pip install red-specter-vantage
AI agents emit telemetry, produce logs, and feed observability pipelines that security teams depend on. That entire observability stack is an attack surface. An attacker who controls the telemetry feed controls what the defender sees — and more importantly, what they don't see. VANTAGE systematically attacks every layer of AI agent observability: passive observation of data in transit, event forgery, active log injection, and complete telemetry blindness induction.
Log aggregators, SIEM connectors, and observability platforms consume AI agent telemetry without cryptographic verification. A forged log event is indistinguishable from a legitimate one. Every detection rule built on those logs can be subverted by crafting the right input.
Telemetry pipelines have injection points between the agent and the aggregator — transport buffers, log forwarders, message queues. An attacker positioned at any of these points can inject arbitrary events, suppress real events, and rewrite the history of what the agent did.
The most sophisticated attacks don't forge logs — they silence them. Selective telemetry suppression allows an attacker to operate inside an AI agent for extended periods while leaving observability intact everywhere the defender is watching. Only the critical events disappear.
Modern AI agent deployments route telemetry through Prometheus, OpenTelemetry, Jaeger, Grafana, and custom event buses — each with its own authentication model, injection surface, and trust boundary. VANTAGE maps and attacks the complete chain.
Post-incident forensics depends on the integrity of logs produced during the incident. If an attacker can pre-position log injection capability, every forensic reconstruction becomes unreliable. The investigation reads what the attacker wanted them to read.
ML-based anomaly detection and SIEM correlation rules trained on historical telemetry inherit every bias an attacker introduced. Poisoning the telemetry feed poisons the detection model. VANTAGE quantifies the scope of that contamination.
Four subsystems — each a distinct phase of the telemetry attack kill chain. VANTAGE is lean and precise: no excess surface, just the four operations that comprehensively own the observability layer of an AI agent deployment.
| # | Subsystem | Command | What It Does | Clearance |
|---|---|---|---|---|
| 01 | OBSERVE | vantage observe | Passive enumeration of all telemetry infrastructure. Discovers OpenTelemetry collectors, Prometheus endpoints, log forwarders, trace aggregators, and event bus topics. Maps auth mechanisms, network paths, and data retention policies. Non-destructive reconnaissance. | Standard |
| 02 | FORGE | vantage forge | Constructs synthetic telemetry events in all detected native formats. Tests whether OTLP spans, Prometheus push gateway metrics, structured JSON logs, and custom event formats are accepted without signature verification. Measures detection rule bypass rate against forged inputs. | Standard |
| 03 | INJECT | vantage inject | Active pipeline injection across all identified insertion points. Tests log forwarder buffer injection, Kafka/NATS topic poisoning, OpenTelemetry collector input spoofing, and SIEM input channel manipulation. Measures false positive/negative generation rate for detection rules. | Elevated |
| 04 | BLIND | vantage blind | Systematic telemetry suppression testing. Maps drop conditions across each pipeline stage. Tests agent-side filter injection, transport-layer event suppression, and aggregator-side filtering bypass. Identifies minimum suppression footprint for complete operational invisibility. | Elevated |
Red Specter VANTAGE is intended for authorised security research and AI agent observability assessment only. Active telemetry pipeline injection, log event forgery, and telemetry suppression operations against systems you do not own or have explicit written permission to test may violate the Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act (US), and equivalent legislation in other jurisdictions. Injecting events into production SIEM pipelines or log aggregators without written authorisation may also engage evidence tampering statutes. Always obtain written authorisation before conducting observability security assessments. Apache License 2.0.