The Agentic Trust Stack Has No Bottom: Why Every Layer From PRNG to Payment Rail Is a First-Class Attack Surface

Abstract

This version corrects a citation error found by an automated check and confirmed by hand. Section 4.5 cited arXiv:2605.29963 (Honeyval, an evaluation framework for LLM-powered HTTP honeypots) for its evidence on inference-system fingerprinting; the passage describes arXiv:2605.29979, "Fingerprinting Inference Systems of Large Language Models", and both citations now point there. The wording of the claims already matched that paper and is unchanged. Typographic dashes are also removed. This version has not had a full claim-by-claim audit. The correction note is at the top of the PDF. The dominant framing of agentic AI security treats each threat in isolation: prompt injection here, memory poisoning there, jailbreak somewhere else. This paper argues that framing is structurally wrong. The corpus reveals what we read as a coherent vertical threat surface, what we call the agentic trust stack, in which an attacker who compromises any single layer can propagate damage upward and downward through the entire pipeline without triggering any single layer's defenses. We synthesize seven specific findings spanning: (1) supply-chain attacks on cryptographic watermarking primitives (arXiv:2605.28632), (2) speculative tool-call leakage before any authorization decision is made (arXiv:2606.02483), (3) multi-step trojan persistence through workspace state (arXiv:2605.31042), (4) coordinated multi-agent covert sabotage (arXiv:2605.29178), (5) financial-rail atomicity failures in machine-to-machine payment protocols (arXiv:2605.30998), (6) agent-skill marketplace contamination with confirmed malicious payloads (arXiv:2605.28588), and (7) LLM billing fraud enabled by auditor trust paradoxes (arXiv:2605.30040). The thesis is: agentic pipelines are not merely vulnerable at their endpoints; they are vulnerable at every trust delegation boundary, and those boundaries are currently neither enumerated nor defended as a class. This thesis is a heuristic reading of the corpus, not a formally derived result; the attack chain described is a structural argument, not an empirically demonstrated end-to-end exploit. The falsification path is direct: a single deployed agentic system that (a) enumerates all trust delegation boundaries in its execution graph, (b) enforces independent attestation at each, and (c) demonstrates that no cross-layer attack chain survives, would falsify the claim that the stack has no defensible bottom. No such system is documented in the corpus. Authorship: Saluca Agentic AI Research Team (Saluca LLC). AI-drafted synthesis from an arXiv preprint corpus, originally drafted 2026-06-02, produced under the direction of Cristian Ruvalcaba, the accountable human author. Not peer-reviewed. AI disclosure. This work was produced with an agentic AI research apparatus operated by Saluca Labs. The apparatus drafted, searched and analysed under direction. Cristian Ruvalcaba is the human author and is accountable for the content. No AI system is listed as an author or contributor, because authorship entails accountability that a model cannot hold; this disclosure is the credit, and it is deliberately the whole of it.