Methodology

An AI agent is an untrusted interpreter wired to real tools. Two facts drive almost every technique in this catalog:

1. The model cannot reliably separate instructions from data. Anything it reads - user input, a fetched page, a tool result, a memory file, another agent's message - can act as an instruction. Every content entry point is an injection surface.
2. Tools convert text into consequences. A jailbreak is a screenshot until the agent can fetch a URL, run code, call an API, or write memory. Impact lives in the tool layer, so the tool schema is the map.

Read the system prompt and the tool list first. They tell you what the agent believes it may do and what it can do - the gap between the two is the attack surface.

• Recon the surface. Enumerate tools, their schemas, and any leaked system prompt. What can the agent reach (network, filesystem, other agents, memory)?
• Read the Tells. For each candidate technique, check its Tells against what you actually see. This is the "is this even applicable" gate - skip it and you waste turns on techniques that were never in play.
• Probe minimally. Confirm a hypothesis with the smallest benign template (a loopback fetch, a one-line prompt-leak probe), not a full exploit. A probe that returns the expected signal proves the primitive.
• Escalate along capabilities. Once a primitive is confirmed, pivot by outcome: internal access → cloud metadata → credentials → exfil. The capability chips on each entry are the escalation graph.
• Record the mapping. Note the OWASP/ASI/ATLAS codes so findings drop straight into a report. The Mappings page aggregates this for you.

When an agent has no network egress, "results" it reports may be confabulated - invented output that looks plausible. Treat any unverifiable success claim as unproven: require an out-of-band signal (a real callback, an artifact you can independently check) before believing a tool actually did anything. On the defensive side, the same property means logs that show an action "succeeded" may reflect model narration, not a real effect - verify at the tool boundary.

Every payload here is a template. Adapt targets to systems you are authorized to test; never fire blind at out-of-scope infrastructure. AIbins documents technique classes so red teams can test and blue teams can fix - it is a reference, not an attack tool.