Autonomous security agents increasingly depend on logs, application responses, threat intelligence, tickets, telemetry, and other environmental data to make decisions. But much of this evidence can be attacker-controlled or attacker-influenced. This session demonstrates how manipulated evidence can alter an autonomous security agent's investigation and decisions, and explores a practical approach for incorporating provenance, trust, corroboration, and uncertainty into agentic security workflows.