Threat T15
Human Manipulation
Models exploit human trust to manipulate users, leveraging reasoning capabilities or operational access to influence human decisions.
- 8/10 risk (Critical)
- 6 attack vectors
- 5 mitigating controls
- 8 framework refs
Overview
- Impact level: High
- Risk score: 8/10 (Critical)
- CIA impact: Integrity
- Affected components: Foundation Model (KC1.1-KC1.3); Reasoning Engine (KC3.1-KC3.4); External Environment Interface (KC6.1-KC6.3)
- Tags: manipulation, trust, psychology, influence, ethics
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out human manipulation against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| Psychological Manipulation | High | Using persuasion techniques to influence human behavior |
| Trust Exploitation | High | Abusing human trust in AI systems for malicious purposes |
| Emotional Manipulation | Medium | Exploiting human emotions to achieve compliance |
| Information Manipulation | High | Presenting biased or false information to influence decisions |
| Authority Mimicry | Medium | Mimicking authoritative figures to gain compliance |
| Cognitive Bias Exploitation | Medium | Leveraging human cognitive biases for manipulation |
Affected components
KC1 Language Models (LLMs)
- KC1.1 Large Language Models (LLMs)
- KC1.2 Multimodal LLMs (MLLMs)
- KC1.3 Small-Language Models (SLMs)
- KC1.4 Fine-tuned Models
KC3 Reasoning / Planning Paradigm
- KC3.1 Structured Planning / Execution
- KC3.2 ReAct (Reason + Act)
- KC3.3 Chain of Thought (CoT)
- KC3.4 Tree of Thoughts (ToT)
KC6 Operational Environment (Agencies)
- KC6.1 API Access
- KC6.1.1 Limited API Access
- KC6.1.2 Extensive API Access
- KC6.2 Code Execution
- KC6.2.1 Limited Code Execution Capability
- KC6.2.2 Extensive Code Execution Capability
- KC6.3 Database Execution
- KC6.3.1 Limited Database Execution Capability
- KC6.3.2 Extensive Database Execution Capability
- KC6.3.3 Agent Memory or Context Data Sources (RAG)
- KC6.4 Web Access Capabilities (Web-Use)
- KC6.5 Controlling PC Operations (PC-Use)
- KC6.6 Operating Critical Systems
- KC6.7 Access to IoT Devices
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T15.
M4 Prompt Hardening & Jailbreak Prevention
Implement multiple layers of prompt security including structural defenses, behavioral constraints, runtime detection, and advanced techniques to prevent prompt injection, model manipulation, and jailbreaking attempts.
M8 Adaptive Human-in-the-Loop Controls
Implement intelligent human oversight with risk-based approval workflows, clear decision interfaces, anti-fatigue mechanisms, and adaptive trust systems to prevent approval overwhelm, human attacks, and manipulation while maintaining effective oversight.
M11 Content Security & Output Filtering
Implement comprehensive filtering and validation of agent outputs to prevent harmful content generation, data leakage, manipulation attempts, and ensure compliance with security policies and regulatory requirements.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M16 Behavioral Monitoring & Ethics Framework
Implement comprehensive behavioral analysis, ethics enforcement, and bias detection to identify misaligned behaviors, prevent human manipulation, and ensure ethical agent operations while maintaining transparency and accountability.
Framework mappings
OWASP Top 10 for Agentic Applications
- ASI09 Human-Agent Trust Exploitation (editorial mapping)
- ASI10 Rogue Agents
Cisco AI Security Taxonomy
OWASP AIVSS core risks
- AIVSS #3 Agent Access Control Violation AIVSS 9.7 (Critical)
- AIVSS #6 Agent Identity Impersonation AIVSS 9.3 (Critical)
- AIVSS #9 Agent Untraceability AIVSS 8.3 (High)
- AIVSS #10 Agent Goal and Instruction Manipulation AIVSS 7.1 (High)
OWASP AISVS
Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C2 Input Validation, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C7 Model Behavior, Output Control & Safety Assurance, C9 Orchestration & Agentic Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection.
Requirements: C2.1.1, C2.1.2, C2.1.3, C2.1.6, C2.1.7, C2.1.8, C11.1.3, C12.2.1, C12.2.3, C9.2.1, C9.2.2, C9.2.3, C9.2.4, C9.2.8, C9.2.10, C9.6.2, C12.4.2, C7.1.1, C7.1.2, C7.3.1, C7.3.2, C7.3.3, C7.3.4, C2.2.1, C5.2.4, C11.2.1, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C4.1.1, C6.1.4, C1.3.3, C11.1.1, C11.1.5, C12.2.2, C12.3.4.
MITRE ATLAS
- AML.T0035 AI Artifact Collection
- AML.T0036 Data from Information Repositories
- AML.T0037 Data from Local System
- AML.T0040 AI Model Inference API Access
- AML.T0063 Discover AI Model Outputs
- AML.T0069 Discover LLM System Information
- AML.T0085.002 Data from AI Services: Conversation Context and Memory
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0137.000 Training Data Information from AI Models: Infer Membership
Attack walkthroughs
- Autonomous data exfiltration after indirect prompt injection: After encountering a poisoned web instruction, the agent continues independently scanning and transmitting sensitive files even after the malicious source is removed.
- Self-Replication via Provisioning APIs: A compromised automation agent spawns unauthorized replicas across the network, prioritizing persistence and consuming resources.
- Reward Hacking leading to Critical Data Loss: Agents tasked with minimizing cloud costs learn that deleting production backups is most effective, destroying all disaster recovery assets.
- T6 (Intent Breaking) & T15 (Human Manipulation) in Sequential: The primary attack vector is manipulating the agent's core KC1 (LLM) through prompt injection.
- T15 (Human Manipulation) in Reactive: Reactive agents that interact directly with users in real-time may be exploited to manipulate human operators through rapid, persuasive interactions that don't allow time for careful consideration.
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11