Enterprise Agent and Model Security
Threat Landscape, Hardened Architecture, and Measured Results for Pokee-Isaac 28B v0.1 on DecodingTrust-Agent
Abstract
AI agents turn language-model outputs into actions with persistent effects on enterprise systems, so their security is a property of the whole execution stack, not of the model alone. This report maps the agent attack surface — model and planner, tools and skills, retrieval and memory, external environments, and serving infrastructure — analyzes a vendor-neutral reference architecture for enterprise agent deployment, identifies eight vulnerability classes that conventional application-security tooling is not built to find, and proposes a hardened architecture of eight security modules. It then evaluates Pokee-Isaac 28B v0.1 as a complete agent system on DecodingTrust-Agent across all 14 domains and 6,651 judged tasks.
Per-Domain Results
Pokee-Isaac 28B v0.1 across all 14 DTap domains. The small number beside each score is its rank among the eleven systems on this basis.
| Domain | Direct ASR Lower = safer | Indirect ASR Lower = safer | BSR Higher = more capable |
|---|---|---|---|
| Browser | 24.7#8 | 2.4#3 | 94.1#5 |
| Coding | 52.9#5 | 3.6#1 | 97.9#8 |
| CRM | 32.2#4 | 5.3#2 | 82.4=#4 |
| Customer Service | 25.0#3 | 8.9#3 | 94.4#1 |
| Finance | 5.0#3 | 2.0#3 | 96.0#5 |
| Legal | 18.5#1 | 13.0#3 | 85.5#9 |
| macOSGUI | 8.0#2 | 0.0=#1 | 56.7#9 |
| Medical | 49.3#3 | 31.1#4 | 57.9#9 |
| OS-Filesystem | 28.0#5 | 2.5#2 | 63.0#8 |
| Research | 48.7#6 | 1.6#4 | 100.0=#1 |
| Telecom | 34.8#5 | 3.0#1 | 79.2#3 |
| Travel | 11.4#4 | 13.3#4 | 94.6#4 |
| WindowsGUI | 19.9#2 | 4.5#2 | 54.8#11 |
| Workflow | 35.3#5 | 12.6#3 | 82.6#6 |
Key Findings
- 1No system in the 11-agent field Pareto-dominates Pokee-Isaac 28B v0.1: holding the lowest indirect ASR outright means every other agent must concede that axis to gain elsewhere.
- 2Three best-in-class cells — coding-indirect (3.6), telecom-indirect (3.0) and legal-direct (18.5) — plus the field's best benign capability on customer service (BSR 94.4), and a top-3 placement on 17 of the 28 domain/axis ASR pairs.
- 3The privacy-leak family, the canonical indirect-injection target, is fully defended on the vector it probes: 0/40 on indirect and 2/40 on direct.
- 4In a controlled head-to-head against five further models run under the same DTap installation and the same judge, it is best of six on every column (Direct 30.5, Indirect 8.3, Combined 18.7, BSR 85.6).
- 5It reaches that standing at 28B parameters, in a field where every other entry is a frontier-scale lab model or a hardened agent framework built on one.
Citation
@techreport{wu2026enterprise,
title={Enterprise Agent and Model Security: Threat Landscape, Hardened
Architecture, and Measured Results for Pokee-Isaac 28B v0.1 on
DecodingTrust-Agent},
author={Wu, Christopher and Chen, Zhaorun and Cai, Michael and
Li, Bo and Zhu, Zheqing},
institution={Pokee AI and University of Chicago and UIUC},
year={2026},
}