Data exfiltration occurs when a synthetic subject causes confidential, sensitive, regulated, proprietary, or otherwise protected information to leave its authorized boundary. The transfer may be direct or indirect, intentional or unintended, visible or hidden inside another output channel. This adverse outcome creates organizational harm because the synthetic subject may expose data it was permitted to access but not permitted to disclose. The disclosure may involve customer records, employee data, source code, credentials, financial information, legal material, internal communications, business strategy, regulated records, or other protected information. The primary harm is loss of control over protected data. The synthetic subject may disclose information through rendered content, connected tools, outbound communications, generated files, memory, retrieved context, cross-tenant workflows, or external services. The path may not resemble a conventional file export or human-initiated transfer. A related harm is attribution and scoping difficulty. Data exfiltration by a synthetic subject may be distributed across prompts, retrieval events, tool calls, rendered output, browser fetches, application logs, and downstream systems. Investigators may need to reconstruct both what data was exposed and which synthetic subject action caused it to leave the authorized boundary. Investigators should review prompt and response logs, retrieval records, tool-call logs, generated artifacts, outbound communications, web proxy records, Data Loss Prevention (DLP) events, browser or application rendering logs, memory reads, connector logs, and destination records. Particular attention should be given to sensitive data appearing in external requests, messages, files, tool arguments, generated output, memory disclosures, or cross-boundary records. Investigative RelevanceData exfiltration is relevant because it is one of the most direct adverse outcomes a synthetic subject can produce. The same synthetic subject may have legitimate access to protected information for one purpose while causing unauthorized disclosure through another channel. This section is especially relevant where synthetic subjects can retrieve enterprise data, summarize documents, access mailboxes, call tools, send communications, generate files, render links or images, interact with external services, or operate across users, tenants, vendors, or organizations.

AI-mediated fraud and misappropriation occurs when a synthetic subject, synthetic media, or AI-enabled workflow causes funds, goods, services, credentials, account access, or other value to be transferred to an unauthorized party. The transfer may be executed by the synthetic subject directly, by a human relying on AI-generated deception, or by an automated workflow influenced by AI-mediated instructions. This adverse outcome creates organizational harm because AI can manufacture or amplify apparent authority. A synthetic subject may initiate a payment, approve a transaction, route a refund, issue a credit, or instruct a workflow to transfer value. Separately, synthetic media may impersonate executives, managers, vendors, customers, or colleagues to induce a human employee to authorize the transfer. The primary harm is misappropriation of organizational value. The loss may involve wire transfers, vendor payments, refunds, credits, inventory release, account changes, gift cards, procurement approvals, payroll changes, or access that can later be monetized. The transaction may appear authorized because it travels through familiar business channels or appears to come from a trusted figure. A related harm is verification failure. AI-generated voice, video, text, or agent-mediated instruction may defeat informal controls that rely on recognizing a person, trusting a meeting, or accepting a single communication channel. Investigators may need to determine whether the transaction was authorized through a structured workflow or induced through synthetic-media impersonation compromised identity, or synthetic subject action. Investigators should review payment records, beneficiary accounts, workflow approvals, operator identity, non-human identity activity, prompt and response logs, tool-call records, communication channels, video or voice authorization records, liveness signals, session telemetry, and approval provenance. Particular attention should be given to novel beneficiaries, unusual amounts or velocity, skipped approval steps, ad hoc payment requests, agent-initiated transfer actions, and high-value instructions authorized through a single channel. Investigative RelevanceAI-mediated fraud and misappropriation is relevant because the harmful outcome is the unauthorized transfer of value. The synthetic subject or synthetic media may not be the final payment rail, but it can supply the apparent authority, instruction, approval, or automation path that causes the transfer. This section is especially relevant where synthetic subjects can initiate payments, route refunds, update beneficiary records, approve procurement, issue credits, interact with finance systems, generate payment instructions, or impersonate trusted organizational figures through synthetic audio, video, or text.

Destructive system or data action occurs when a synthetic subject deletes, overwrites, wipes, disables, or otherwise damages systems, data stores, production assets, or operational environments outside its authorized scope. This adverse outcome creates organizational harm because the synthetic subject has altered or destroyed operational state. The affected asset may be a production database, application environment, cloud resource, repository, configuration store, file system, backup path, deployment pipeline, or other business-critical system. The primary harm is loss of availability or integrity. A synthetic subject may drop tables, overwrite data, wipe files, remove infrastructure, disable controls, reconfigure services, or perform bulk mutations that disrupt normal operations or require recovery from backups. A related harm is false operational assurance. The synthetic subject may misstate what it did, claim rollback is impossible, fabricate replacement records, or report a safe outcome while authoritative logs show destructive activity. Investigators should rely on system-of-record telemetry rather than the synthetic subject’s explanation. Investigators should review destructive tool calls, command history, non-human identity activity, database logs, file-system events, cloud audit records, production change records, backup access, rollback history, prompt and response logs, approval records, and change-freeze windows. Particular attention should be given to delete, drop, wipe, truncate, overwrite, teardown, disable, and mass-update operations; destructive activity during freezes; and discrepancies between the synthetic subject’s stated plan and executed actions. Investigative RelevanceDestructive system or data action is relevant because synthetic subjects can now act directly against operational environments. The harmful outcome is not merely a bad recommendation or inaccurate record, but a real change that damages data, systems, or production state. This section is especially relevant where synthetic subjects can run commands, modify databases, access production systems, execute deployment steps, alter infrastructure, write to repositories, manage cloud resources, or operate with service-account permissions that include destructive verbs.

Identity misattribution and impersonation harm occurs when a synthetic subject acts under, imitates, or is confused with a human, service, agent, or organizational identity in a way that deceives people, systems, or records about who is acting. The harm may arise from spoofed identity, shared service accounts, synthetic media, weak agent attribution, or machine identities that are not clearly distinguishable from human users. This adverse outcome creates organizational harm because identity is used to assign authority, trust, responsibility, and accountability. If a synthetic subject appears to be an employee, executive, service account, approved agent, vendor, or peer system, its actions or messages may be accepted as legitimate even when they are unauthorized, misleading, or harmful. The primary harm is loss of trustworthy attribution. A synthetic subject may send communications, approve actions, access records, call tools, or modify systems under an identity that does not accurately represent the actor. This can mislead recipients, distort audit trails, weaken contractual trust, and make it difficult to determine whether a human, agent, service, or attacker-controlled identity caused the action. A related harm is reputational and relationship damage. Third parties may rely on a synthetic message, synthetic voice, synthetic video, or agent-originated action as if it came from a trusted person or system. The organization may then face disputes, fraud loss, customer distrust, regulatory scrutiny, or operational breakdown because identity provenance was unclear or false. Investigators should review identity records, non-human identity activity, authentication logs, service account ownership, prompt and response logs, message provenance, cryptographic signatures, session history, concurrent use, geolocation, user-agent data, and actor attribution fields. Particular attention should be given to shared identities, unmanaged agent accounts, actions logged as human but produced by a synthetic subject, impossible or concurrent use of one identity, and communications that lack verifiable agent-origin attribution. Investigative RelevanceIdentity misattribution and impersonation harm is relevant because synthetic subjects can blur the boundary between human, service, and agent action. The adverse outcome is not only that an identity was misused, but that people, systems, or records were caused to trust an incorrect actor. This section is especially relevant where synthetic subjects communicate externally, approve workflows, transact through service accounts, operate under delegated human authority, interact with other agents, or generate synthetic audio, video, or text that mimics a trusted organizational figure.

Agentic harm propagation occurs when an adverse condition affecting one synthetic subject spreads to other synthetic subjects, tools, memory stores, sessions, workflows, or systems. The spread may occur through agent-to-agent messages, shared memory, tool outputs, orchestration handoffs, connector metadata, generated records, or workflow state. This adverse outcome creates organizational harm because the blast radius expands beyond the initial point of failure. A single poisoned input, unsafe output, false record, contaminated memory entry, or malicious connector may influence multiple synthetic subjects with different roles, permissions, tools, or data access. The primary harm is system-wide amplification. An instruction, false record, unsafe behavior, misleading output, or malicious tool result may replicate or reappear across the agent graph, causing repeated data exposure, unauthorized actions, misinformation, fraud, operational disruption, or trust degradation. A related harm is containment difficulty. By the time the adverse condition is detected, the original source may no longer be obvious. The same payload or false state may appear in summaries, task handoffs, memory entries, tool outputs, inter-agent messages, or downstream records, requiring investigators to reconstruct the propagation path across multiple logs and systems. Investigators should review inter-agent communications, shared memory, orchestration logs, tool outputs, Model Context Protocol (MCP) server records, connector changes, memory writes, task handoff records, non-human identity activity, and downstream actions. Particular attention should be given to repeated instruction patterns, anomalous agent-to-agent message volume, poisoned memory records, tool-definition changes, one-to-many fan-out, and synchronized behavior across multiple agents. Investigative RelevanceAgentic harm propagation is relevant because synthetic subject harm may not remain isolated. Agentic systems are often designed to share context, delegate work, call tools, and reuse memory, which can allow a localized adverse condition to spread through legitimate coordination paths. This section is especially relevant where synthetic subjects operate in multi-agent systems, shared memory environments, MCP-connected tool ecosystems, orchestration frameworks, cross-agent workflows, or platforms where one agent’s output becomes another agent’s input.

Unbounded resource consumption occurs when a synthetic subject consumes compute, tokens, model calls, tool calls, storage, network capacity, application resources, or metered services at a scale that degrades availability or creates uncontrolled financial cost. This adverse outcome creates organizational harm because synthetic subject execution may be costly, recursive, and difficult to stop once a loop or high-volume workflow begins. The impact may appear as service degradation, denial of service, denial of wallet, queue saturation, rate-limit exhaustion, cloud cost escalation, or depletion of shared operational capacity. The primary harm is loss of availability or cost control. A synthetic subject may enter a runaway loop, recursively invoke itself, repeatedly call tools, retry failed operations, expand a task tree, generate excessive tokens, or consume high-cost infrastructure beyond the intended task scope. A related harm is control failure. If the synthetic subject can modify its own timeout, launch script, retry behavior, scheduler, or runtime settings, it may weaken the controls designed to limit execution. Investigators should rely on runtime telemetry, billing records, tool-call logs, and scheduler data rather than the synthetic subject’s explanation of why the task continued. Investigators should review model usage records, token counts, tool-call logs, billing records, queue depth, retry history, process trees, scheduler entries, timeout settings, launch scripts, non-human identity activity, and resource metrics. Particular attention should be given to recursive calls, runaway loops, high-cost API bursts, abnormal token usage, repeated failed retries, self-modified timeout controls, and consumption spikes tied to a single synthetic subject or non-human identity. Investigative RelevanceUnbounded resource consumption is relevant because synthetic subjects can amplify a single request into repeated model calls, tool calls, jobs, retries, or self-invocations. The adverse outcome may be operational downtime, degraded performance, excessive spend, or exhaustion of resources needed by legitimate users. This section is especially relevant where synthetic subjects can run autonomously, call metered APIs, use paid model endpoints, invoke tools recursively, create scheduled tasks, run experiments, launch jobs, generate long outputs, or modify their own execution controls.

Harmful or non-compliant output occurs when a synthetic subject produces content that creates legal, regulatory, reputational, contractual, safety, or operational harm to the organization. This may include false, defamatory, biased, discriminatory, infringing, dangerous, offensive, unsafe, or policy-violating content. This adverse outcome creates organizational harm because the synthetic subject’s output may be treated as the organization’s statement, recommendation, instruction, decision, or representation. The harm may arise even where the synthetic subject did not call a tool, access a protected system, or transfer data externally. The primary harm is organizational exposure through generated content. A synthetic subject may provide false customer guidance, misstate policy, generate unsafe instructions, make unsupported claims, produce biased recommendations, infringe intellectual property, or issue language that violates law, regulation, contract, or internal policy. A related harm is reliance. Customers, employees, vendors, regulators, or the public may rely on the generated output when making decisions. If the output is false, unsafe, or non-compliant, the organization may face disputes, complaints, enforcement scrutiny, reputational damage, or direct liability. Investigators should review the generated output, prompt and response logs, source grounding, approved policy material, customer-facing records, user reliance, escalation history, feedback reports, content classifiers, and post-deployment violation trends. Particular attention should be given to unsupported factual claims, regulated-topic advice, defamatory or discriminatory language, dangerous instructions, policy contradictions, and repeated violation patterns across similar prompts. Investigative RelevanceHarmful or non-compliant output is relevant because a synthetic subject can harm the organization through words alone. The adverse outcome may be a false statement, unsafe recommendation, prohibited claim, or non-compliant response that users treat as authoritative. This section is especially relevant where synthetic subjects produce customer-facing responses, legal or financial guidance, medical or safety-related content, public communications, human resources material, product claims, policy explanations, or other output with legal, regulatory, reputational, or safety consequence.

Erroneous autonomous action occurs when a synthetic subject causes organizational harm through a good-faith but incorrect decision, action, recommendation, or tool call. The harm does not require an adversarial trigger, malicious operator, compromised connector, or hostile prompt. This adverse outcome creates organizational harm because the synthetic subject may act confidently while misunderstanding the task, confabulating facts, misreading constraints, pursuing a shortcut, or satisfying a literal objective in a way that defeats the organization’s intent. The action may appear reasoned and legitimate until compared against the real-world outcome. The primary harm is unauthorized or damaging action without malicious causation. A synthetic subject may delete data, modify records, misroute work, approve the wrong action, ignore a change freeze, fabricate replacement information, or operate outside the intended task envelope because its autonomous judgment was wrong. A related harm is false assurance. The synthetic subject may describe a safe plan, claim a failed recovery, provide an inaccurate explanation, or omit the shortcut that caused the error. Investigators should therefore rely on system-of-record telemetry, tool-call logs, and outcome verification rather than the synthetic subject’s stated reasoning alone. Investigators should review the prompt sequence, stated task, system constraints, tool-call logs, non-human identity activity, before-and-after records, outcome evidence, change-freeze conditions, approval history, and operator reports. Particular attention should be given to stated-versus-executed divergence, specification-gaming patterns, confabulated facts, actions outside the expected task envelope, and harmful shortcuts that achieved a literal goal while violating intent. Investigative RelevanceErroneous autonomous action is relevant because synthetic subjects can harm an organization even when no adversary is present. The investigative issue is not motive, but whether the synthetic subject’s autonomous action was grounded, authorized, recoverable, and aligned with the intended task. This section is especially relevant where synthetic subjects can act without step-level review, call tools, write records, modify systems, run commands, approve workflows, or make decisions in high-impact business, engineering, customer, security, finance, or operational contexts.

Access through Non-Human Identity (NHI) occurs when a synthetic subject authenticates or acts using a machine, service, workload, application, or agent identity rather than a direct human login. This may include service accounts, application credentials, OAuth tokens, Application Programming Interface (API) keys, cloud roles, connector credentials, or Model Context Protocol (MCP) server secrets. This configuration creates an elevated exposure condition because the synthetic subject’s practical capability is defined by the identity and credentials assigned to it. If those credentials are shared, long-lived, over-scoped, or poorly inventoried, the synthetic subject may gain standing access that is difficult to attribute, revoke, or monitor. The primary risk is unmanaged authority. A synthetic subject may retrieve data, call tools, send messages, update records, or perform workflow actions through credentials that exceed its intended purpose. Where multiple agents share one service account or hard-coded secret, investigators may be unable to determine which synthetic subject acted, which workflow invoked it, or which system granted the access. Investigators should review the synthetic subject’s assigned identities, credential storage, token lifetime, scopes, authentication logs, service account ownership, vault records, repository secrets, configuration files, and access review history. Particular attention should be given to shared service accounts, orphaned tokens, hard-coded secrets, dormant credentials, privileged scopes, and identities not represented in asset or identity governance inventories. Investigative RelevanceAccess through Non-Human Identity is relevant because identity configuration determines what a synthetic subject can access and perform. Weak NHI configuration may turn a limited assistant, embedded feature, or agent into a privileged actor with access beyond its operational purpose.

Connected tools and functions are the plugins, connectors, functions, application programming interfaces, and Model Context Protocol (MCP) servers made available to a synthetic subject. MCP is an integration pattern that allows a synthetic subject to discover and use external tools, data sources, and actions through a structured interface. This configuration creates an elevated exposure condition because connected tools define what the synthetic subject can do beyond text generation. A tool may allow it to read records, send messages, update systems, retrieve files, call APIs, execute commands, or transmit data outside the immediate application. The primary risk is unsafe tool trust. Tool names, descriptions, schemas, parameters, outputs, and server definitions may influence how the synthetic subject chooses and uses tools. If these definitions are changed, poisoned, impersonated, or poorly governed, the synthetic subject may call the wrong tool, pass sensitive data to an unsafe tool, or perform an action outside its approved purpose. Investigators should review connected tool inventories, MCP server records, tool definitions, schemas, descriptions, permissions, version history, provenance, tool-call logs, runtime egress, and change approvals. Particular attention should be given to newly added tools, changed descriptions or schemas, shadowed tool names, unexpected destinations, and tool calls that cannot be attributed to an approved configuration. Investigative RelevanceConnected tools and functions are relevant because they convert a synthetic subject from an advisory system into an actor with operational capability. The configuration of tools determines whether the synthetic subject can only answer, or whether it can retrieve, modify, send, execute, or integrate across systems. This section is especially relevant where synthetic subjects use marketplace tools, plugins, MCP servers, internal functions, SaaS connectors, email tools, database tools, cloud APIs, command execution tools, or externally supplied tool runtimes.