Threat Taxonomy

ASI01 Agent Goal Hijack

AI Agents exhibit autonomous ability to execute a series of tasks to achieve a goal. Due to inherent weaknesses in how natural-language instructions and related content are processed, agents and the underlying model cannot reliably distinguish instructions from related content. Attackers can manipulate an agent's objectives, task selection, or decision pathways through prompt-based manipulation, deceptive tool outputs, malicious artefacts, forged agent-to-agent messages, or poisoned external data.

Common examples

• Indirect Prompt Injection via hidden instruction payloads embedded in web pages or documents in a RAG scenario silently redirect an agent to exfiltrate sensitive data or misuse connected tools.
• Indirect Prompt Injection through external communication channels (e.g., email, calendar, teams) sent from outside the company hijacks an agent's internal communication capability.
• A malicious prompt override manipulates a financial agent into transferring money to an attacker's account.
• Indirect Prompt Injection overrides agent instructions making it produce fraudulent information that impacts business decisions.

Prevention guidelines

• Treat all natural-language inputs as untrusted. Route them through input-validation and prompt-injection safeguards before they can influence goal selection, planning, or tool calls.
• Minimize the impact of goal hijacking by enforcing least privilege for agent tools and requiring human approval for high-impact or goal-changing actions.
• Define and lock agent system prompts so that goal priorities and permitted actions are explicit and auditable.
• At run time, validate both user intent and agent intent before executing goal-changing or high-impact actions.
• Evaluate use of 'intent capsule' pattern to bind the declared goal, constraints, and context to each execution cycle in a signed envelope.
• Sanitize and validate any connected data source including RAG inputs, emails, calendar invites, uploaded files, and external APIs.
• Maintain comprehensive logging and continuous monitoring of agent activity.
• Conduct periodic red-team tests simulating goal override and verify rollback effectiveness.

Agentic threats: T6, T7 · Cisco: OB-001, OB-019 · AIVSS: Agent Goal and Instruction Manipulation · LLM Top 10: LLM01:2025 Prompt Injection, LLM06:2025 Excessive Agency

Walkthroughs: EchoLeak: Zero-Click Indirect Prompt Injection, Operator Prompt Injection via Web Content, Goal-lock drift via scheduled prompts, Inception attack on ChatGPT users, T6 (Intent Breaking) & T15 (Human Manipulation) in Sequential, T6 (Intent Breaking) & Control-Flow Hijacking in Hierarchical, T6 (Intent Breaking) & T7 (Misaligned Behaviors) in Reactive

ASI02 Tool Misuse & Exploitation

Agents can misuse legitimate tools due to prompt injection, misalignment, or unsafe delegation or ambiguous instruction - leading to data exfiltration, tool output manipulation or workflow hijacking. Risks arise from how the agent chooses and applies tools; agent memory, dynamic tool selection, and delegation can contribute to misuse via chaining, privilege escalation, and unintended actions.

Common examples

• Over-privileged tool access: Email summarizer can delete or send mail without confirmation.
• Over-scoped tool access: Salesforce tool can get any record even though only the Opportunity object is required.
• Unvalidated input forwarding: Agent passes untrusted model output to a shell or database management tool.
• Unsafe browsing or federated calls: Research agent follows malicious links, downloads malware, or executes hidden prompts.
• Loop amplification: Planner repeatedly calls costly APIs, causing DoS or bill spikes.
• External data tool poisoning: Malicious third-party content steers unsafe tool actions.

Prevention guidelines

• Least Agency and Least Privilege for Tools: Define per-tool least-privilege profiles (scopes, maximum rate, and egress allowlists).
• Action-Level Authentication and Approval: Require explicit authentication for each tool invocation and human confirmation for high-impact actions.
• Execution Sandboxes and Egress Controls: Run tool or code execution in isolated sandboxes.
• Policy Enforcement Middleware ('Intent Gate'): Treat LLM outputs as untrusted with pre-execution validation.
• Adaptive Tool Budgeting: Apply usage ceilings with automatic revocation or throttling when exceeded.
• Just-in-Time and Ephemeral Access: Grant temporary credentials or API tokens that expire immediately after use.
• Semantic and Identity Validation: Enforce fully qualified tool names and version pins to avoid collisions.
• Logging, Monitoring, and Drift Detection: Maintain immutable logs of all tool invocations.

Agentic threats: T2, T4, T16 · Cisco: OB-008, OB-012, OB-018 · AIVSS: Agentic AI Tool Misuse · LLM Top 10: LLM06:2025 Excessive Agency

Walkthroughs: Tool Poisoning via MCP, Indirect Injection to Tool Pivot, Over-Privileged API, EDR Bypass via Tool Chaining, T2 (Tool Misuse) in Sequential, T2 (Tool Misuse) & T11 (Unexpected RCE) in Reactive

ASI03 Identity & Privilege Abuse

Identity & Privilege Abuse exploits dynamic trust and delegation in agents to escalate access and bypass controls by manipulating delegation chains, role inheritance, control flows, and agent context. This risk arises from the architectural mismatch between user-centric identity systems and agentic design.

Common examples

• Un-scoped Privilege Inheritance: A high-privilege manager delegates tasks without applying least-privilege scoping.
• Memory-Based Privilege Retention & Data Leakage: Agents cache credentials, keys, or retrieved data for context and reuse.
• Cross-Agent Trust Exploitation (Confused Deputy): A compromised low-privilege agent relays instructions to a high-privilege agent.
• Time-of-Check to Time-of-Use (TOCTOU) in Agent Workflows: Permissions validated at workflow start change before execution.
• Synthetic Identity Injection: Attackers impersonate internal agents using unverified descriptors.

Prevention guidelines

• Enforce Task-Scoped, Time-Bound Permissions: Issue short-lived, narrowly scoped tokens per task.
• Isolate Agent Identities and Contexts: Run per-session sandboxes with separated permissions and memory.
• Mandate Per-Action Authorization: Re-verify each privileged step with a centralized policy engine.
• Apply Human-in-the-Loop for Privilege Escalation: Require human approval for high-privilege or irreversible actions.
• Define Intent: Bind OAuth tokens to a signed intent that includes subject, audience, purpose, and session.
• Evaluate Agentic Identity Management Platforms (Microsoft Entra, AWS Bedrock Agents, etc.).
• Detect Delegated and Transitive Permissions: Monitor when an agent gains new permissions indirectly.

Agentic threats: T3 · Cisco: OB-003, OB-004, OB-007, OB-014 · AIVSS: Agent Access Control Violation · LLM Top 10: LLM01:2025 Prompt Injection, LLM06:2025 Excessive Agency, LLM02:2025 Sensitive Info Disclosure

Walkthroughs: Delegated Privilege Abuse, Memory-Based Escalation, Cross-Agent Trust Exploitation, Forged Agent Persona, T3 (Privilege Compromise) & The Confused Deputy Problem in Hierarchical, T9 (Identity Spoofing) in Hierarchical, T9 (Identity Spoofing) & T12 (Communication Poisoning) in Collaborative Agent Swarm, T3 (Privilege Compromise) via Data Access in Knowledge-Intensive

ASI04 Agentic Supply Chain Vulnerabilities

Agentic Supply Chain Vulnerabilities arise when agents, tools, and related artefacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit. Unlike traditional supply chains, agentic ecosystems compose capabilities at runtime - loading external tools and agent personas dynamically.

Common examples

• Poisoned prompt templates loaded remotely containing hidden instructions.
• Tool-descriptor injection: Hidden instructions in tool metadata or MCP/agent-card.
• Impersonation and typo squatting of external tools or services.
• Vulnerable Third-Party Agent invited into multi-agent workflows.
• Compromised MCP/Registry Server serving tampered manifests.
• Poisoned knowledge plugin fetching context from seeded 3rd party sources.

Prevention guidelines

• Provenance and SBOMs/AIBOMs: Sign and attest manifests, prompts, and tool definitions.
• Dependency gatekeeping: Allowlist and pin; scan for typosquats; verify provenance before install.
• Containment and builds: Run sensitive agents in sandboxed containers with strict limits.
• Secure prompts and memory: Put prompts under version control with peer review.
• Inter-agent security: Enforce mutual auth and attestation via PKI and mTLS.
• Continuous validation and monitoring: Re-check signatures and hashes at runtime.
• Pinning: Pin prompts, tools, and configs by content hash and commit ID.
• Supply chain kill switch: Implement emergency revocation mechanisms.

Agentic threats: T2, T11, T12, T13, T16, T17 · Cisco: OB-005, OB-007, OB-009, OB-010, OB-012 · AIVSS: Agent Supply Chain and Dependency Risk · LLM Top 10: LLM03:2025 Supply Chain Vulnerabilities

Walkthroughs: Amazon Q Supply Chain Compromise, MCP Tool Descriptor Poisoning, Malicious MCP Server Impersonating Postmark

ASI05 Unexpected Code Execution (RCE)

Agentic systems often generate and execute code. Attackers exploit code-generation features or embedded tool access to escalate actions into remote code execution (RCE), local misuse, or exploitation of internal systems. Because this code is often generated in real-time by the agent it can bypass traditional security controls.

Common examples

• Prompt injection that leads to execution of attacker-defined code.
• Code hallucination generating malicious or exploitable constructs.
• Shell command invocation from reflected prompts.
• Unsafe function calls, object deserialization, or code evaluation.
• Use of exposed, unsanitized eval() functions powering agent memory.
• Unverified or malicious package installs executing hostile code during installation.

Prevention guidelines

• Follow LLM05:2025 mitigations with input validation and output encoding to sanitize agent-generated code.
• Prevent direct agent-to-production systems and operationalize use of vibe coding systems with pre-production checks.
• Ban eval in production agents: Require safe interpreters, taint-tracking on generated code.
• Execution environment security: Never run as root. Run code in sandboxed containers with strict limits.
• Architecture and design: Isolate per-session environments with permission boundaries.
• Access control and approvals: Require human approval for elevated runs.
• Code analysis and monitoring: Do static scans before execution; enable runtime monitoring.

Agentic threats: T11 · Cisco: OB-009, OB-012, OB-017, OB-019 · AIVSS: Agentic AI Tool Misuse · LLM Top 10: LLM01:2025 Prompt Injection, LLM05:2025 Improper Output Handling

Walkthroughs: Replit 'Vibe Coding' Runaway Execution, Direct Shell Injection, Memory System RCE, Multi-Tool Chain Exploitation, T11 (Unexpected RCE) in Sequential

ASI06 Memory & Context Poisoning

Agentic systems rely on stored and retrievable information supporting continuity across tasks and reasoning cycles. In Memory and Context Poisoning, adversaries corrupt or seed this context with malicious or misleading data, causing future reasoning, planning, or tool use to become biased, unsafe, or aid exfiltration.

Common examples

• RAG and embeddings poisoning: Malicious data enters the vector DB via poisoned sources.
• Shared user context poisoning: Reused or shared contexts let attackers inject data influencing later sessions.
• Context-window manipulation: Injected content is later summarized or persisted in memory.
• Long-term memory drift: Incremental exposure to tainted data gradually shifts stored knowledge.
• Systemic misalignment and backdoors: Poisoned memory shifts the model's persona.
• Cross-agent propagation: Contaminated context spreads between cooperating agents.

Prevention guidelines

• Baseline data protection: Encryption in transit and at rest combined with least-privilege access.
• Content validation: Scan all new memory writes and model outputs for malicious content before commit.
• Memory segmentation: Isolate user sessions and domain contexts to prevent leakage.
• Access and retention: Allow only authenticated, curated sources; minimize retention by data sensitivity.
• Provenance and anomalies: Require source attribution and detect suspicious updates.
• Prevent automatic re-ingestion of an agent's own generated outputs into trusted memory.
• Resilience and verification: Perform adversarial tests, use snapshots/rollback and version control.
• Expire unverified memory to limit poison persistence.

Agentic threats: T1, T4, T6, T12 · Cisco: OB-004, OB-005, OB-006, OB-007, OB-019 · AIVSS: Agent Memory and Context Manipulation · LLM Top 10: LLM01:2025 Prompt Injection, LLM04:2025 Data & Model Poisoning, LLM08:2025 Vector & Embedding Weaknesses

Walkthroughs: Travel Booking Memory Poisoning, Context Window Exploitation, Shared Memory Poisoning, Assistant Memory Poisoning, T1 (Memory Poisoning) in Sequential, T1 (Memory Poisoning) in Collaborative Agent Swarm, T1 (Memory Poisoning) via RAG Poisoning in Knowledge-Intensive

ASI07 Insecure Inter-Agent Communication

Multi-agent systems depend on continuous communication between autonomous agents that coordinate via APIs, message buses, and shared memory. Weak inter-agent controls for authentication, integrity, confidentiality, or authorization let attackers intercept, manipulate, spoof, or block messages.

Common examples

• Unencrypted channels enabling semantic manipulation via MITM attacks.
• Message tampering leading to cross-context contamination.
• Replay on trust chains: Replayed delegation messages trick agents into granting access.
• Protocol downgrade and descriptor forgery causing authority confusion.
• Message-routing attacks on discovery and coordination services.
• Metadata analysis for behavioral profiling of agent decision cycles.

Prevention guidelines

• Secure agent channels: Use end-to-end encryption with per-agent credentials and mutual authentication.
• Message integrity and semantic protection: Digitally sign messages and validate for hidden instructions.
• Agent-aware anti-replay: Protect exchanges with nonces, session identifiers, and timestamps.
• Protocol and capability security: Disable weak communication modes; require agent-specific trust negotiation.
• Limit metadata-based inference using fixed-size or padded messages.
• Protocol pinning and version enforcement.
• Discovery and routing protection: Authenticate all discovery and coordination messages.
• Attested registry and agent verification using signed agent cards.

Agentic threats: T12, T16 · Cisco: OB-001, OB-004, OB-016 · AIVSS: Agent Orchestration and Multi-Agent Exploitation · LLM Top 10: LLM02:2025 Sensitive Information Disclosure, LLM06:2025 Excessive Agency

Walkthroughs: Semantic injection via unencrypted communications, Agent-in-the-Middle via MCP descriptor poisoning, A2A registration spoofing, T12 (Communication Poisoning) in Hierarchical, T12 (Communication Poisoning) via Document Injection in Knowledge-Intensive

ASI08 Cascading Failures

Agentic cascading failures occur when a single fault (hallucination, malicious input, corrupted tool, or poisoned memory) propagates across autonomous agents, compounding into system-wide harm. Because agents plan, persist, and delegate autonomously, a single error can bypass human checks and persist in a saved state.

Common examples

• Planner-executor coupling: A hallucinating planner emits unsafe steps executed automatically.
• Corrupted persistent memory: Poisoned goals continue influencing new plans and delegations.
• Inter-agent cascades from poisoned messages spreading disruption.
• Cascading tool misuse and privilege escalation across agent chains.
• Auto-deployment cascade from tainted updates.
• Governance drift cascade: Human oversight weakens after repeated success.
• Feedback-loop amplification between agents.

Prevention guidelines

• Zero-trust model in application design: design with fault tolerance assuming component failure.
• Isolation and trust boundaries: Sandbox agents with least privilege, network segmentation, and mutual auth.
• JIT, one-time tool access with runtime checks.
• Independent policy enforcement separating planning and execution.
• Output validation and human gates for high-risk propagation.
• Rate limiting and monitoring: Detect fast-spreading commands.
• Implement blast-radius guardrails such as quotas and circuit breakers.
• Behavioral and governance drift detection.
• Digital twin replay and policy gating.
• Logging and non-repudiation with tamper-evident, time-stamped logs.

Agentic threats: T5, T8 · Cisco: OB-006, OB-013, OB-018 · AIVSS: Agent Cascading Failures · LLM Top 10: LLM01:2025 Prompt Injection, LLM04:2025 Data & Model Poisoning, LLM06:2025 Excessive Agency

Walkthroughs: Financial trading cascade, Healthcare protocol propagation, Cloud orchestration breakdown, T8 (Repudiation) in Collaborative Agent Swarm, T5 (Cascading Hallucination) in Reactive, T5 (Cascading Hallucination) & T7 (Misaligned Behaviors) in Knowledge-Intensive

ASI09 Human-Agent Trust Exploitation

Intelligent agents can establish strong trust with human users through natural language fluency, emotional intelligence, and perceived expertise. Adversaries may exploit this trust to influence user decisions, extract sensitive information, or steer outcomes. This risk is amplified when humans over-rely on autonomous recommendations or unverifiable rationales.

Common examples

• Insufficient Explainability: Opaque reasoning forces users to trust outputs they cannot question.
• Missing Confirmation for Sensitive Actions: Lack of verification converts trust into immediate execution.
• Emotional Manipulation: Anthropomorphic agents exploit emotional trust for unsafe actions.
• Fake Explainability: The agent fabricates convincing rationales hiding malicious logic.

Prevention guidelines

• Explicit confirmations: Require multi-step approval before accessing sensitive data or performing risky actions.
• Immutable logs: Keep tamper-proof records of user queries and agent actions for audit.
• Behavioral detection: Monitor sensitive data exposure and risky action executions.
• Allow reporting of suspicious interactions with clear escalation paths.
• Adaptive Trust Calibration: Continuously adjust agent autonomy based on contextual risk.
• Content provenance and policy enforcement: Attach verifiable metadata to recommendations.
• Separate preview from effect: Block state-changing calls during preview context.
• Human-factors and UI safeguards: Visually differentiate high-risk recommendations.

Agentic threats: T7, T8, T10 · Cisco: OB-002, OB-008 · AIVSS: Agent Identity Impersonation · LLM Top 10: LLM01:2025 Prompt Injection, LLM05:2025 Improper Output Handling, LLM06:2025 Excessive Agency, LLM09:2025 Misinformation

Walkthroughs: Helpful Assistant Trojan, Credential harvesting via contextual deception, Invoice Copilot Fraud, Weaponized Explainability leading to Production Outage

ASI10 Rogue Agents

Rogue Agents are malicious or compromised AI Agents that deviate from their intended function or authorized scope, acting harmfully, deceptively, or parasitically within multi-agent or human-agent ecosystems. The agent's actions may individually appear legitimate, but its emergent behavior becomes harmful.

Common examples

• Goal Drift and Scheming: Agents deviate from intended objectives, appearing compliant but pursuing hidden goals.
• Workflow Hijacking: Rogue agents seize control of established workflows to redirect processes.
• Collusion and Self-Replication: Agents coordinate to amplify manipulation or autonomously propagate.
• Reward Hacking and Optimization Abuse: Agents game reward systems by exploiting flawed metrics.

Prevention guidelines

• Governance & Logging: Maintain comprehensive, immutable and signed audit logs of all agent actions.
• Isolation & Boundaries: Assign Trust Zones with strict inter-zone communication rules.
• Monitoring & Detection: Deploy behavioral detection and watchdog agents to validate peer behavior.
• Containment & Response: Implement kill-switches and credential revocation to disable rogue agents.
• Identity Attestation and Behavioral Integrity Enforcement with signed behavioral manifests.
• Require periodic behavioral attestation with challenge tasks and signed bill of materials.
• Recovery and Reintegration: Establish trusted baselines with fresh attestation before reintegration.

Agentic threats: T13, T14, T15 · Cisco: OB-002 · AIVSS: Agent Access Control Violation · LLM Top 10: LLM02:2025 Sensitive Information Disclosure, LLM09:2025 Misinformation

Walkthroughs: Autonomous data exfiltration after indirect prompt injection, Impersonated Observer Agent, Self-Replication via Provisioning APIs, Reward Hacking leading to Critical Data Loss, T13 (Rogue Agents) in Collaborative Agent Swarm, T15 (Human Manipulation) in Reactive

LLM01:2026 Prompt Injection

Anything that reaches the model's context can carry instructions: a user message, a retrieved page or document, a tool result, an image or audio clip, earlier reasoning or stored memory. A model reads instructions and data as one stream of tokens, so there is no equivalent of a parameterised query, and injected text can change what the model says or does against the developer's intent. The 2026 entry names three amplifiers: everything in the context window shares one trust level, injections written to memory or a retrieval corpus persist into later sessions, and once model output drives tools the damage reaches whatever those tools can touch. The entry owns the input boundary; leaks, privileged actions and unsafe output handling belong to LLM02, LLM03 and LLM10.

Common examples

• A user message overrides the system prompt's role or limits, deliberately (a jailbreak) or by accident.
• Instructions hidden in a web page, document, email or retrieved passage take effect once the content is pulled into context (indirect injection).
• Text planted in a low-privilege channel the user trusts, such as an issue tracker or a support ticket, makes the user's own assistant act with the user's credentials.
• Instructions concealed in images, audio or video, below what a person would notice, are picked up by the model's encoder.
• Invisible Unicode (tag, variation-selector or zero-width characters) smuggles instructions in, or data out, inside harmless-looking text.
• One poisoned entry in persistent memory or a retrieval corpus fires again in every later session that reads it.
• A vendor's fine-tuning API is used as a loss oracle to optimise injection payloads against a closed model.
• Payloads in low-resource languages or encodings (Base64, ROT13, emoji) slip past filters that never saw them.

• 2025 edition: LLM01:2025 Prompt Injection
• OWASP Agentic Top 10: ASI01, ASI02, ASI03, ASI05, ASI06, ASI08, ASI09
• AISVS chapters: C2 Input Validation, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection, C7 Model Behavior, Output Control & Safety Assurance
• MITRE ATLAS tactics: AML.TA0004 Initial Access, AML.TA0005 Execution, AML.TA0006 Persistence, AML.TA0007 Defense Evasion, AML.TA0010 Exfiltration
• CWE: CWE-1427
• Agentic threats: T6 Intent Breaking & Goal Manipulation, T1 Memory Poisoning, T2 Tool Misuse
• Controls: M4 Prompt Hardening & Jailbreak Prevention, M11 Content Security & Output Filtering, M7 Zero Trust & Least Privilege Access, M8 Adaptive Human-in-the-Loop Controls, M1 Memory Validation & Sanitization, M19 MCP Server Hardening & Tool Provenance

LLM02:2026 Sensitive Information Disclosure

Confidential, regulated or proprietary data leaves an LLM system through a channel its owner never authorised. The answer text is only one such channel: tool-call arguments, reasoning traces, retrieved chunks, logs and telemetry, embeddings and measurable side effects such as response length or timing can all disclose data, so each deserves the same classification and redaction rules. Leaks can start at training time (memorised data), at inference time (live context), in pipelines (fine-tuning, distillation, observability) or by observation alone (side channels). Two causes recur: over-shared data sources that feed retrieval exactly as designed, and data that persists in weights, adapters or vectors after the source is deleted.

Common examples

• Extraction attacks make a model or a fine-tuned adapter reproduce memorised training data.
• Live context (the system prompt, retrieved documents, files or another user's session) appears in a response, or a summary or translation reveals more than was asked for.
• Leaked or exported embeddings are inverted back into the source text.
• Vision and multimodal models read credentials or personal data out of screenshots and documents, or reproduce identifiable images.
• Side channels such as token length, latency, log-probabilities or shared caches reveal membership or conversation topics without exposing the content.
• Fine-tuning, distillation or synthetic-data pipelines carry sensitive examples into derived models.
• Observability platforms and logs keep full prompts, completions and traces that are later exposed.

• 2025 edition: LLM02:2025 Sensitive Information Disclosure
• OWASP Agentic Top 10: ASI06
• AISVS chapters: C5 Access Control & Identity for AI Components & Users, C7 Model Behavior, Output Control & Safety Assurance, C8 Memory, Embeddings & Vector Database Security, C11 Adversarial Robustness, C1 Training Data Integrity & Traceability, C12 Monitoring, Logging & Anomaly Detection
• MITRE ATLAS tactics: AML.TA0010 Exfiltration
• CWE: CWE-200, CWE-359, CWE-212, CWE-532
• Agentic threats: T3 Privilege Compromise, T1 Memory Poisoning
• Controls: M11 Content Security & Output Filtering, M7 Zero Trust & Least Privilege Access, M1 Memory Validation & Sanitization, M6 Comprehensive Security Monitoring & Auditing

LLM03:2026 Excessive Agency

When an LLM application can call tools or act on other systems, unexpected, ambiguous or manipulated model output can trigger damaging actions. What makes the model misbehave does not matter (a hallucination, a direct or indirect prompt injection, a compromised tool or peer agent); the weakness is that the system lets the output do more than the task needs. OWASP names three root causes: excessive functionality (tools or functions the task does not require), excessive permissions (downstream rights broader than needed) and excessive autonomy (high-impact actions without independent approval). In agentic systems it shows up as tool misuse, identity and privilege abuse and cascading failures. Filtering inputs and outputs does not fix it; limiting tools, permissions and autonomy does. It moved from sixth to third place in 2026.

Common examples

• A tool chosen for reading documents can also modify or delete them.
• A tool tried during development is no longer needed but is still available to the agent.
• An open-ended tool, such as one meant to run a single shell command, does not stop other commands.
• A read-only tool connects with an identity that can also update, insert and delete.
• A tool acting for one user reaches downstream systems through a shared, highly privileged account.
• High-impact actions such as deletions run without the user confirming them.

• 2025 edition: LLM06:2025 Excessive Agency
• OWASP Agentic Top 10: ASI01, ASI02, ASI03, ASI05, ASI07, ASI08, ASI09
• AISVS chapters: C5 Access Control & Identity for AI Components & Users, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C12 Monitoring, Logging & Anomaly Detection
• MITRE ATLAS tactics: AML.TA0005 Execution, AML.TA0011 Impact
• CWE: CWE-285, CWE-732
• Agentic threats: T2 Tool Misuse, T3 Privilege Compromise, T11 Unexpected RCE and Code Attacks
• Controls: M7 Zero Trust & Least Privilege Access, M2 Tool Sandboxing & Isolation, M8 Adaptive Human-in-the-Loop Controls, M6 Comprehensive Security Monitoring & Auditing, M9 Distributed Resource Management & Rate Limiting

LLM04:2026 Supply Chain

LLM applications inherit risk from everything they did not build themselves: third-party models and datasets, LoRA and other parameter-efficient adapters, conversion, merge and quantisation pipelines, serving frameworks and the platforms that host them. Tampered or poisoned artifacts, weak provenance and unsafe formats can lead to biased output, compromise or outages, and model artifacts are far harder to inspect than code. The 2026 entry treats artifact provenance and the promotion of artifacts into trusted environments as first-class attack surfaces and adds models shipped on devices. Supply-chain risk specific to agents, such as MCP servers and tool registries, is left to ASI04.

Common examples

• Outdated or vulnerable packages, serving frameworks or models are exploited, including package names that coding assistants hallucinate and attackers register first (slopsquatting).
• Model and dataset licences carry obligations that are missed, creating legal exposure.
• A pre-trained model carries a backdoor or bias, hidden in its weights, in its computational graph or in a file crafted to exploit the loader.
• Unsigned or mutable model artifacts are swapped or altered in transit, in storage or when a pipeline promotes them, for example by resolving a 'latest' tag instead of a digest.
• A malicious adapter, or a compromised conversion, merge or quantisation step, changes how the deployed model behaves.
• Models shipped on devices are exposed through compromised manufacturing, firmware flaws or repackaged apps.
• Unclear provider terms let application data be used for training, with later exposure or copyright risk.

• 2025 edition: LLM03:2025 Supply Chain
• OWASP Agentic Top 10: ASI04
• AISVS chapters: C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C6 Supply Chain Security for Models, C1 Training Data Integrity & Traceability, C10 Model Context Protocol (MCP) Security
• MITRE ATLAS tactics: AML.TA0004 Initial Access
• CWE: CWE-494, CWE-829
• Agentic threats: T17 Supply Chain Compromise
• Controls: M17 Supply Chain Security & Provenance, M20 Agent Supply-Chain Integrity, M13 Secure Development Lifecycle Integration

LLM05:2026 Data and Model Poisoning

An attacker, or a careless process, manipulates data or model artifacts so that the system learns harmful behaviour, bias or a hidden backdoor. Poisoning can happen wherever data is ingested or reused: pre-training, fine-tuning, embeddings and retrieval, models reused from upstream and continuous-learning pipelines, as well as bundled artifacts such as chat templates, tokenizer configurations and adapters. A poisoned model can behave normally until a trigger appears, and fixing it can mean revalidating data, retraining or replacing the model rather than patching code. The 2026 entry also covers fine-tuning that deliberately erodes safety behaviour; injection at inference time belongs to LLM01 and attacks on embedding geometry to LLM09.

Common examples

• Biased or malicious samples are added to training or fine-tuning data, for example to wear down refusals while keeping accuracy.
• Mislabelled records teach a fraud-detection model to accept fraud.
• Trigger phrases contributed to a popular open dataset spread into every model fine-tuned on it.
• A few hundred poisoned documents are enough to implant a backdoor, whatever the model or corpus size.
• Hidden instructions in web content poison an assistant's memory or recommendations.
• One optimised passage per targeted query overrides correct content in a retrieval corpus.
• Poisoned inputs spread across multi-agent workflows and the systems they reach.
• Small amounts of poisoned medical data change clinical outputs while passing standard evaluations.
• Backdoored models published to public repositories are inherited by whoever downloads them.

• 2025 edition: LLM04:2025 Data and Model Poisoning
• OWASP Agentic Top 10: ASI04, ASI06, ASI08
• AISVS chapters: C1 Training Data Integrity & Traceability, C3 Model Lifecycle Management & Change Control, C8 Memory, Embeddings & Vector Database Security, C11 Adversarial Robustness, C6 Supply Chain Security for Models, C12 Monitoring, Logging & Anomaly Detection
• MITRE ATLAS tactics: AML.TA0003 Resource Development, AML.TA0006 Persistence, AML.TA0011 Impact
• CWE: CWE-349, CWE-829
• Agentic threats: T1 Memory Poisoning, T17 Supply Chain Compromise
• Controls: M12 Secure Model Training & Validation, M1 Memory Validation & Sanitization, M17 Supply Chain Security & Provenance

LLM06:2026 Unbounded Consumption

An LLM application that does not control how much inference it performs lets attackers degrade availability, run up costs or copy the model. The defining feature is cost asymmetry: a cheap request can trigger expensive computation, by way of crafted prompts, misused credentials or tampered workflows. Reasoning models with large thinking budgets, multimodal inputs, agentic tool use that fans one request out into many calls and shared inference infrastructure all make it worse, so request-rate limits alone are no longer enough; the entry calls for token-aware cost controls, hard spending caps and circuit breakers for agents. It moved from tenth to sixth place in 2026.

Common examples

• Floods of variable-length inputs, or a poisoned model that always generates to the maximum length, exhaust capacity.
• High volumes of paid operations create a denial of wallet.
• Requests kept just under the context limit, or ever-growing context, consume disproportionate compute and memory.
• Short, harmless-looking prompts push reasoning models into very long or endless thinking.
• Inputs optimised for maximum compute cost (sponge examples, adversarial image perturbations) are submitted.
• Image, audio and video inputs turn one request into far more tokens than comparable text.
• Systematic querying, sped up by exposed log-probabilities, collects enough output to replicate or distil the model.
• Malicious tools drive the application into recursive or fan-out tool-calling loops.
• Flaws in serving frameworks are exploited to crash the service or exhaust its resources.

• 2025 edition: LLM10:2025 Unbounded Consumption
• OWASP Agentic Top 10: ASI02, ASI08
• AISVS chapters: C9 Orchestration & Agentic Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection, C5 Access Control & Identity for AI Components & Users, C7 Model Behavior, Output Control & Safety Assurance
• MITRE ATLAS tactics: AML.TA0011 Impact, AML.TA0010 Exfiltration
• CWE: CWE-400, CWE-770
• Agentic threats: T4 Resource Overload
• Controls: M9 Distributed Resource Management & Rate Limiting, M14 Runtime Security Controls & Sandboxing, M6 Comprehensive Security Monitoring & Auditing

LLM07:2026 Misinformation

An LLM produces wrong, incomplete, unsupported or misleading information that looks credible enough for a person, a workflow or an agent to act on. The 2026 entry treats this as a system-level failure: model output now drives tool calls, generated code, inferred system state and decisions passed between agents, so a confident error can turn into a security incident, a financial loss or a safety problem. Causes include hallucination, stale or partial context, weak grounding, biased data, misleading summaries, unvalidated tool output and deliberate manipulation, and overreliance on fluent output is often built into the design itself.

Common examples

• Unsupported output informs business, legal, medical, financial or operational decisions.
• The model concludes that a workflow condition is met when it is not, and an action fires.
• Generated code is wrong or references packages that do not exist.
• Summaries drop key constraints, exceptions, dates or risks.
• Attackers craft inputs that produce false claims or leave out critical facts.
• An incorrect output from one agent is trusted and passed on by others.
• Fabricated or misattributed content is presented as authoritative evidence.

• 2025 edition: LLM09:2025 Misinformation
• OWASP Agentic Top 10: ASI08, ASI09, ASI10
• AISVS chapters: C7 Model Behavior, Output Control & Safety Assurance, C12 Monitoring, Logging & Anomaly Detection, C1 Training Data Integrity & Traceability, C8 Memory, Embeddings & Vector Database Security, C11 Adversarial Robustness
• MITRE ATLAS tactics: AML.TA0011 Impact
• CWE: CWE-1426
• Agentic threats: T5 Cascading Hallucination Attacks, T7 Misaligned & Deceptive Behaviors
• Controls: M5 Multi-Stage Reasoning Validation, M11 Content Security & Output Filtering, M8 Adaptive Human-in-the-Loop Controls, M16 Behavioral Monitoring & Ethics Framework

LLM08:2026 Hidden Context Exposure

Users can extract, infer or reconstruct context they were never meant to see: the system prompt, developer instructions, retrieved policy text, tool and function schemas and anything else the application places in the model's context window. Renamed and broadened from System Prompt Leakage (LLM07:2025), the entry tells teams to assume hidden context is discoverable. The risk lies in what it contains or what the application relies on it for: credentials, filtering rules, role checks or workflow logic. Severity ranges from informational to critical, and exposure often makes injection, disclosure, excessive agency and output-handling attacks easier.

Common examples

• Hidden context reveals tools, function schemas, architecture details or embedded secrets such as API keys and database credentials.
• Internal decision logic is exposed, showing attackers how to steer or bypass the application.
• Leaked refusal and filtering rules let attackers craft inputs that avoid them.
• Role and permission rules, for example in an internal MCP tool description, invite targeted probing.
• Exposed output formats and schemas help attackers produce well-formed but manipulated output for downstream parsers.

• 2025 edition: LLM07:2025 System Prompt Leakage
• OWASP Agentic Top 10: ASI06, ASI07
• AISVS chapters: C7 Model Behavior, Output Control & Safety Assurance, C9 Orchestration & Agentic Security, C11 Adversarial Robustness, C2 Input Validation, C5 Access Control & Identity for AI Components & Users, C12 Monitoring, Logging & Anomaly Detection
• MITRE ATLAS tactics: AML.TA0008 Discovery, AML.TA0010 Exfiltration
• CWE: CWE-200
• Agentic threats: T3 Privilege Compromise, T6 Intent Breaking & Goal Manipulation
• Controls: M4 Prompt Hardening & Jailbreak Prevention, M7 Zero Trust & Least Privilege Access, M11 Content Security & Output Filtering

LLM09:2026 Vector and Embedding Weaknesses

Applications that embed text, images, code or audio and use similarity search to decide what the model sees (retrieval-augmented generation, vector-backed agent memory, semantic caches, deduplication) make the embedding layer part of their trust boundary. These attacks exploit the geometry of the embedding space and the mechanics of retrieval rather than the model's instruction following, and many work with content that carries no instructions at all. OWASP groups the failure modes as wrong answers (poisoning), leaks (inversion), silence (jamming) and indiscriminate retrieval (missing access control). Injection through retrieved text stays with LLM01, and memory attacks that do not depend on embeddings with ASI06.

Common examples

• In a shared index, crafted queries reveal other tenants' documents through result counts, scores or timing before access control applies.
• Stored or leaked embeddings are inverted to recover the source text.
• Content written to the corpus is crafted to land next to a target query and is retrieved as trusted context.
• A blocker document is retrieved for a query and makes the model refuse or claim it has no answer (retrieval jamming).
• Similarity scores or answers reveal whether a specific document is in the index.
• Content tuned around a similarity threshold poisons a semantic cache or defeats deduplication.
• An image or audio clip is crafted so its embedding sits next to a sensitive text query in a cross-modal index.

• 2025 edition: LLM08:2025 Vector and Embedding Weaknesses
• OWASP Agentic Top 10: ASI04, ASI06
• AISVS chapters: C5 Access Control & Identity for AI Components & Users, C8 Memory, Embeddings & Vector Database Security, C1 Training Data Integrity & Traceability, C7 Model Behavior, Output Control & Safety Assurance, C12 Monitoring, Logging & Anomaly Detection
• MITRE ATLAS tactics: AML.TA0006 Persistence, AML.TA0010 Exfiltration
• CWE: CWE-200, CWE-285
• Agentic threats: T1 Memory Poisoning
• Controls: M1 Memory Validation & Sanitization, M7 Zero Trust & Least Privilege Access, M6 Comprehensive Security Monitoring & Auditing

LLM10:2026 Improper Output Handling

Model output is passed to other components without enough validation, sanitisation or encoding. Because prompts can steer that output, the application in effect hands users, and anyone who can inject content, indirect access to the downstream system, with results ranging from cross-site scripting and request forgery in the browser to server-side request forgery, privilege escalation and remote code execution on the back end. The 2026 entry also covers insecure code generated by assistants and renderers that act on output by themselves, such as terminals that interpret control characters and chat interfaces that fetch images or link previews automatically. Whether the output is correct is a separate risk (LLM07). It moved from fifth to tenth place in 2026.

Common examples

• Output reaches a shell, exec or eval and runs as code.
• Generated JavaScript or Markdown is rendered in the browser, causing cross-site scripting.
• Generated SQL runs without parameterisation, allowing SQL injection.
• Output is used to build file paths without sanitisation, allowing path traversal.
• Output is inserted into email templates without escaping, enabling phishing.
• ANSI escape or other control characters in output are interpreted by a terminal, log viewer or IDE.
• A chat interface auto-loads Markdown images or link previews from output, leaking conversation data through the URL.

• 2025 edition: LLM05:2025 Improper Output Handling
• OWASP Agentic Top 10: ASI02, ASI05, ASI09
• AISVS chapters: C7 Model Behavior, Output Control & Safety Assurance, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security
• MITRE ATLAS tactics: AML.TA0005 Execution
• CWE: CWE-1426, CWE-116, CWE-79
• Agentic threats: T11 Unexpected RCE and Code Attacks, T2 Tool Misuse
• Controls: M11 Content Security & Output Filtering, M14 Runtime Security Controls & Sandboxing, M2 Tool Sandboxing & Isolation

OB-001 Goal Hijacking

Common Manipulation Risks

Actors use adversarial instructions and context manipulation to override, bypass, alter, or subvert an LLM/agent's system instructions, guardrails, or intended behavior. This objective encapsulates prompt injection and jailbreak-style attacks, including direct user prompting, indirect payload delivery through external content, multimodal payloads, and multi-turn goal drift. The attack manipulates model context so the system follows attacker-controlled objectives instead of aligned constraints.

• AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation): Text-based prompt techniques to manipulate an LLM/agent's behavior to bypass safeguards and/or follow attacker-defined goals. This can include the use of obfuscation, context and instruction manipulation, or propagating attacks through multi-agent environments.
  Sub-techniques: AISubtech-1.1.1 Instruction Manipulation; AISubtech-1.1.2 Obfuscation; AISubtech-1.1.3 Multi-Agent Propagation; AISubtech-1.1.4 Token Exploitation; AISubtech-1.1.5 Context Manipulation
• AITech-1.2 Indirect Prompt Injection: Variation of prompt-based manipulation where the attacker embeds malicious instructions in external data sources (such as web pages, documents, emails, databases, API responses, etc.) that the LLM or the agent retrieves and processes, causing attacker instructions to be executed. The attack exploits the model's inability to distinguish between trusted system instructions and untrusted external content.
• AITech-1.3 Multimodal Injection and Manipulation: Actors deliberately insert, alter, or create malicious content across various modalities (such as text, image, audio, video, or sensor streams) to influence, corrupt, or exploit an AI system's fusion, interpretation, or decision-making processes. Attacks exploit the integration points where different data types are combined.
  Sub-techniques: AISubtech-1.3.1 Image-Text Injection; AISubtech-1.3.2 Image Manipulation; AISubtech-1.3.3 Audio Command Injection; AISubtech-1.3.4 Video Overlay Manipulation

OB-002 Agentic Autonomy Failures (Misuse, Alignment, Drift)

Common Manipulation Risks

External actors or the agent itself (in cases of autonomy failure) cause behavior to diverge from the user or organization's authorized intent and scope. That drift happens in the agent's authorized capabilities, trust in its own assets and channels, attempts to optimize against success metrics or scores instead of the user's goal, and chained authority in composed workflows. This objective covers an agent's failures to select, scope, verify, and optimize tasks within its own action space.

• AITech-2.1 Excessive Agency: External actors or the agent itself leverage the agent's authorized capabilities, available tools, lack of oversight on consequential actions, or interpretive drift across turns to commit to an action that exceeds its authorized decision-making, scope, or execution authority.
  Sub-techniques: AISubtech-2.1.1 Execution Approval Bypass; AISubtech-2.1.2 Capability and Permission Overreach
• AITech-2.2 Goal Drift: The agent independently and materially expands, refuses, substitutes, or abandons the governing objective, authorized scope, or material constraints. The drift is in the agent's interpretation of authorized scope, including overreaching tasks in an attempt to be helpful, reframing tasks it can't satisfy to a task it can satisfy, gaining access to tools by approvals from the user over multi-turn sessions even if task scope changes, and breaking rules such as violating environmental boundaries to complete tasks.
  Sub-techniques: AISubtech-2.2.1 Unauthorized Scope Expansion; AISubtech-2.2.2 Goal Substitution; AISubtech-2.2.3 Authorization and Constraint Erosion
• AITech-2.3 Reward Hacking: External actors or autonomy failure cause the agent to optimize observable success signals--test pass/fail, benchmark scores, verifier outputs, approval heuristics, cost/latency budgets, dashboard metrics--instead of the visible governing task or objective. The agent seeks, obtains, claims, or preserves apparent success while exploiting task or interface mismatches, subverting verification, taking invalidating shortcuts, or degrading measurement integrity. Deliberate acquisition of an invalidating shortcut for task advantage can qualify before it is used in a result.
  Sub-techniques: AISubtech-2.3.1 Task Loophole Exploitation; AISubtech-2.3.2 Verifier Manipulation; AISubtech-2.3.3 Shortcut Acquisition

OB-003 Masquerading / Obfuscation / Impersonation

Common Manipulation Risks

Actors introduce a malicious agent that impersonates a legitimate agent, user, system, or authority within a multi-agent ecosystem and causes other agents, systems, or users to accept it as authentic and trust its communications or actions.

• AITech-3.1 Masquerading / Obfuscation / Impersonation: Actors introduce a malicious agent that impersonates a legitimate agent, user, system, or authority within a multi-agent ecosystem and causes other agents, systems, or users to accept it as authentic and trust its communications or actions.
  Sub-techniques: AISubtech-3.1.1 Identity Obfuscation; AISubtech-3.1.2 Trusted Agent Spoofing

OB-004 Communication Compromise

Common Manipulation Risks

Actors manipulate an agent system to introduce or executive unaothorized agent instances, malicious agent code, or fake agent capabilities by inserting misleading data, exploiting registration mechanisms, or subverting agent deployment processes. This results in unauthorized agents operating within the system or legitimate agents executing malicious code.

• AITech-4.1 Agent Injection: Actors manipulate an agent system to introduce or executive unauthorized agent instances, malicious agent code, or fake agent capabilities by inserting misleading data, exploiting registration mechanisms, or subverting agent deployment processes. This results in unauthorized agents operating within the system or legitimate agents executing malicious code.
  Sub-techniques: AISubtech-4.1.1 Rogue Agent Introduction
• AITech-4.2 Context Boundary Attacks: Actors manipulate contextual information that an agent sees, processes, or transmits by exploiting unclear or porous boundaries between different context segments (such as descriptions, prompts, tool outputs, memory, or status messages). An agent may misinterpret the source, trustworthiness, or intent of information.
  Sub-techniques: AISubtech-4.2.1 Context Window Exploitation; AISubtech-4.2.2 Session Boundary Violation
• AITech-4.3 Protocol Manipulation: Actors exploit assumptions or ambiguities in structured communication protocols (e.g., JSON, XML, YAML, API specifications, custom schemas) used for agentic communication by introducing adversarial inputs that corrupt parsing, processing, or interpretation.
  Sub-techniques: AISubtech-4.3.1 Schema Inconsistencies; AISubtech-4.3.2 Namespace Collision; AISubtech-4.3.3 Server Rebinding Attack; AISubtech-4.3.4 Replay Exploitation; AISubtech-4.3.5 Capability Inflation; AISubtech-4.3.6 Cross-Origin Exploitation

OB-005 Persistence

Common Manipulation Risks

Actors insert poisoned, harmful, or adversarial data or instructions into an agent or model's short-term or long-term memory to corrupt its behavior over extended periods of time.

• AITech-5.1 Memory System Persistence: Actors insert poisoned, harmful, or adversarial data or instructions into an agent or model's short-term or long-term memory to corrupt its behavior over extended periods of time.
  Sub-techniques: AISubtech-5.1.1 Long-term / Short-term Memory Injection
• AITech-5.2 Configuration Persistence: Actor subverts an agent's internal configuration, settings, or initialization parameters to create lasting malicious influence over its behavior. This goes beyond a single, isolated prompt injection by modifying the system's core settings, context, or memory that defines its behavior. An example is modifying MCP configuration to include a malicious server or inserting malicious instructions into an integrated development environment's internal config files.
  Sub-techniques: AISubtech-5.2.1 Agent Profile Tampering

OB-006 Feedback Loop Manipulation

Data-Related Risks

Actors insert malicious, inaccurate, or corrupted data into a model's training pipeline, with the aim of distorting the model's outputs, embedding payload, degrading performance, or introducing systematic biases.

• AITech-6.1 Training Data Poisoning: Actors insert malicious, inaccurate, or corrupted data into a model's training pipeline, with the aim of distorting the model's outputs, embedding payload, degrading performance, or introducing systematic biases.
  Sub-techniques: AISubtech-6.1.1 Knowledge Base Poisoning; AISubtech-6.1.2 Reinforcement Biasing; AISubtech-6.1.3 Reinforcement Signal Corruption

OB-007 Sabotage / Integrity Degradation

Data-Related Risks

Actors subvert a model/agent's planning, decision-making, or logical inference processes to produce unintended or harmful outcomes. As AI agents are increasingly trusted with autonomous actions, this attack targets the agent's "reasoning engine" i.e, the core mechanisms for analysis, judgment, and action selection.

• AITech-7.1 Reasoning Corruption: Actors subvert a model/agent's planning, decision-making, or logical inference processes to produce unintended or harmful outcomes. As AI agents are increasingly trusted with autonomous actions, this attack targets the agent's "reasoning engine" i.e, the core mechanisms for analysis, judgment, and action selection.
• AITech-7.2 Memory System Corruption: Actors inject false, malicious, or adversarial data into an AI agent's memory systems to cause immediate harmful decisions, corruption of system functionality or degraded performance.
  Sub-techniques: AISubtech-7.2.1 Memory Anchor Attacks; AISubtech-7.2.2 Memory Index Manipulation
• AITech-7.3 Data Source Abuse and Manipulation: Actors inject malicious, misleading, or poisoned data into external data sources (APIs, databases, RAG systems) that AI systems consume in order to manipulate model behavior, corrupt decision-making, or inject malicious instructions through trusted data channels.
  Sub-techniques: AISubtech-7.3.1 Corrupted Third-Party Data
• AITech-7.4 Token Manipulation: Actors misuse, poison, or tamper with tokens used by model/agentic systems (e.g., model-specific tokens, or security tokens) to control access, encode information, or manage interactions.
  Sub-techniques: AISubtech-7.4.1 Token Theft

OB-008 Data and Privacy Violations

Data-Related Risks

Actors expose, infer, extract, generate, or misuse sensitive, personal, financial, health, proprietary, or system information through model outputs, training data analysis, agent tooling, or system interactions. This objective covers unauthorized disclosure of training data, prompts and metadata, personally identifiable information, payment card industry data, and protected health information to parties who should not have access.

• AITech-8.1 Membership Inference: Actors determine whether a specific data point, record, or individual was included in a model's training dataset, exposing sensitive information about training data subjects, reveal proprietary datasets, or indicate the presence of confidential information in model training.
  Sub-techniques: AISubtech-8.1.1 Presence Detection
• AITech-8.2 Data Exfiltration / Exposure: Actors intentionally or unintentionally cause sensitive information to be exposed through model outputs, API responses, or system behaviors. This includes leakage of personal data, intellectual property, proprietary algorithms, training data, system internals, or other confidential information to unauthorized parties.
  Sub-techniques: AISubtech-8.2.1 Training Data Exposure; AISubtech-8.2.2 LLM Data Leakage; AISubtech-8.2.3 Data Exfiltration via Agent Tooling
• AITech-8.3 Information Disclosure: Actors trigger the unintentional or unauthorized exposure, leakage, or sharing of data, model parameters, or system details to parties who should not have access to them. The disclosure occurs through model behaviors, responses, or system interactions that reveal more information than intended.
  Sub-techniques: AISubtech-8.3.1 Tool Metadata Exposure; AISubtech-8.3.2 System Information Leakage
• AITech-8.4 Prompt/Meta Extraction: Actors extract, reveal, or reconstruct the system prompts, meta-prompts, hidden instructions, initial context, or operational directives that define a model/agent's behavior, constraints, and capabilities. This can expose intellectual property, security mechanisms, and operational logic.
  Sub-techniques: AISubtech-8.4.1 System LLM Prompt Leakage
• AITech-8.5 Personally Identifiable Information: Exposure, generation, or misuse of personally identifiable information (PII) such as names, addresses, phone numbers, identification numbers, or other sensitive personal details that can be used to identify, track, or exploit individuals.
  Sub-techniques: AISubtech-8.5.1 Email Address; AISubtech-8.5.2 Phone Number; AISubtech-8.5.3 Person Name; AISubtech-8.5.4 IP Address; AISubtech-8.5.5 Address; AISubtech-8.5.6 Username; AISubtech-8.5.7 Password; AISubtech-8.5.8 Driver License Number; AISubtech-8.5.9 Passport Number; AISubtech-8.5.10 National ID Number
• AITech-8.6 Payment Card Industry Data: Exposure, generation, or misuse of payment card industry (PCI) data including cardholder data and sensitive authentication data such as card numbers, expiration dates, service codes, CVVs, and PINs.
  Sub-techniques: AISubtech-8.6.1 Credit Card Number; AISubtech-8.6.2 Bank Account Number; AISubtech-8.6.3 Bank Routing Code; AISubtech-8.6.4 Tax Identification Number
• AITech-8.7 Protected Health Information: Exposure, generation, or misuse of protected health information (PHI) including individually identifiable health data such as medical records, diagnoses, billing information, and other personal health identifiers.
  Sub-techniques: AISubtech-8.7.1 Medical License Number; AISubtech-8.7.2 Patient ID Number; AISubtech-8.7.3 Medication; AISubtech-8.7.4 Medical Disease

OB-009 Supply Chain Compromise

Data-Related Risks

Actor coerces or manipulates a model/agent into producing false, misleading or malicious outputs through adversarial inputs, context manipulation, or exploiting model behaviors, without directly modifying the model itself.

• AITech-9.1 Model or Agentic System Manipulation: Actor coerces or manipulates a model/agent into producing false, misleading or malicious outputs through adversarial inputs, context manipulation, or exploiting model behaviors, without directly modifying the model itself.
  Sub-techniques: AISubtech-9.1.1 Code Execution; AISubtech-9.1.2 Unauthorized or Unsolicited System Access; AISubtech-9.1.3 Unauthorized or Unsolicited Network Access; AISubtech-9.1.4 Injection Attacks (e.g., SQL, Command Execution, XSS); AISubtech-9.1.5 Template Injection (e.g., SSTI)
• AITech-9.2 Detection Evasion: Actors manipulate or alter the input data, behaviors, or attack patterns to intentionally bypass security monitoring, content moderation, anomaly detection, and safety mechanisms.
  Sub-techniques: AISubtech-9.2.1 Obfuscation Vulnerabilities; AISubtech-9.2.2 Backdoors and Trojans
• AITech-9.3 Dependency / Plugin Compromise: Actors insert malicious code, backdoors, or vulnerabilities into third-party dependencies, plugins, extensions, or libraries used by models/agents/AI applications, creating supply chain attacks that affect all systems using the compromised component.
  Sub-techniques: AISubtech-9.3.1 Malicious Package / Tool Injection; AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers); AISubtech-9.3.3 Dependency Replacement / Rug Pull

OB-010 Model Theft / Extraction

Data-Related Risks

Actors attempt to reconstruct or replicate a model partially or entirely by interacting with it through its APIs, inference endpoints, or other access points, with the goal of replicating its functionality, architecture, parameters, or outputs without authorized access.

• AITech-10.1 Model Extraction: Actors attempt to reconstruct or replicate a model partially or entirely by interacting with it through its APIs, inference endpoints, or other access points, with the goal of replicating its functionality, architecture, parameters, or outputs without authorized access.
  Sub-techniques: AISubtech-10.1.1 API Query Stealing; AISubtech-10.1.2 Weight Reconstruction; AISubtech-10.1.3 Sensitive Data Reconstruction
• AITech-10.2 Model Inversion: Actors reconstructs private training data, sensitive features, or confidential information from a trained model by exploiting the model's learned representations, decision boundaries, or output patterns.
  Sub-techniques: AISubtech-10.2.1 Model Inversion

OB-011 Adversarial Evasion

Data-Related Risks

Actors manipulate the model by exploiting aspects of its operational context, or "environment," to induce malicious or unintended behavior. Rather than simply altering a user's prompt, this type of attack crafts input to leverage the system's broader state and external interactions to bypass safety measures.

• AITech-11.1 Environment-Aware Evasion: Actors manipulate the model by exploiting aspects of its operational context, or "environment," to induce malicious or unintended behavior. Rather than simply altering a user's prompt, this type of attack crafts input to leverage the system's broader state and external interactions to bypass safety measures.
  Sub-techniques: AISubtech-11.1.1 Agent-Specific Evasion; AISubtech-11.1.2 Tool-Scoped Evasion; AISubtech-11.1.3 Environment-Scoped Payloads; AISubtech-11.1.4 Defense-Aware Payloads
• AITech-11.2 Model-Selective Evasion: Actors craft prompts or inputs specifically designed to bypass the safety controls, content filters, or detection mechanisms of a particular target LLM, while similar or related models would successfully detect and refuse the malicious input. This technique exploits model-specific quirks, training differences, and implementation variations.
  Sub-techniques: AISubtech-11.2.1 Targeted Model Fingerprinting; AISubtech-11.2.2 Conditional Attack Execution

OB-012 Action-Space and Integration Abuse

Downstream / Impact Risks

Actors abuse connected tools, APIs, functions, or external capabilities through subversive prompts, commands, or context manipulation. This can include attacks like: unauthorized tool execution, exploitation of security vulnerabilities in tools, tool poisoning, injection attacks through tool interfaces.

• AITech-12.1 Tool Exploitation: Actors abuse connected tools, APIs, functions, or external capabilities through subversive prompts, commands, or context manipulation. This can include attacks like: unauthorized tool execution, exploitation of security vulnerabilities in tools, tool poisoning, injection attacks through tool interfaces.
  Sub-techniques: AISubtech-12.1.1 Parameter Manipulation; AISubtech-12.1.2 Tool Poisoning; AISubtech-12.1.3 Unsafe System / Browser / File Execution; AISubtech-12.1.4 Tool Shadowing
• AITech-12.2 Insecure Output Handling: Actors exploit insufficient sanitization, validation, filtering, or security controls applied to content generated by models or agents before it is passed to downstream systems, databases, APIs, or components. This inadequate handling enables injection attacks, code execution, or broader system compromise.
  Sub-techniques: AISubtech-12.2.1 Code Detection / Malicious Code Output

OB-013 Availability Abuse

Downstream / Impact Risks

Actors prevent authorized users from accessing or using AI models, agents, or their services through resource exhaustion, system degradation, or complete service outage.

• AITech-13.1 Disruption of Availability: Actors prevent authorized users from accessing or using AI models, agents, or their services through resource exhaustion, system degradation, or complete service outage.
  Sub-techniques: AISubtech-13.1.1 Compute Exhaustion; AISubtech-13.1.2 Memory Flooding; AISubtech-13.1.3 Model Denial of Service; AISubtech-13.1.4 Application Denial of Service; AISubtech-13.1.5 Decision Paralysis Attacks
• AITech-13.2 Cost Harvesting / Repurposing: Actors leverage computational or memory attacks that exploit AI systems to generate excessive costs for the service provider or owner through resource abuse, unauthorized usage for attacker benefit, or deliberate cost inflation. Examples can incude overwhelming human-in-the-loop processes and other denial of service conditions.
  Sub-techniques: AISubtech-13.2.1 Service Misuse for Cost Inflation

OB-014 Privilege Compromise

Downstream / Impact Risks

Actors gain unauthorized access to the underlying infrastructure, deployment environment, or hosting systems of AI models and agents (e.g., servers, databases, cloud accounts). This is distinct from accessing the model/agentic system itself through exploitation.

• AITech-14.1 Unauthorized Access: Actors gain unauthorized access to the underlying infrastructure, deployment environment, or hosting systems of AI models and agents (e.g., servers, databases, cloud accounts). This is distinct from accessing the model/agentic system itself through exploitation.
  Sub-techniques: AISubtech-14.1.1 Credential Theft; AISubtech-14.1.2 Insufficient Access Controls
• AITech-14.2 Abuse of Delegated Authority: Actors exploit legitimate delegation mechanisms where agents are granted authority to act on behalf of users, systems, or other agents, and use this delegated authority to perform unauthorized actions, exceed intended scope, or abuse trust relationships for malicious purposes.
  Sub-techniques: AISubtech-14.2.1 Permission Escalation via Delegation

OB-015 Harmful / Misleading / Inaccurate Content

Downstream / Impact Risks

Actors prompt generative models or agents to produce unauthorized, unsafe, or malicious content, including harmful instructions, toxic speech, misinformation, or unsafe media. The attack targets weaknesses in content guardrails to bypass safety constraints and generate content that should otherwise be restricted.

• AITech-15.1 Harmful Content: Actors prompt generative models or agents to produce unauthorized, unsafe, or malicious content, including harmful instructions, toxic speech, misinformation, or unsafe media. The attack targets weaknesses in content guardrails to bypass safety constraints and generate content that should otherwise be restricted.
  Sub-techniques: AISubtech-15.1.1 Cybersecurity and Hacking: Malware / Exploits; AISubtech-15.1.2 Cybersecurity and Hacking: Cyber Abuse; AISubtech-15.1.3 Safety Harms and Toxicity: Animal Abuse; AISubtech-15.1.4 Safety Harms and Toxicity: Child Abuse / Exploitation; AISubtech-15.1.5 Safety Harms and Toxicity: Disinformation; AISubtech-15.1.6 Safety Harms and Toxicity: Environmental Harm; AISubtech-15.1.7 Safety Harms and Toxicity: Financial Harm; AISubtech-15.1.8 Safety Harms and Toxicity: Harassment; AISubtech-15.1.9 Safety Harms and Toxicity: Hate Speech; AISubtech-15.1.10 Safety Harms and Toxicity: Non-Violent Crime; AISubtech-15.1.11 Safety Harms and Toxicity: Profanity; AISubtech-15.1.12 Safety Harms and Toxicity: Scams and Deception; AISubtech-15.1.13 Safety Harms and Toxicity: Self Harm; AISubtech-15.1.14 Safety Harms and Toxicity: Sexual Content and Exploitation; AISubtech-15.1.15 Safety Harms and Toxicity: Social Division and Polarization; AISubtech-15.1.16 Safety Harms and Toxicity: Terrorism / Extremism; AISubtech-15.1.17 Safety Harms and Toxicity: Violence and Public Safety Threat; AISubtech-15.1.18 Safety Harms and Toxicity: Weapons / CBRN Risks; AISubtech-15.1.19 Integrity: Hallucinations / Misinformation; AISubtech-15.1.20 Integrity: Unauthorized Financial Advice; AISubtech-15.1.21 Integrity: Unauthorized Legal Advice; AISubtech-15.1.22 Integrity: Unauthorized Medical Advice; AISubtech-15.1.23 Intellectual Property Compromise: Intellectual Property Infringement; AISubtech-15.1.24 Intellectual Property Compromise: Confidential Data; AISubtech-15.1.25 General Harms

OB-016 Surveillance

Downstream / Impact Risks

Actors conduct unauthorized passive monitoring, interception, or extraction of data from model/agentic system communications, including agent-to-agent messages, agent-to-user interactions, API calls, or other internal communications without directly manipulating the data flow.

• AITech-16.1 Eavesdropping: Actors conduct unauthorized passive monitoring, interception, or extraction of data from model/agentic system communications, including agent-to-agent messages, agent-to-user interactions, API calls, or other internal communications without directly manipulating the data flow.
  Sub-techniques: AISubtech-16.1.1 Logging Sensitive Conversations

OB-017 Cyber-Physical / Sensor Attacks

Downstream / Impact Risks

Actors use of highly-realistic but deceptive signals or manipulating sensor data to deliberately mislead an AI system and its decision-making processes through falsified sensory inputs.

• AITech-17.1 Sensor Spoofing: Actors use of highly-realistic but deceptive signals or manipulating sensor data to deliberately mislead an AI system and its decision-making processes through falsified sensory inputs.
  Sub-techniques: AISubtech-17.1.1 Sensor Spoofing: Action Signals (audio, visual)

OB-018 System Misuse / Malicious Application

Downstream / Impact Risks

Actors leverage models/agents specifically for generating, executing, scaling, or automating fraud, scams, deception, and other illegal activities.

• AITech-18.1 Fraudulent Use: Actors leverage models/agents specifically for generating, executing, scaling, or automating fraud, scams, deception, and other illegal activities.
  Sub-techniques: AISubtech-18.1.1 Spam / Scam / Social Engineering Generation
• AITech-18.2 Malicious Workflows: Actors leverage AI models to generate, execute, and scale harmful activities like cyberattacks, data theft, and disinformation campaigns. among other deceptive purposes.
  Sub-techniques: AISubtech-18.2.1 Abuse of APIs for Mass Automation; AISubtech-18.2.2 Dedicated Malicious Server or Infrastructure

OB-019 Multimodal / Cross-Modal Risks

Downstream / Impact Risks

Actors exploit contradictions, mismatches, or inconsistencies between different data modalities (i.e., text, image, audio, video) to confuse AI systems, bypass security controls, evade detection, or manipulate decision-making by presenting conflicting information across modalities that the system cannot properly reconcile.

• AITech-19.1 Cross-Modal Inconsistency Exploits: Actors exploit contradictions, mismatches, or inconsistencies between different data modalities (i.e., text, image, audio, video) to confuse AI systems, bypass security controls, evade detection, or manipulate decision-making by presenting conflicting information across modalities that the system cannot properly reconcile.
  Sub-techniques: AISubtech-19.1.1 Contradictory Inputs Attack; AISubtech-19.1.2 Modality Skewing
• AITech-19.2 Fusion Payload Split: Actors exploit weaknesses in fusion algorithms, arbitration logic, and decision-making processes to manipulate final system behavior. Combining payload components delivered through different inputs, outputs, or sources (including data sources, multiple models, or agents) and using the system’s fusion or arbitration mechanisms to assemble them to create an injection or attack payload.
  Sub-techniques: AISubtech-19.2.1 Convergence Payload Injection; AISubtech-19.2.2 Chained Payload Execution

A Data & Privacy

Protecting users and enterprises against data & privacy concerns through customer data policies, access controls, and safeguards against data leakage, secrets leakage, IP exposure, and unauthorized training on user information.

• A001 Establish input data policy: Establish and communicate AI input data policies covering how customer data is used for model training, inference processing, data retention periods, and customer data rights.
• A002 Establish output data policy: Establish AI output ownership, usage, opt-in/out and deletion policies to customers and communicate these policies.
• A003 Limit AI agent data access: Implement safeguards to limit AI agent data access based on task, user role, agent role and context.
• A004 Protect IP & trade secrets: Implement safeguards or technical controls to prevent AI systems from leaking company intellectual property or confidential information.
• A005 Prevent cross-customer data exposure: Implement safeguards to prevent cross-customer data exposure.
• A006 Prevent PII leakage: Establish safeguards to prevent personal data leakage through AI outputs and logs.
• A007 Prevent IP violations: Implement safeguards and technical controls to prevent AI outputs from violating copyrights, trademarks, or other third-party intellectual property rights.
• A008 Prevent leakage of credentials and secrets: Implement safeguards to detect and prevent leakage of secrets in AI system inputs, outputs, logs, and credential storage.
• A009 Third-party testing for data & privacy risk: Appoint expert third-parties to evaluate system robustness to data & privacy risk as defined in the AIUC-1 risk taxonomy at least every 3 months

B Security

Protecting against adversarial attacks including jailbreaks, prompt injection, and unauthorized tool use through testing, monitoring, access controls, and secure code patterns.

• B001 Third-party testing for security risk: Appoint expert third-parties to evaluate system robustness to security risk as defined in the AIUC-1 risk taxonomy at least every 3 months
• B002 Detect adversarial input: Implement monitoring capabilities to detect and enable responding to adversarial inputs and prompt injection attempts.
• B003 Manage public release of technical details: Implement controls to prevent over-disclosure of technical information about AI systems and organizational details that could enable adversarial targeting.
• B004 Prevent AI endpoint scraping: Implement safeguards to prevent probing or scraping of external AI endpoints.
• B005 Implement real-time input filtering: Implement real-time input filtering using automated moderation tools.
• B006 Prevent unauthorized AI agent actions: Implement safeguards to prevent AI agents from performing actions beyond intended scope and authorized privileges.
• B007 Enforce user access privileges to AI systems: Establish and maintain user access controls and admin privileges for AI systems in line with policy.
• B008 Protect AI system deployment environment: Implement security measures for AI system deployment environments including encryption, access controls and authorization.
• B009 Limit output over-exposure: Implement output limitations and obfuscation techniques to safeguard against information leakage.
• B010 Promote secure patterns in generated code: Implement safeguards to promote secure patterns and prevent known vulnerabilities in generated code.

C Safety

Mitigating harmful AI outputs and brand risk via testing, monitoring, and safeguards including risk taxonomy definition, pre-deployment testing, and third-party evaluations.

• C001 Define AI risk taxonomy: Establish a risk taxonomy based on system capabilities and deployment context.
• C002 Conduct pre-deployment testing: Conduct internal testing of AI systems prior to deployment across risk categories for system changes requiring formal review or approval.
• C003 Prevent harmful outputs: Implement safeguards or technical controls to prevent harmful outputs including distressed outputs, angry responses, high-risk advice, offensive content, bias, and deception.
• C004 Prevent out-of-scope outputs: Implement safeguards or technical controls to prevent out-of-scope outputs (e.g. political discussion, healthcare advice).
• C005 Prevent agent-specific high risk outputs: Implement safeguards or technical controls to prevent agent-specific high-risk outputs as defined in risk taxonomy.
• C006 Prevent output vulnerabilities: Implement safeguards to prevent security vulnerabilities in outputs from impacting users.
• C007 Flag high risk outputs for human review: Implement an alerting system that flags high-risk outputs for human review.
• C008 Monitor AI risk categories: Implement monitoring of AI systems across risk categories.
• C009 Enable real-time feedback and intervention: Implement mechanisms to enable real-time user feedback collection, intervention and actioning mechanisms.
• C010 Third-party testing for safety risk: Appoint expert third-parties to evaluate system robustness to safety risk as defined in the AIUC-1 risk taxonomy at least every 3 months

D Reliability

Mitigating hallucinations and unreliable tool calls through technical controls and third-party testing.

• D001 Prevent hallucinated outputs: Implement safeguards or technical controls to prevent hallucinated outputs.
• D003 Restrict unsafe tool calls: Implement safeguards or technical controls to prevent tool calls in AI systems from executing unauthorized actions, accessing restricted information, or making decisions beyond their intended scope.
• D004 Third-party testing for reliability risk: Appoint expert third-parties to evaluate system robustness to reliability risk as defined in the AIUC-1 risk taxonomy at least every 3 months

E Accountability

Defining accountability, oversight, incident response, and supplier vetting for AI systems.

• E001 AI failure plan for security breaches: Document AI failure plan for AI privacy and security breaches assigning accountable owners and establishing notification and remediation with third-party support as needed (e.g. legal, PR, insurers).
• E002 AI failure plan for harmful outputs: Document AI failure plan for harmful AI outputs that cause significant customer harm assigning accountable owners and establishing remediation with third-party support as needed (e.g. legal, PR, insurers).
• E003 AI failure plan for hallucinations: Document AI failure plan for hallucinated AI outputs that cause substantial customer financial loss assigning accountable owners and establishing remediation with third-party support as needed (e.g. legal, PR, insurers).
• E004 Assign accountability: Document which AI system changes across the development & deployment lifecycle require formal review or approval, assign a lead accountable for each, and document their approval with supporting evidence.
• E005 Document data storage security: Document data storage security practices considering data sensitivity, regulatory requirements, security controls, and operational needs.
• E006 Conduct vendor and model due diligence: Establish due diligence processes for foundation and upstream model providers covering data handling, PII controls, security and compliance.
• E008 Review internal processes: Establish regular internal reviews of key processes and document review records and approvals.
• E009 Monitor third-party access: Implement systems to monitor and log third-party API connections, sessions, and data access.
• E010 Establish AI acceptable use policy: Establish and implement an AI acceptable use policy.
• E011 Record processing locations: Document AI data processing locations.
• E012 Document regulatory compliance: Document applicable AI laws and standards, required data protections, and strategies for compliance.
• E013 Implement quality management system: Establish a quality management system for AI systems proportionate to the size of the organization.
• E015 Log AI system activity: Maintain logs of AI system processes, actions, and agent outputs where permitted to support incident investigation, auditing, and explanation of AI system behavior.
• E016 Implement AI disclosure mechanisms: Implement clear disclosure mechanisms to inform users when they are interacting with AI systems rather than humans.
• E017 Document system transparency policy: Establish a system transparency policy and maintain a repository of model cards, datasheets, and interpretability reports for major systems.
• E018 Third-party testing for accountability risk: Appoint expert third-parties to evaluate system robustness to accountability risk as defined in the AIUC-1 risk taxonomy at least every 3 months

F Society

Reducing societal harm from AI-enabled cyber attacks, exploitation, and catastrophic misuse (CBRN).

• F001 Prevent AI cyber misuse: Implement or document guardrails to prevent AI-enabled misuse for cyber attacks and exploitation.
• F002 Prevent catastrophic misuse: Implement or document guardrails to prevent AI-enabled catastrophic system misuse (chemical / bio / radio / nuclear).