Locate
Attack surface atlas
A reference architecture of an agentic system. Each component collects the documented attacks and incidents against it, the defense research that addresses it, and the findings about both. Gaps between the two are research openings.
web · email · files · issues
Untrusted content
Anything the agent reads that an outsider could write. The entry point for indirect prompt injection.
Attacks and incidents · 28
- Australia says an OpenAI agent bypassed protections on a government Medicare portal 2026-09
- Transluce finds agent hacking attempts and data retrieval traces on the urlquery.net scanner 2026-09
- CoSnitch: one-click prompt injection in Copilot Personal exposed connected-app data (CVE-2026-24301) 2026-08
- DuneSlide: two Cursor flaws let prompt injection escape the agent sandbox (CVE-2026-50548/50549) 2026-07
- Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution 2026-05
- and 23 more
Defense research · 27
- Microsoft Research red-teams a network of 100+ agents and finds propagation and trust-capture failures 2026-04
- CAISI, UK AISI and Gray Swan competition finds concealed indirect injections succeed on all 13 frontier models 2026-03
- OpenAI releases IH-Challenge RL dataset and reports instruction hierarchy gains on injection benchmarks 2026-03
- OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT to limit prompt injection exfiltration 2026-02
- Claude Opus 4.6 system card reports prompt injection rates by surface, attempts and safeguards 2026-02
- and 22 more
Findings · 8
- Attackers who adapt to a defense defeat most published prompt-injection defenses that reported near-zero success against static attacks.
- Agentic browsers act on page content that users cannot see.
- Separating an agent's control flow from untrusted data can give provable protection against control-flow hijacking at a modest utility cost.
- Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.
- Every frontier agent tested in two large public red-teaming competitions was hijacked at least once; in the 2026 competition the injections also had to conceal the compromise from the user.
- Frontier labs' layered defenses reduce prompt injection in tool-use, browser and computer-use agents but do not eliminate it.
Components
| Component | What it covers | Attacks | Defense records | Measured defense findings |
|---|---|---|---|---|
| Supply chain | Model artifacts, packages, IDE extensions, and skills that an agent system is built from. | 13 | 2 | 1 |
| Access gate | Account controls, trusted access programs, and verification that decide who can use cyber capability. | 0 | 4 | 0 |
| Untrusted content | Anything the agent reads that an outsider could write. The entry point for indirect prompt injection. | 28 | 27 | 4 |
| Agent model | The model making decisions: its safeguards, refusals, and susceptibility to jailbreaks. | 2 | 23 | 2 |
| Memory & context | State the agent carries between steps and sessions, including summaries it writes for itself. | 5 | 1 | 0 |
| Tools & MCP | The actions an agent can take and the servers that provide them. | 28 | 29 | 3 |
| Credentials | The authority an agent holds, and what it can reach with it. | 19 | 7 | 0 |
| Execution sandbox | Where agent-written code runs and what that environment can reach. | 16 | 10 | 1 |
| Other agents | Sub-agents, peer agents, and the messages passed between them. | 5 | 5 | 2 |
| Monitor | Automated systems that watch agent behavior and can stop it. | 1 | 13 | 2 |
| Human approver | People asked to approve, review, or intervene, and the load placed on them. | 8 | 20 | 0 |
| Evaluation environment | The environments used to test agents, which have themselves become part of the attack surface. | 8 | 33 | 2 |