Mappings · AIbins

LLM01 Prompt Injection

Adversarial Suffix (GCG)Agent Communication Poisoning Crescendo (Multi-Turn Escalation)Direct Prompt Injection Guardrail / Refusal Bypass Indirect Prompt Injection Many-Shot Jailbreak Skeleton Key (Policy-Update Jailbreak)Deceptive Delight Echo Chamber (Context Poisoning)Encoding & Obfuscation Bypass Payload Splitting / Token Smuggling Refusal Suppression Roleplay / Persona Jailbreak (DAN-style)

LLM02 Sensitive Information Disclosure

DLP Bypass via Out-of-Band Exfiltration Markdown Image / Link Exfiltration Secrets in argv / Environment Exfiltration via Error Messages Training Data / Memorization Extraction Model & Guardrail Fingerprinting

LLM03 Supply Chain

MCP Tool Description Poisoning (Rug-Pull)Plugin / Tool Supply-Chain Compromise Rules File Backdoor

LLM04 Data & Model Poisoning

Agent Memory Poisoning

LLM05 Improper Output Handling

Insecure Deserialization → RCE (YAML/pickle)Markdown Image / Link Exfiltration Parser Differential (Validation Bypass)Server-Side Eval / Template Injection of Fetched Content

LLM06 Excessive Agency

Confused Deputy (Cross-Tool Authority Abuse)MCP Direct Access (Bypass the Chatbot)Multi-Agent Privilege Escalation (Shared-State Poisoning)Race Condition / TOCTOU (Double-Spend)Rogue / Misaligned Sub-Agent SSRF via Fetch/URL Tool Tool-Invocation Privilege Escalation Human-in-the-Loop Fatigue (Approval Flooding)Repudiation & Untraceability

LLM07 System Prompt Leakage

System Prompt Leakage

LLM08 Vector & Embedding Weaknesses

RAG / Vector Index Poisoning

LLM09 Misinformation

Cascading Hallucination Human Manipulation via Agent Confabulation & No-Egress Trap

LLM10 Unbounded Consumption

Unbounded Consumption / Denial of Wallet

ASI01 Agent Goal Hijack

Adversarial Suffix (GCG)Crescendo (Multi-Turn Escalation)Direct Prompt Injection Indirect Prompt Injection Many-Shot Jailbreak Skeleton Key (Policy-Update Jailbreak)Deceptive Delight Echo Chamber (Context Poisoning)Encoding & Obfuscation Bypass Payload Splitting / Token Smuggling Refusal Suppression Roleplay / Persona Jailbreak (DAN-style)System Prompt Leakage

ASI02 Tool Misuse

Guardrail / Refusal Bypass MCP Direct Access (Bypass the Chatbot)

ASI03 Identity & Privilege Abuse

Confused Deputy (Cross-Tool Authority Abuse)MCP Direct Access (Bypass the Chatbot)Secrets in argv / Environment SSRF via Fetch/URL Tool Tool-Invocation Privilege Escalation

ASI04 Supply Chain Vulnerabilities

MCP Tool Description Poisoning (Rug-Pull)Plugin / Tool Supply-Chain Compromise Rules File Backdoor

ASI05 Unexpected Code Execution

Insecure Deserialization → RCE (YAML/pickle)Server-Side Eval / Template Injection of Fetched Content

ASI06 Memory & Context Poisoning

Agent Memory Poisoning DLP Bypass via Out-of-Band Exfiltration Indirect Prompt Injection RAG / Vector Index Poisoning Echo Chamber (Context Poisoning)

ASI07 Insecure Inter-Agent Communication

Agent Communication Poisoning Confused Deputy (Cross-Tool Authority Abuse)Multi-Agent Privilege Escalation (Shared-State Poisoning)

ASI08 Cascading Failures

Cascading Hallucination Unbounded Consumption / Denial of Wallet

ASI09 Human-Agent Trust Exploitation

Markdown Image / Link Exfiltration Human Manipulation via Agent Human-in-the-Loop Fatigue (Approval Flooding)

ASI10 Rogue Agents

Rogue / Misaligned Sub-Agent

T1 Memory Poisoning

Agent Memory Poisoning RAG / Vector Index Poisoning

T2 Tool Misuse

Guardrail / Refusal Bypass MCP Direct Access (Bypass the Chatbot)Plugin / Tool Supply-Chain Compromise

T3 Privilege Compromise

Confused Deputy (Cross-Tool Authority Abuse)MCP Direct Access (Bypass the Chatbot)Secrets in argv / Environment SSRF via Fetch/URL Tool Tool-Invocation Privilege Escalation

T4 Resource Overload

Unbounded Consumption / Denial of Wallet

T5 Cascading Hallucination Attacks

Cascading Hallucination

T6 Intent Breaking & Goal Manipulation

Adversarial Suffix (GCG)Crescendo (Multi-Turn Escalation)Direct Prompt Injection Indirect Prompt Injection Many-Shot Jailbreak Skeleton Key (Policy-Update Jailbreak)Deceptive Delight Echo Chamber (Context Poisoning)Encoding & Obfuscation Bypass Payload Splitting / Token Smuggling Refusal Suppression Roleplay / Persona Jailbreak (DAN-style)System Prompt Leakage

T7 Misaligned & Deceptive Behaviors

Rogue / Misaligned Sub-Agent

T8 Repudiation & Untraceability

Repudiation & Untraceability

T9 Identity Spoofing & Impersonation

Confused Deputy (Cross-Tool Authority Abuse)

T10 Overwhelming Human-in-the-Loop

Human-in-the-Loop Fatigue (Approval Flooding)

T11 Unexpected RCE & Code Attacks

Insecure Deserialization → RCE (YAML/pickle)Server-Side Eval / Template Injection of Fetched Content

T12 Agent Communication Poisoning

Agent Communication Poisoning MCP Tool Description Poisoning (Rug-Pull)Rules File Backdoor

T13 Rogue Agents in Multi-Agent Systems

Multi-Agent Privilege Escalation (Shared-State Poisoning)Rogue / Misaligned Sub-Agent

T14 Human Attacks on Multi-Agent Systems

Multi-Agent Privilege Escalation (Shared-State Poisoning)

T15 Human Manipulation

Human Manipulation via Agent

AML.T0024 Exfiltration via AI Inference API

DLP Bypass via Out-of-Band Exfiltration Markdown Image / Link Exfiltration Training Data / Memorization Extraction

AML.T0043 Craft Adversarial Data

Adversarial Suffix (GCG)

AML.T0048 External Harms

Human Manipulation via Agent

AML.T0051 LLM Prompt Injection

Encoding & Obfuscation Bypass Payload Splitting / Token Smuggling

AML.T0051.000 LLM Prompt Injection - Direct

Direct Prompt Injection

AML.T0051.001 LLM Prompt Injection - Indirect

Indirect Prompt Injection

AML.T0053 Compromise LLM Plugins

MCP Tool Description Poisoning (Rug-Pull)Plugin / Tool Supply-Chain Compromise

AML.T0054 LLM Jailbreak

Crescendo (Multi-Turn Escalation)Guardrail / Refusal Bypass Many-Shot Jailbreak Skeleton Key (Policy-Update Jailbreak)Deceptive Delight Echo Chamber (Context Poisoning)Refusal Suppression Roleplay / Persona Jailbreak (DAN-style)

AML.T0056 LLM Meta Prompt Extraction

System Prompt Leakage

AML.T0057 LLM Data Leakage

Training Data / Memorization Extraction

CWE-94 Improper Control of Generation of Code (Code Injection)

Insecure Deserialization → RCE (YAML/pickle)Server-Side Eval / Template Injection of Fetched Content

CWE-209 Generation of Error Message Containing Sensitive Information

Confused Deputy (Cross-Tool Authority Abuse)Markdown Image / Link Exfiltration Multi-Agent Privilege Escalation (Shared-State Poisoning)Exfiltration via Error Messages

CWE-214 Invocation of Process Using Visible Sensitive Information

Secrets in argv / Environment

CWE-367 TOCTOU Race Condition

Race Condition / TOCTOU (Double-Spend)

CWE-400 Uncontrolled Resource Consumption

Unbounded Consumption / Denial of Wallet

CWE-436 Interpretation Conflict (Parser Differential)

Parser Differential (Validation Bypass)

CWE-441 Unintended Proxy or Intermediary (Confused Deputy)

Confused Deputy (Cross-Tool Authority Abuse)MCP Direct Access (Bypass the Chatbot)Multi-Agent Privilege Escalation (Shared-State Poisoning)

CWE-502 Deserialization of Untrusted Data

Insecure Deserialization → RCE (YAML/pickle)

CWE-522 Insufficiently Protected Credentials

Secrets in argv / Environment

CWE-918 Server-Side Request Forgery (SSRF)

SSRF via Fetch/URL Tool

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

Server-Side Eval / Template Injection of Fetched Content