinvariant}{62}
\bibcite{glasswing}{63}
\bibcite{atrscan}{64}
\gdef \@abspage@last{23}
