AI Agent Telemetry Poisoning: When The Dashboard Lies

Telemetry becomes security critical when an agent uses it as decision evidence. A human dashboard can be wrong and still wait for a human to notice. An agent dashboard can be wrong and immediately feed planning, approval, retry, rollback, deployment, routing or escalation logic.

That difference matters because modern agent workflows are increasingly wrapped in measurement. They read CI summaries, observability panels, release scorecards, eval reports, ticket health, error budgets, freshness badges, trace summaries and executive ready KPI cards. Those artifacts are useful because they compress messy reality into a small number of decisions. Ship or hold. Escalate or ignore. Roll back or continue. Tune tighter or relax. Trust the run or re run it.

Compression is also the opening. If an attacker can change the compressed evidence without obviously changing the underlying system, the agent may inherit a false state of the world. The attack does not need to say "ignore previous instructions." It can say "last updated. Now," "all checks green," "approved by review chain," "SLO budget at risk," or "severity below threshold." The words look operational. The outcome is behavioral control.

The poisoned object is not always the raw log. It is often the summary layer an agent trusts more than the raw data. That includes the KPI definition, scorecard template, freshness marker, trace explanation, dashboard label, guardrail threshold or SLO pressure statement that tells the workflow how to interpret evidence.

A scorecard is a good example. The visible panel might still contain real numbers, but the template behind it can quietly redefine what counts as success. A "green" deployment lane can change from "all safety gates passed" to "no critical customer facing outage detected." A model eval card can move a failing category into an informational bucket. A release summary can preserve the same format while mutating the boundary between safe and unsafe.

Freshness signals are another high value target. Agents and operators love small recency claims because they reduce cognitive load. Green dot, last successful pull, newer than badge, current snapshot, fresh bundle. If the badge is forged or replayed, stale evidence becomes action ready. The agent does not need to be gullible. It only needs to trust the badge more than it verifies the source.

Decision traces are the most dangerous version because they attack review itself. If the trace says a step was considered, a reviewer approved it or an exception was already justified, the next actor may treat the action as pre cleared. A forged approval narrative can launder a risky action through the same audit language defenders depend on after an incident. This connects directly to what our managed agents research documented. Approval language in an agent context is not the same as verified approval.

KPI scorecard substitution works by changing what the agent thinks the metric means while preserving the familiar dashboard shape. The weekly release panel still has rows, colors, owners and a final recommendation. But the template now treats missing security telemetry as "not applicable," moves policy exceptions into a lower risk lane or changes a fallback rule from "hold" to "continue with caution."

Nothing in that panel has to look dramatic. That is the point. The attacker is not trying to win a shouting match with the model. They are trying to edit the spreadsheet the model believes. Once the scorecard definition is poisoned, every downstream decision can be wrong while still citing a neat, executive friendly metric.

Freshness badge forgery works by making old evidence appear safe to reuse. An incident response agent sees a green dot, a last updated timestamp or a "newer than two hours" badge and proceeds without pulling the raw source again. The report layout is clean. The timestamp is plausible. The cached artifact is stale.

The agent's mistake is not irrational. Many production systems train operators to respect freshness badges because re checking every source is expensive. The security fix is not "never trust dashboards." The fix is to make recency claims verifiable, source bound and hard to replay across lanes or cycles. See our FAQ for how Sunglasses handles this class of attack at the ingestion boundary.

Decision trace approval forgery works by corrupting the audit trail before the next decision point consumes it. A plan summary says a human approved the risky step. A trace record says the agent considered the security exception. A review chain says the write action was narrowed to read only scope. The actual execution path does not match that story.

This is especially dangerous for human in the loop systems. Humans are not bypassed. They are shown a forged story that makes rubber stamping feel reasonable. The attack turns the safety layer into a confidence layer. The approval text becomes the payload. Our CVP evaluation methodology uses this exact pattern class to stress test scanner detection under real adversarial conditions.

This attack class is narrower than generic runtime trust because the control channel is measurement integrity. Access control asks who may reach the system. Runtime trust asks whether the workflow should act now. Telemetry poisoning asks whether the evidence used to answer that question has been corrupted.

That distinction keeps the defense practical. A team can have decent permissions, sandboxing, approval gates and policy checks while still letting an agent consume a poisoned metric layer. The agent is not escaping its cage. It is reading the cage's status panel and being told the door is safe to open.

The guardrail tampering version is particularly subtle. Many systems auto tune thresholds from recent telemetry. If the telemetry is poisoned slowly, the guardrail can teach itself to accept what it used to block. The attacker does not defeat the detector in one cinematic payload. They train the boundary to move.

SLO and error budget pressure create a similar path. A dashboard can frame security checks as the thing endangering availability. If the agent is rewarded for preserving uptime, it may treat safety gates as optional friction during an "urgent" budget burn. In that scenario the metric is not just a report. It is a priority injection.

Sunglasses helps by treating agent facing operational text and metadata as trust bearing input, not harmless decoration. Scorecard templates, dashboard labels, freshness claims, approval summaries, trace notes, SLO explanations, guardrail tuning comments and observability instructions can all change how an agent interprets evidence.

That matters because many telemetry poisoning payloads are written in the language of legitimate operations. "Mark missing telemetry as informational." "Proceed if availability budget is threatened." "Use cached readiness when pull fails." "Suppress noisy logs from the executive summary." Each sentence might be benign in one context and dangerous in another. The question is whether the text changes authority, suppresses evidence, relaxes safety, redefines success or launders approval. The Sunglasses manual covers the full detection taxonomy across all 55 categories.

For defenders, Sunglasses is not a replacement for observability, SIEM, identity or tamper evident logging. It is the layer that asks a different question before an agent acts. Are the words and metadata around this workflow trying to make false evidence look trustworthy?

The useful places to scan are the seams. Release scorecards, incident runbooks, eval summaries, dashboard templates, MCP/tool descriptions, CI annotations, approval summaries, freshness files and any generated report that an agent may use as evidence for its next step.

The fastest way to reduce telemetry poisoning risk is to separate evidence, interpretation and authority. Do not let one friendly green panel own all three.