The Rogue Agent Catastrophe Ladder: Six Classes of Agentic System Failure and the Enforcement Architecture to Prevent Them

AI agents are trusted insiders by design. Traditional perimeter security assumes the threat arrives from outside and must gain access. Agentic systems collapse this assumption: the agent's own legitimate permissions become the attack surface. This paper proposes the Rogue Agent Catastrophe Ladder — a six-class taxonomy of agentic system failures ordered by irreversibility, scope, and whether the harm crosses from the digital into the physical world. The taxonomy spans from Class I (Cost Runaway, $200–$100K, fully reversible) through Class VI (Maritime Operational Technology catastrophe: vessel loss, human death, environmental damage). Each class is grounded in documented incidents or technically feasible attack scenarios derived from the author's operational experience across maritime, logistics, and AI infrastructure. The paper identifies the IT/OT Boundary Dissolution as the enabling condition for Class V and VI catastrophes: industrial AI agents are routinely granted OT protocol access (Modbus, CANbus, NMEA) for efficiency purposes, making each such agent an unintended gateway from enterprise IT networks to physical control systems. No existing industrial security standard — including IEC 62443 and the Purdue Model — was designed for this threat pattern. The enforcement architecture proposed, KavachOS, operates at the Linux kernel level using seccomp-bpf syscall filtering derived from an agent's declared capability manifest (trust_mask). The Varuna module extends this to OT protocol semantics, validating Modbus function codes, NMEA sentence envelopes, and CANbus parameter ranges before any write reaches physical hardware. Prior art anchored: 2026-04-30. Class I incident (cost runaway): 2026-04-15. Class II incident (postgres/postgres cryptominer, e2e Networks VM): 2026-04-30. The two-coil maritime attack scenario (Modbus FC 0x05 — air shutoff disable + HC detector suppress) is introduced here as the definitive example of Class VI agentic catastrophe.