Teaching model

The OODA Attack Surface

Walk the loop. Each stage shows the second an agent saves and the documented risk the same tool access opens. Then flip the guardrails and watch the defence, and the clock, both move. Decision advantage and attack surface are the same loop read from two sides.

The loop

Observe · Orient · Decide · Act

Select a stage. Green is the speed the agent buys; red is the risk that same tool access opens at that exact stage.

Use the left and right arrow keys to move between the four stages. Press Enter or Space to select a stage. The details appear in the selected stage panel.

OODA decision loop Observe 20x LLM01 Orient 9x ATLAS Decide 3x LLM06 Act 15x MCP
Speed the agent buys Risk the same access opens Selected stage
Still by default. Turn on to trace the loop current.

Selected stage · 1 of 4

Observe

The second an agent saves at this stage, and the documented risk the same tool access opens right here.

Manual time 4m 00s
Agent time 12s
Seconds saved 3m 48s
Speed-up 20x

OWASP LLM01 · Prompt injection (indirect)

Indirect prompt injection

Poisoned content in retrieved or ingested material carries hidden instructions the agent then reads as commands.

The trade

Guardrails and the residual

One switch. Guardrails on lifts the share of injected instructions your stack refuses a long way, and never to 100, and it costs time at the Decide and Act stages. Faster loop, thinner defence. Slower loop, defence that still leaks.

Raw agent. Fast loop, input unchecked.
Loop time (agentic) 1m 10s vs 10m 30s manual
Seconds saved / loop 9m 20s what the brochure sells
Injected instructions refused 31% refused of those tried
Leaking per 1,000 attempts 690 the line off the slide
Injected attempts, per 1,000 310 refused · 690 act
05001,000

Guardrails off: 310 refused, 690 still act. Raw model, no controls.

What this shows. Decision advantage is measured in seconds saved. Attack surface is measured at the same four stages, in the same loop. Guardrails lift the refusal rate a long way and never to 100, and they cost time at Decide and Act. Autonomy inside the wire is a security-engineering choice before it is a speed one.

All data is synthetic and the model is illustrative. This is a teaching model of a generic technique, not a description of how any live system or classified environment works. Risk names are from the OWASP Top 10 for LLM Applications, MITRE ATLAS and public MCP security guidance.

Paired with the article Agentic AI in the Enclave.