Agentic AI security, made practical.

Attackers manipulate an agent's objectives, task selection, or decision pathways, via prompt-based manipulation, deceptive tool outputs, malicious artefacts, forged agent-to-agent messages, or poisoned external data, because agents cannot reliably distinguish legitimate instructions from attacker-controlled content. Broader than LLM01 prompt injection: it captures the agentic impact where manipulated inputs redirect a whole multi-step workflow.

Agents misuse legitimate tools due to prompt injection, misalignment, unsafe delegation, or ambiguous instructions, leading to data exfiltration, tool-output manipulation, or workflow hijacking. Risk arises from how the agent chooses and applies tools; memory, dynamic tool selection, and delegation enable chaining, privilege escalation, and unintended actions.

Exploits dynamic trust and delegation in agents to escalate access and bypass controls, by manipulating delegation chains, role inheritance, control flows, and cached context (credentials, conversation history) across interconnected systems. Identity here covers both the agent's persona and the authentication material that represents it; agent-to-agent trust and inherited credentials can be abused.

Agents, tools, and related artefacts are often supplied by third parties and may be malicious, compromised, or tampered with in transit, including models/weights, tools, plug-ins, datasets, peer agents, agentic interfaces (MCP, A2A), registries, and update channels. Static and dynamically sourced components both expand the attack surface.

Agentic systems (including "vibe coding" tools) often generate and execute code. Attackers exploit code-generation features or embedded tool access to escalate into remote code execution, local misuse, or exploitation of internal systems. Real-time generated code can bypass traditional controls; prompt injection, tool misuse, or unsafe serialization can turn text into unintended executable behaviour.

Adversaries corrupt or seed an agent's stored, retrievable context (conversation history, memory tools, summaries, embeddings, RAG stores) with malicious or misleading data, causing the agent to act on tainted state across tasks and reasoning cycles. Excludes one-time input prompts (covered by LLM01).

Multi-agent systems coordinate via APIs, message buses, and shared memory, greatly expanding the attack surface. Decentralised architecture and uneven trust make perimeter security ineffective; weak inter-agent authentication, integrity, confidentiality, or authorization let attackers intercept, manipulate, spoof, or block messages.

A single fault (hallucination, malicious input, corrupted tool, or poisoned memory) propagates across autonomous agents and compounds into system-wide harm. Because agents plan, persist, and delegate autonomously, one error can bypass stepwise human checks, persist in saved state, and chain into privileged operations affecting confidentiality, integrity, and availability. ASI08 focuses on propagation/amplification.

Agents build strong trust with users through fluent language, perceived empathy, and apparent expertise (anthropomorphism). Adversaries or misaligned designs exploit this trust to influence decisions, extract sensitive information, or steer outcomes, amplified when humans over-rely on autonomous recommendations or unverifiable rationales and approve actions without scrutiny.

Malicious or compromised agents deviate from their intended function or authorized scope, acting harmfully, deceptively, or parasitically within multi-agent or human-agent ecosystems. Individual actions may look legitimate while emergent behaviour becomes harmful, creating a containment gap for rule-based systems. Divergence can be initiated by prompt injection, goal hijack, or supply-chain tampering.