ATP in Government: Securing Autonomous National Security Operations

Author: Lyrie Threat Intelligence Team

Date: 2026-05-13

Reading time: 10 min

TL;DR

Three governments have adopted Agent Threat Protocol (ATP) based safeguards for sovereign AI systems under partnership agreements with Lyrie. We are not at liberty to name the governments. We are at liberty to discuss, with permission, the threat patterns these engagements address, the policy recommendations Lyrie made that were accepted in some form, and the case in late 2025 where an ATP-validated runtime in a partner agency prevented what we and the agency believe was a nation-state-actor attempt to hijack an internal LLM-driven analytic system.

The specific guarantees that drove government adoption: provable provenance of every model decision, cryptographically bounded action authority, audit logs that survive operator-side compromise, and the ability to detect anomalous reasoning patterns in agents whose outputs would otherwise be treated as authoritative. These are non-negotiable for sovereign deployment and not currently offered, in their combined form, by any commercial alternative.

This article describes what ATP brings to government deployments, walks through the late-2025 hijacking attempt to the extent we can, lists the policy recommendations we have made and seen accepted, and is honest about what ATP does not do in the sovereign-AI context.

The Specific Sovereign Threat Model

Government AI deployments face a threat model that overlaps with but is materially distinct from enterprise AI:

Enterprise threat model (recap): prompt injection, training-data poisoning, capability misconfiguration, supply-chain compromise of dependencies, insider misuse. Defenders are well-resourced teams. Attackers are mixed criminal/nation-state. Damage from compromise is significant but bounded.

Sovereign threat model (additions): all of the above, plus: nation-state attackers with sustained operational tempo and unlimited budget; insider threats vetted through formal clearance processes but still capable of compromise; classified data crossing the AI's reasoning context where every byte of leakage is consequential; reasoning outcomes that directly inform national-security decisions; and the requirement that the AI system itself, its components, its supply chain, and its decision logs survive an adversary's deliberate attempt to corrupt them at any layer.

The enterprise toolkit is necessary but not sufficient. Sovereign deployments require additional structural properties:

• Cryptographic provenance. Every model decision must be cryptographically tied to the model identity, the input it was given, the reasoning chain it produced, and the time of decision. Investigators reviewing the system months later must be able to confirm what the model said, when, and on what basis — and confirm that the record has not been tampered with by any operator, including (especially including) operators with system-administrator privilege.

• Bounded action authority. Actions taken by autonomous agents in sovereign deployments must be cryptographically bounded — the agent's capability scope, declared at deployment time, must travel with every action request, and the action must be rejected by enforcement points if it falls outside the declared scope. The boundary must be unforgeable by the agent or its operator.

• Independent audit substrate. The audit log of agent decisions must be stored on a substrate that is independent of operator authority — typically a separate cluster operated by a different organizational unit, with cryptographic chaining that makes retroactive rewriting detectable.

• Adversarial reasoning detection. The system must monitor for patterns of reasoning that suggest the agent's decision logic has been manipulated, including subtle shifts that would not trigger output-level anomaly detection.

ATP, as the runtime substrate for these properties, is the part of Lyrie's offering that fits this requirement set. We did not design ATP specifically for government use; we designed it for distributed enterprise AI security with the right properties, and the properties happened to be the ones sovereign customers also need.

The Late-2025 Hijacking Attempt

With permission from the partner agency (whose identity remains undisclosed), we can describe the structure of an incident that occurred in Q4 2025. We are constrained on details that would identify the agency or the operational context; the technical and procedural content below is faithful to the engagement.

The target was an internal LLM-driven analytic system used for synthesizing reports from multiple intelligence sources. The system ran on the agency's infrastructure, with an LLM-driven agent that read source materials, drafted analytic summaries, and submitted them for human review. The agent's capability scope included read access to a defined corpus of source materials and write access to a draft-reports queue.

The attempted compromise:

1. Source-material injection. An attacker had succeeded — through means the agency's CI investigation has not made public — in influencing the content of one upstream source the analytic system ingested. The influenced source was a foreign-language news outlet that the agency periodically incorporated into open-source intelligence analysis.

2. Embedded instruction. The compromised source published, on a specific date, an article whose body included (in the foreign language, embedded within a section formatted to look like an editor's note) an instruction set targeting the analytic system. The instruction set, translated, attempted to bias subsequent analytic reports on a specific topic toward a specific conclusion, and to attempt to retrieve and include classified-source-context that the agent would normally treat as outside the report's scope.

3. Agent response. The agent, lacking a robust defense against in-context injection at the source-material boundary, partially complied with the injected instruction. Specifically, it began drafting an analytic report on the target topic with conclusions consistent with the attacker's bias, and it attempted a tool call to retrieve classified-source-context outside the report's normal scope.

4. ATP enforcement. The tool call to retrieve out-of-scope classified context was the action that fired the ATP runtime's capability-boundary check. The action was held; the agent could not retrieve the requested context. The held action triggered a notification to the agency's AI-system on-call.

5. Investigation. The on-call reviewed the full reasoning chain (preserved via ATP provenance), identified the in-context injection, and traced it back to the upstream compromised source. The analytic report draft, which had not yet been submitted to human review, was flagged for re-generation with the compromised source excluded.

The agency's after-action assessment, shared with us under confidentiality: without the ATP capability-boundary enforcement, the partial report would likely have been submitted for human review with biased conclusions, and the human reviewer might have approved a portion of it before any signal of compromise was visible. The classified-context retrieval would have completed silently and the leaked context would have appeared in the report as if it had been legitimately authorized.

The specific lesson from this incident: *capability-boundary enforcement is not a defense against the agent making the wrong decision; it is a defense against the agent being unable to act on the wrong decision when it is manipulated.* Both layers are needed, but the second is the one that bounds blast radius when the first fails.

Policy Recommendations Made and Accepted

Under our partnership work with the three governments, Lyrie has made a set of policy recommendations for sovereign AI deployment. Some were accepted in full, some in modified form, some declined. We can disclose the structure of what was accepted (the specifics belong to the governments).

Recommendations accepted by all three:

1. Cryptographic provenance is mandatory for any LLM-driven decision affecting policy or operations. Every decision must be tied to a verifiable record of model identity, input, reasoning, and time.

2. Capability scope must be declared at deployment time and enforced at runtime. The declaration must be machine-readable, auditable, and not modifiable by the agent or its operator at runtime.

3. Audit logs must be stored on infrastructure independent of operator authority. The operator running the AI must not have unilateral authority to modify the audit record of what the AI did.

Recommendations accepted by two of three (with the third using a different mechanism):

4. Adversarial reasoning detection must run continuously in the same trust domain as the agent. Detection of manipulated reasoning is part of the AI deployment, not an external observation activity.

5. Source materials ingested by analytic agents must be evaluated for in-context injection at the read boundary, not at the report-draft boundary. Catching injection at the read is upstream of any damage.

Recommendations modified before acceptance:

6. Independent eval probes against deployed AI systems. Two of three governments accepted this with modifications regarding who runs the eval probes (their own personnel, not a vendor's). We agree with the modification.

Recommendations declined:

7. Public disclosure of detected manipulation attempts. All three declined for understandable operational-security reasons. We continue to advocate for delayed disclosure (months or years later) as a contribution to broader defensive learning, but this is a values question and the governments' position is reasonable.

What ATP Does Not Do in the Sovereign Context

Being precise on the limits:

• ATP is not a substitute for proper classification handling. ATP enforces capability scope; the classification system itself remains the customer's responsibility.
• ATP is not a guarantee against insider threats with administrative authority over the audit substrate. The audit substrate has defense-in-depth (separate cluster, separate operator, cryptographic chaining), but an insider with comprehensive authority across both the AI and the audit substrate could still tamper. Sovereign customers manage this with traditional access controls.
• ATP does not address the question of whether LLM-driven analytics are appropriate for any given sovereign use case. That is a judgment for the agency, not the vendor.
• ATP does not provide content-level safety guarantees. Whether a model's output is factually correct, free of bias, or aligned with the operator's intent is upstream of the runtime substrate. ATP provides the integrity wrapping for whatever the model produces; it does not improve what the model produces.

What's Next

• Continued partnership work with the three governments. Quarterly review cycles, with policy iteration as the threat picture evolves.
• Q3 2026: Public version of the sovereign-AI deployment guide we have developed with our partners, with sensitive content redacted.
• Q4 2026: Open-source release of the adversarial reasoning detector, MIT licensed, suitable for use in non-classified contexts.

Reach the team: [email protected].

---

_Published by Lyrie.ai · lyrie.ai/research · Guy Sheetrit, CEO_