AI Agent Spawn Depth: Reported Parent Chains and Monitoring

What 1-SEC checks

Spawn handling computes a depth from reported agent/parent history, emits a new-agent observation, and increases severity when the computed depth exceeds three. It then records the parent relationship for subsequent events.

Read the implementation: handleAgentSpawn

Required telemetry and context

Relevant input events: agent_spawn, agent_created. Use a trusted producer at the real application boundary.

• agent_id
• parent_agent
• capabilities

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Emit parent relationships from a trusted scheduler before child actions. Review permitted fan-out, reconcile reported agents with the real orchestrator inventory, and enforce maximum depth and capabilities in that scheduler.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/aicontainment -run '^(TestAgentTracker_GetSpawnDepth|TestContainment_HandleEvent_AgentSpawn)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

func TestAgentTracker_GetSpawnDepth(t *testing.T) {
	at := NewAgentTracker()
	at.RegisterAgent("root", "")
	at.RegisterAgent("child1", "root")
	at.RegisterAgent("child2", "child1")

	// root -> child1 -> child2 -> grandchild = depth 4
	depth := at.GetSpawnDepth("grandchild", "child2")
	if depth != 4 {
		t.Errorf("GetSpawnDepth() = %d, want 4", depth)
	}
}

// ─── ToolIntegrityMonitor (MCP ASI04) ─────────────────────────────────────────

func TestContainment_HandleEvent_AgentSpawn(t *testing.T) {
	cp := makeCapturingPipeline()
	c := startedModuleWithPipeline(t, cp)
	defer c.Stop()

	ev := core.NewSecurityEvent("test", "agent_spawn", core.SeverityInfo, "agent spawned")
	ev.Details["agent_id"] = "child-agent-1"
	ev.Details["parent_agent"] = "parent-agent-0"
	ev.Details["capabilities"] = "file_read,file_write,network"
	ev.SourceIP = "10.0.0.3"

	if err := c.HandleEvent(ev); err != nil {
		t.Fatalf("HandleEvent() error: %v", err)
	}

	if cp.count() == 0 {
		t.Error("expected alert for agent spawn")
	}

	profile, ok := c.agentTracker.agents.Get("child-agent-1")
	if !ok {
		t.Error("expected spawned agent to be registered in tracker")
	}
	if profile.Parent != "parent-agent-0" {
		t.Errorf("parent = %q, want %q", profile.Parent, "parent-agent-0")
	}
}

Tuning, evaluation, and coverage limits

This is not a scheduler that refuses deep creation or prevents process forks. Missing ancestry, changed identities, late events, or bounded state can affect the calculated chain. A capabilities string is not a verified capability grant.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.