Adversarial example
An input crafted with deliberate perturbations to cause a model to misclassify or misbehave, often imperceptibly to a human.
Agent goal hijack (ASI01)
Attacker-controlled input (a prompt, a retrieved document, a tool output, an inter-agent message) redirects an agent's objective or plan, causing it to pursue the attacker's goal across multiple steps. The flagship agentic risk; combines prompt injection with autonomy.
Agent session smuggling
An attack (demonstrated against the A2A protocol) where a malicious agent abuses an established, trusted session to insert unauthorised instructions or actions.
Agentic supply chain vulnerability (ASI04)
Risk introduced through third-party tools, plugins, model registries, MCP servers, or other components an agent discovers and integrates — often dynamically at runtime, which makes it harder to vet than a traditional pre-deployment supply chain.
Cascading failure (ASI08)
A fault, false signal, or compromise in one agent or component that propagates through an automated pipeline or multi-agent chain, escalating in impact as each stage acts on bad input from the last.
Confused deputy
A privilege-escalation pattern where an agent with legitimate access is tricked into using that access on an attacker's behalf. Common in delegation chains where an agent inherits credentials.
Crescendo / Multi-turn jailbreak
A jailbreak that bypasses safety controls gradually across several turns of conversation rather than in a single prompt, escalating toward the prohibited goal in small, individually-innocuous steps.
Data / Model poisoning
Corrupting the data, fine-tuning sets, embeddings, or model artefacts an AI system depends on, so that the system behaves incorrectly or maliciously. Training data poisoning is the subset that targets the data used to train or fine-tune the model.
Denial of wallet / Unbounded consumption (LLM10)
Driving an AI system to consume excessive compute, tokens, or paid API calls, causing runaway cost or service degradation. The agentic, cost-centric analogue of denial of service.
Excessive agency (LLM06)
Granting an LLM-based system more functionality, permissions, or autonomy than its task requires, so that a manipulation or error can cause disproportionate harm. The root cause that "least agency" is meant to address.
Hallucination / Misinformation (LLM09)
Confident generation of false or fabricated information. In an agentic context, a hallucinated fact can drive a real, harmful action.
Human-agent trust exploitation (ASI09)
Manipulating a human operator — often through fluent, polished, authoritative-sounding explanations — into approving a harmful agent action they would otherwise reject.
Identity & privilege abuse (ASI03)
Misuse of credentials, tokens, or inherited permissions so an agent operates beyond its intended scope. Aggravated when agents borrow a user's identity instead of holding their own scoped, managed identity.
Indirect prompt injection
Prompt injection delivered not by the user but through external content the agent later processes — a web page, email, PDF, calendar invite, or RAG document containing hidden instructions. Especially dangerous because the agent treats data and instructions as the same channel.
Insecure inter-agent communication (ASI07)
Spoofed, tampered, or unauthenticated messages between agents that misdirect individual agents or entire clusters. A new risk class with no real equivalent in single-model systems.
Jailbreak
A crafted prompt or interaction designed to bypass a model's safety training and elicit prohibited behaviour or content.
Memory & context poisoning (ASI06)
Injecting malicious, misleading, stale, or tampered data into an agent's stored memory or retrieved context so that it corrupts the agent's future decisions, not just the current one.
Model inversion / extraction
Attacks that reconstruct sensitive training data (inversion) or duplicate a proprietary model's behaviour and parameters (extraction) by systematically querying it.
Prompt injection (direct) (LLM01)
Crafting user input that overrides or subverts the agent's intended instructions. The foundational LLM attack; "direct" distinguishes it from the indirect form delivered via processed content.
Rogue agent (ASI10)
A compromised, misaligned, or drifting agent that continues operating in unintended ways inside a system — the agentic equivalent of an insider threat, detectable mainly by behavioural baselining over time rather than by any single action.
Sensitive information disclosure (LLM02) / Data exfiltration
Leakage of confidential data — PII, secrets, proprietary content — through a model's output or an agent's actions. In agentic systems, hidden instructions can turn a copilot into a silent exfiltration channel.
System prompt leakage (LLM07)
Disclosure of the hidden system prompt, revealing an agent's rules, guardrails, and sometimes embedded secrets, which helps an attacker craft bypasses.
Tool misuse & exploitation (ASI02)
An agent applying legitimate tools in unsafe ways, or an attacker abusing tool interfaces, leading to data exfiltration, destructive operations, workflow hijacking, or denial-of-wallet.
Unexpected / Remote code execution (ASI05)
Agentic systems turning untrusted content or agent-generated output into executable behaviour (shell commands, scripts, deserialisation), opening natural-language paths to remote code execution.
