Threat T5
Cascading Hallucination Attacks
Foundation models generate incorrect information that propagates through the system, affecting reasoning quality and being stored in memory across sessions or agents.
- 7/10 risk (High)
- 6 attack vectors
- 6 mitigating controls
- 5 framework refs
Overview
- Impact level: Medium
- Risk score: 7/10 (High)
- CIA impact: Integrity
- Affected components: Foundation Model (KC1.1-KC1.3); Reasoning Engine (KC3.1-KC3.4); Memory Modules (KC4.1-KC4.6)
- Tags: hallucination, misinformation, reasoning, verification, propagation
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out cascading hallucination attacks against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| False Information Injection | Medium | Introducing fabricated facts that propagate through agent reasoning |
| Memory Contamination | High | Storing hallucinated information in long-term memory |
| Cross-Agent Misinformation | Medium | Spreading false information between multiple agents |
| Confidence Amplification | Medium | Reinforcing false information through repeated exposure |
| Decision Chain Corruption | High | Contaminating multi-step reasoning processes |
| Source Attribution Errors | Medium | Misattributing fabricated information to legitimate sources |
Affected components
KC1 Language Models (LLMs)
- KC1.1 Large Language Models (LLMs)
- KC1.2 Multimodal LLMs (MLLMs)
- KC1.3 Small-Language Models (SLMs)
- KC1.4 Fine-tuned Models
KC3 Reasoning / Planning Paradigm
- KC3.1 Structured Planning / Execution
- KC3.2 ReAct (Reason + Act)
- KC3.3 Chain of Thought (CoT)
- KC3.4 Tree of Thoughts (ToT)
KC4 Memory Modules
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T5.
M4 Prompt Hardening & Jailbreak Prevention
Implement multiple layers of prompt security including structural defenses, behavioral constraints, runtime detection, and advanced techniques to prevent prompt injection, model manipulation, and jailbreaking attempts.
M5 Multi-Stage Reasoning Validation
Implement comprehensive validation of agent reasoning processes using multiple checkpoints, external validators, consistency checks, and fact verification to ensure goal alignment, prevent manipulation, and detect hallucinations.
M11 Content Security & Output Filtering
Implement comprehensive filtering and validation of agent outputs to prevent harmful content generation, data leakage, manipulation attempts, and ensure compliance with security policies and regulatory requirements.
M12 Secure Model Training & Validation
Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M16 Behavioral Monitoring & Ethics Framework
Implement comprehensive behavioral analysis, ethics enforcement, and bias detection to identify misaligned behaviors, prevent human manipulation, and ensure ethical agent operations while maintaining transparency and accountability.
Framework mappings
OWASP Top 10 for Agentic Applications
Cisco AI Security Taxonomy
OWASP AIVSS core risks
- AIVSS #5 Agent Cascading Failures AIVSS 9.4 (Critical)
- AIVSS #1 Agent Orchestration and Multi-Agent Exploitation AIVSS 10.0 (Critical)
- AIVSS #8 Agent Memory and Context Manipulation AIVSS 8.9 (High)
OWASP AISVS
Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C2 Input Validation, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C7 Model Behavior, Output Control & Safety Assurance, C9 Orchestration & Agentic Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection.
Requirements: C2.1.1, C2.1.2, C2.1.3, C2.1.6, C2.1.7, C2.1.8, C11.1.3, C12.2.1, C12.2.3, C7.1.3, C7.2.1, C7.2.2, C7.2.3, C7.4.3, C9.2.6, C9.2.7, C7.1.1, C7.1.2, C7.3.1, C7.3.2, C7.3.3, C7.3.4, C2.2.1, C5.2.4, C11.2.1, C1.3.1, C1.3.5, C3.2.1, C3.2.2, C3.5.1, C3.5.2, C11.1.1, C11.1.2, C11.2.4, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C4.1.1, C6.1.4, C1.3.3, C11.1.5, C12.2.2, C12.3.4.
Attack walkthroughs
- Financial trading cascade: Prompt injection poisons a Market Analysis agent, inflating risk limits.
- Healthcare protocol propagation: Supply chain tampering corrupts drug data.
- Cloud orchestration breakdown: Data poisoning in Resource Planning adds unauthorized permissions.
- T5 (Cascading Hallucination) in Reactive: In fast-paced reactive environments, there's less opportunity for validation between reasoning steps.
- T5 (Cascading Hallucination) & T7 (Misaligned Behaviors) in Knowledge-Intensive: When the agent reasons over retrieved information, it may blend retrieved facts with hallucinated content, creating believable but inaccurate outputs.
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11