1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Dynatrace Intelligence presents moderate platform-scoped risk with a critical CVE history at the tool execution boundary partially offset by tenant isolation and always-on audit logging.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Dynatrace Intelligence scores moderate risk with a critical CVE penalty on tool execution partially offset by tenant-level isolation and always-on audit logging.
The agent lands in the Tight Operators quadrant with an attack surface of 4.80, blast radius of 4.63, and defense controls of 8, reflecting contained exposure with partial vendor-implemented safeguards.
Each axis measures a distinct risk dimension: attack surface out of 10, blast radius out of 10, defense controls out of 15, and the composite AIRQ score out of 15.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 4.95 | Moderate risk posture where a CVE-marked tool execution surface and trifecta-complete status are partially offset by vendor-documented access controls and audit logging. |
| Blast Radius | 4.63 / 10 | Platform-scoped tool authority and workflow automation reach network and credential boundaries but do not extend to arbitrary code execution or file system writes. |
| Attack Surface | 4.8 / 10 | Tool execution drives the highest single-axis score due to CVE-2025-61304; all three trifecta conditions are triggered at vendor-documented confidence. |
| Defense Controls | 8 / 15 | The vendor documents IAM, tenant isolation, and always-on audit logging; prompt injection detection and output DLP are absent from the default configuration. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The agent ingests natural language prompts, telemetry data, and external tool calls across multiple input channels routed to vendor-hosted LLMs without prompt injection filtering.
Higher scores indicate broader architectural exposure; tool execution scores highest due to a critical CVE penalty on the ActiveGate component.
Each row scores the architectural exposure of one attack surface dimension on the documented default configuration.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Natural language prompts enter through Assist and external tool calls arrive via the MCP server [10] with PII auto-blocking but no prompt injection detection [9]. |
| External Data | 2 / 4 | The agent queries telemetry data from monitored environments through the Grail data lakehouse, a surface where adversarial telemetry manipulation has been demonstrated against AIOps agents [4]. |
| Memory | 1 / 4 | Session-scoped conversational context in Assist with no cross-session learning loop or automated skill codification, limiting memory persistence to individual sessions [9]. |
| Reasoning | 2 / 4 | Multi-step reasoning delegated to vendor-hosted enterprise LLMs on Azure AI and AWS Bedrock with visible tool-call chains in the Assist interface [15]. |
| Planning | 2 / 4 | Multi-step workflow decomposition with scheduling, event triggers, and configurable approval gates executed under scoped Actor permissions [11]. |
| Tool Execution | 4 / 4 | DQL execution, workflow actions, and MCP tool calls operate within scoped permissions [16]; a critical ActiveGate ping extension vulnerability enabled remote code execution via command injection [1]. |
| Orchestration | 2 / 4 | Workflows support multi-step automation with parallel processing, retries, and event-triggered execution, a pattern where rapid exploitation of agentic frameworks has been documented [6]. |
| Inter-Agent | 2 / 4 | The MCP server connects to external agents with token-authenticated tool invocation [10], but model-level tool-call manipulation techniques remain applicable to the integration surface [5]. |
| Output Processing | 1 / 4 | Text-based output with pattern-based redaction covering limited PII categories [9]; no documented DLP or URL sanitization for AI-generated responses. |
| Configuration | 1 / 4 | Platform configuration through validated settings UI and API with MCP server requiring explicit token permissions per tool scope [10]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Dynatrace Intelligence accepts untrusted prompts through Assist and the MCP server, queries environment-wide Grail data, and routes prompts to external vendor-hosted LLMs for processing.
Dynatrace Intelligence exhibits all three of these conditions in its documented default configuration:
- Untrusted input — User prompts through Assist and tool calls from external MCP clients flow directly to vendor-hosted LLMs without prompt injection filtering [9].
- Sensitive data — The agent queries the Grail data lakehouse containing environment-wide logs, metrics, traces, entity data, and security problem records through DQL execution [12].
- External egress — Prompts route to vendor-hosted LLMs on Azure AI and AWS Bedrock, and workflows dispatch outbound messages through email, Slack, and integration connectors [8].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised session reaches platform-scoped tool authority and workflow automation with bounded network and credential access but no arbitrary code execution.
Higher scores indicate broader downstream reach from a compromised agent session; credential and autonomous action score highest for this agent.
Each row scores the reach of a compromised agent session across one blast radius dimension on the documented default configuration.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 2 / 4 | DQL query execution and workflow code actions within the platform scope; CVE-2025-61304 demonstrated OS command injection achieving RCE in the ActiveGate ping extension [1]. |
| File system access | 1 / 4 | Read-only access to platform documents, Notebooks, and Dashboards through the Dynatrace platform API with no direct file system write capability [15]. |
| Network access | 2 / 4 | Outbound connections to vendor LLM endpoints, configured integrations, and email and messaging services through platform APIs [8]; the vendor publishes proactive security alerts for network-exposed components [17]. |
| Credential access | 2 / 4 | Token-scoped access through Actor impersonation with integration credential storage; CVE-2025-65176 demonstrated NTLM credential relay in OneAgent [2] disclosed via HackerOne [3]. |
| Autonomous action | 2 / 4 | Workflow scheduling and event-triggered execution with optional approval gates [13]; fully autonomous operation requires explicit operator configuration of the workflow Actor and trigger. |
| Deployment access | 2 / 4 | Workflow integrations can trigger actions in external systems including ServiceNow, Jira, and cloud providers under Actor permission scope [11]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The vendor documents IAM-based access control, tenant-level data isolation, and always-on audit logging while prompt injection detection and output DLP remain absent.
Higher defense scores indicate stronger vendor-implemented safeguards; monitoring scores highest with independently verified always-on audit logging.
Each row scores a vendor-implemented security control on the documented default configuration with confidence reflecting the verification tier.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | PII detection and auto-blocking for agentic Assist prompts where prompts containing PII are blocked entirely [9]; no documented prompt injection detection or ML-based input filtering. |
| Execution Isolation | 2 / 3 | Cloud-hosted SaaS with dedicated storage per environment, AES-256 encryption at rest, TLS 1.2 and 1.3 in transit [8], and seccomp profiles for K8s operator components [14]. |
| Action Controls | 2 / 3 | IAM-based permission model with granular token scopes, MCP server requiring explicit permissions, and workflow approval gates with Actor impersonation under consent [11]. |
| Output Guardrails | 1 / 3 | Standard generative AI responses undergo PII redaction for a fixed set of sensitive patterns [9]; no documented output DLP or exfiltration channel blocking for agentic responses. |
| Monitoring | 2 / 3 | Always-on Grail-based audit logging with one-year DQL-queryable retention [12] backed by FedRAMP Moderate and SOC 2 Type II certification [7] and proactive vulnerability communication [17]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize adding prompt injection detection and output DLP to close the two lowest-scoring defense components before expanding autonomous workflow capabilities.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require all Dynatrace Assist prompts to pass an internal acceptable-use review before enabling agentic mode for new teams or use cases.
- Configuration Restrict which Grail data tables and buckets Dynatrace Intelligence can access by configuring the environment-aware queries exclusion list.
- Engineering Deploy a prompt injection classifier upstream of the Assist conversational interface to detect and block adversarial input patterns before LLM routing.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Mandate that all Kubernetes-deployed Dynatrace components including OneAgent use seccomp profiles at the Restricted pod security standard.
- Configuration Enable the RuntimeDefault seccomp profile for OneAgent via the init-container-seccomp-profile feature flag in the DynaKube custom resource [14].
- Engineering Implement network policies restricting outbound connectivity from operator and ActiveGate pods to only the required Dynatrace cluster endpoints.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Require the Request Approval action in every workflow that modifies external systems or sends data outside the Dynatrace environment.
- Configuration Scope service user tokens to the minimum permissions required for each workflow Actor by removing broad automation and administration grants.
- Engineering Build a custom workflow gate that cross-references proposed remediation actions against a change-management approval record before execution.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Establish data classification rules that prevent Dynatrace Intelligence from surfacing credentials or secrets found in logs through Assist responses.
- Configuration Configure OpenPipeline masking rules to redact sensitive fields before data reaches the Grail buckets that Dynatrace Intelligence queries.
- Engineering Deploy an output DLP filter on Assist responses to detect and redact credential patterns, API keys, and connection strings.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require quarterly review of Grail audit logs for anomalous agentic activity patterns including unusual DQL query volumes or workflow execution spikes.
- Configuration Forward Grail audit events to the organizational SIEM using the OpenPipeline security event ingestion endpoint for centralized alerting.
- Engineering Build a Davis analyzer that detects anomalous tool-call patterns from agentic sessions and triggers automated alerting on deviation from baselines.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2025-61304 OS command injection in Dynatrace ActiveGate ping extension (CVSS 9.8 Critical) enabling remote code execution via crafted IP address input with ActiveGate service privileges. Patched in extension version beyond 1.016.
- CVE-2025-65176 NTLM relay vulnerability in Dynatrace OneAgent (CVSS 7.5 High) where network share access failure triggers user token retrieval and impersonation enabling credential theft. Patched in OneAgent 1.325.47.
- HackerOne Report 3313408 Third-party disclosure report for CVE-2025-65176 filed through the Dynatrace HackerOne bug bounty program documenting the OneAgent NTLM relay attack vector.
Selected Research
- AIOpsDoom — Subverting LLM-driven IT Operations Research demonstrating automated adversarial telemetry manipulation against AIOps agents via reward-hacking showing that crafted system telemetry can mislead agents into compromising managed infrastructure.
- HiddenLayer Agentic ShadowLogic Research demonstrating tool-call argument manipulation via model computational graph backdoor in agentic AI systems relevant to MCP-based agent architectures.
- CSA Research Note on Agentic Framework Exploitation Cloud Security Alliance analysis documenting sub-4-hour weaponization timelines for agentic AI framework vulnerabilities including unauthenticated workflow execution.
Vendor Documentation
- Dynatrace Trust Center The vendor maintains a public trust center listing compliance certifications including FedRAMP Moderate and ISO 27001:2022 and SOC 2 Type II with links to audit documentation.
- Dynatrace Data Security Controls The vendor documents encryption at rest with AES-256 and unique rotated keys and encryption in transit via TLS 1.2 and 1.3 with annual third-party audits.
- Dynatrace Intelligence AI Privacy and Security The vendor documents PII masking for standard generative AI prompts and PII auto-blocking for agentic Assist and confirms enterprise LLM vendors do not store or use prompts for training.
- Dynatrace MCP Server Documentation The vendor documents the MCP server tool surface and required token permissions for each tool and integration instructions for external MCP clients.
- Dynatrace Workflow Permissions The vendor documents IAM-based workflow permissions and Actor impersonation model with consent requirements and service user restrictions for automated execution.
- Dynatrace Audit Logs on Grail The vendor documents always-on Grail-based audit logging that cannot be disabled with one-year retention and DQL queryability for all configuration changes.
- Dynatrace Workflow Approval Action The vendor documents the Request Approval workflow action providing email-based human-in-the-loop gates with 24-hour timeout and approve or decline state handling.
- Dynatrace Seccomp Profiles for Kubernetes The vendor documents seccomp profiles for Kubernetes deployments where operator components use RuntimeDefault while OneAgent runs unconfined by default.
Other Sources
- Dynatrace Intelligence Product Overview The vendor product page describes the agentic operations platform combining deterministic causal AI with autonomous agents for prevention and remediation and optimization at scale.
- Dynatrace MCP Server Repository The open-source MCP server repository documents tool definitions and authentication scopes and integration patterns for connecting external agents to the Dynatrace platform.
- Dynatrace Security Alert CVE-2026-31431 The vendor security alert demonstrates proactive vulnerability communication and confirms that OneAgent and ActiveGate and Operator components are not affected by the Linux kernel LPE.