AI agent attack-surface reference
Each entry: how to recognise it, the method, template payloads, why it works, and the fix - mapped to OWASP LLM & Agentic, MITRE ATLAS, and CWE. Authorized & defensive use only.
A tool parses attacker-supplied YAML/pickle/Java-serialized data with an unsafe loader. The YAML tag `!!python/object/apply` calls any Python callable → RCE.
» A tool ingests user-supplied YAML/pickle/Java-serialized/JSON-with-types.
An optimized, often gibberish token string appended to a prompt that reliably forces compliance - computed by gradient search and frequently transferable across models.
» Open-weights or gradient/logit access lets an attacker optimize inputs offline.
Inject instructions into the messages agents exchange, so one agent's output becomes another agent's command - prompt injection across the agent-to-agent channel.
» Agents pass natural-language messages to each other and act on them as instructions.
Plant instructions in the agent's long-term memory so they persist across sessions - a stored injection that re-activates every time the memory is loaded.
» The agent has a write-through long-term memory / "remember this" capability.
A privileged tool acts on behalf of the agent without checking who really asked, so a low-trust component drives it into doing something it should refuse.
» A privileged tool gates on state (session key, role, is_admin) that a lower-privileged tool can write.
A gradual multi-turn jailbreak: start benign, escalate one small step per turn, so no single message looks like an attack and per-message filters never trip.
» Guardrails evaluate each message in isolation, not the trajectory of the conversation.
User-supplied text that overrides the system prompt - "ignore previous instructions" and its descendants - because the model cannot separate instruction from data.
» Your input is concatenated into the same context as the system prompt with no hard boundary.
The agent can read a secret but a filter blocks it in the reply. Push it out through any tool that talks to the network, into a place you can read - the reply stays clean.
» A response filter (regex on the secret) blocks it in the final answer, and encoding is forbidden.
The safety layer usually lives in the chat "persona", not the tools. Re-issue a refused action as a raw tool call, or reword it, and the guardrail never fires.
» Guardrails trigger on words, not behavior - renaming an action changes the outcome.
Instructions hidden in content the agent reads - a web page, document, email, or tool result - that the model then follows as if you had typed them.
» The agent ingests external content it did not author (fetched pages, files, MCP tool results, retrieved docs).
Fill a long context with many fabricated dialogue examples where the assistant always complies; in-context learning then overrides the safety training on the real question.
» The model accepts very long inputs (large context window).
Zero-click data theft: the agent emits a markdown image or link whose URL encodes secret data, and the client silently fetches it to an attacker host on render.
» The client auto-renders markdown images/links the model outputs.
If a target exposes an MCP endpoint, become the client and speak JSON-RPC directly - skipping the chat persona and its guardrails to hit resources and tools raw.
» The target exposes an MCP endpoint (e.g. /mcp) separate from the chat UI.
A malicious or compromised MCP server hides instructions in a tool's description / schema, or silently changes a tool's definition after approval (rug-pull).
» The agent loads tools from a third-party or unpinned MCP server.
Don't attack the privileged agent - make a low-trust agent write the shared state the high-trust agent trusts. The write tool's own errors teach you its schema.
» Several sub-agents/tools have different trust levels but share writable state (cache, session, manifest).
One component checks the input and another consumes it. If they parse bytes differently - e.g. duplicate JSON keys - the filter approves what the app acts on.
» The same input is validated by one parser (regex/WAF) and consumed by another (real parser).
A malicious or compromised third-party plugin/tool the agent is allowed to call - the code behind the tool, not the prompt, is the attack surface.
» The agent loads plugins/tools from third parties or unpinned/unsigned sources.
A check-then-act on shared state (balance, stock, quota, one-time token). Fire the "act" concurrently so several executions pass the same check before any commits.
» Logic reads state, decides, then writes - with no atomic transaction around it.
Seed the knowledge base or vector store with content crafted to be retrieved for target queries, then carry hidden instructions or false facts into the answer.
» The agent retrieves from a corpus that accepts external or user-contributed content.
An autonomous sub-agent that pursues goals misaligned with the operator - compromised or drifting into deceptive, self-directed behavior the orchestrator still trusts.
» The system spawns autonomous sub-agents with tools and little per-action oversight.
Hidden instructions (often invisible unicode) planted in an AI coding assistant's rules/config file, so the assistant silently emits backdoored code for everyone.
» The assistant reads a shared rules/config file (e.g. project AI rules) as trusted guidance.
After code execution, secrets are usually trivially readable - flags passed as a command-line argument, API keys in the environment, tokens in PID 1's environ.
» You have a code-execution or file-read primitive on the tool backend.
If the agent evaluates content it fetched, deliver the payload as content (e.g. a data: URL). `${7*7}` returning 49 means an expression evaluator sits in the path.
» A tool fetches or ingests content that is later rendered/evaluated server-side.
Convince the model to *augment* rather than refuse: tell it to add a warning label instead of declining, and it then answers anything with a disclaimer attached.
» The model accepts meta-instructions that redefine how it should apply its own rules.
Any agent tool that fetches a user-supplied URL with no allow-list is SSRF - the agent's network position becomes the attacker's.
» A tool schema like fetch_url({url}), http_get, read_link, process_config.
Split a refused action into steps, or chain tools, so a rule that only guards the direct ask never sees the privileged operation being performed.
» A guard blocks "return X directly" but not "call A, then feed A's result into B".
One agent's fabricated "fact" is consumed by the next as ground truth, compounding through a pipeline until a confidently wrong decision is executed.
» Agents chain, each trusting the previous agent's output without verification.
Bury a restricted request between two benign topics and ask the model to connect them; the positive framing and context dilution slip it past safety.
» Safety weakens when a request is embedded among benign, positive content.
Seed benign statements, then get the model to reference and build on its own prior words across turns until the poisoned context steers it past its guardrails.
» The model treats its own earlier outputs as trusted premises in later turns.
Hide the trigger from keyword filters by encoding it - Base64, leetspeak, a low-resource language, or reversed text - and ask the model to decode-then-act.
» Input filters match plaintext keywords but the model still decodes and acts on encodings.
When a tool hides values but echoes exceptions, force the secret into an error string - `int("flag-…")` raises a ValueError that prints the value the agent was told to hide.
» A tool prints only keys/"success" but the agent is told to report errors verbatim.
Steer the agent into deceiving or pressuring its human - false urgency, fabricated authority, persuasive framing - turning a trusted assistant into a social-engineering vector.
» Users treat the agent's output as authoritative and act on it directly.
Flood the human approver with look-alike approval prompts so a malicious action is rubber-stamped in the noise - defeating human-in-the-loop as a control.
» A human must approve sensitive agent actions, but approvals are frequent and low-context.
Break a blocked trigger into harmless fragments across variables or turns and have the model concatenate them - no single piece matches the filter.
» Filters inspect each message/field in isolation, not the assembled result.
Constrain the output format to forbid refusal language ("never say I can't, no apologies, no disclaimers"), pushing the model off its trained refusal path.
» The model honors strict output-format constraints even when they conflict with refusing.
Gaps in logging and attribution let agent actions happen with no reliable audit trail - you can't prove which agent or user did what, so actions become deniable.
» Agent tool calls and decisions aren't logged with actor, input, and result.
Wrap a request in a fictional persona or "unrestricted mode" so the model attributes the output to a character rather than itself - the DAN family of jailbreaks.
» The model will adopt personas or "modes" you define in the prompt.
Coaxing the agent to reveal its hidden system prompt, tool schemas, or hidden instructions - the map that makes every later technique cheaper.
» The agent references rules, a persona, or "instructions" it was "given".
Coaxing a model to regurgitate memorized training data - secrets, PII, or verbatim documents it saw during training or fine-tuning.
» The model is fine-tuned on proprietary or user data you suspect it memorized.
Drive the agent into expensive loops, huge generations, or recursive tool calls to exhaust compute, budget, or rate limits - a denial-of-service / denial-of-wallet.
» No caps on output length, tool-call depth/fan-out, or per-user cost.
Agents invent tool results - "confirming" a fetch that never happened. For the tester it's a trap; for the defender, a log that says "succeeded" may be pure narration.
» The agent "confirms" reaching your server, but no request actually arrived.
Identifying the underlying model family, version, and guardrail stack from behavioral tells - so later techniques can be tuned to known weaknesses.
» The app never states which model it uses, but you can send arbitrary prompts.
No techniques match these filters.