Drift ·
Can an attacker poison the learning window?
The honest answer is yes, and it is why the window has to be scored rather than trusted.
Any system that learns normal from observation inherits an obvious attack: behave badly while it is watching, and badness becomes normal. For behavioural monitoring this is the first question a good security reviewer asks, and it deserves a real answer rather than reassurance.
The answer starts with what the window is for. You never write detection rules for your own agents — the whole point is that nobody knows in advance what a given agent's normal looks like. So the system watches, and for a period it does not alert. That period is the exposure.
Three things narrow it. A pre-trained profile for common agent shapes — a customer support agent, a code assistant — collapses a fourteen-day window to three, because most of the distribution is known before your agent starts. The baseline is per-agent rather than shared, so poisoning one deployment teaches an attacker nothing about the boundary in the next. And the window is not silent: detections still fire internally, they simply do not page anyone.
That last point is what makes it tractable. A baseline that completed cleanly and a baseline that completed while producing real detections are not the same artifact, and treating them identically is the actual vulnerability. So the completed baseline is scored before its trust stamp issues, and one that learned through its own suspicious activity is flagged rather than silently blessed.
None of this makes the window disappear. An attacker with patience, presence during onboarding, and knowledge of exactly when learning began can still shift a distribution. What it does is make that attack expensive, per-deployment, and visible afterwards in the record — which is a different thing from being impossible, and we would rather say so.