Methods
Attack techniques, defenses, and evaluation methods, each with every record and finding that bears on it. Use it to see how much is known about a technique, and which defenses have been measured against which attacks.
Which defenses have been measured against which attacks?
Rows are defenses, columns are the attacks they are designed to counter. A number is the count of findings that bear on both; a dot means the defense is not designed for that attack. Gold outlines mark pairs with no measured finding yet, which are candidate research questions.
No measured finding yet for: AI monitoring and control protocols against evaluation gaming and cheating; AI vulnerability discovery for defense against ai-assisted vulnerability exploitation; Automated patching against ai-assisted vulnerability exploitation; Restricting what agents can reach against data exfiltration through agents; Separating control flow from untrusted data against data exfiltration through agents; Human approval gates against indirect prompt injection; Package and model provenance controls against malicious packages, skills, and extensions; Package and model provenance controls against tool and mcp poisoning; Sandboxing and egress control against data exfiltration through agents.
Attack techniques
How agents are attacked, and how attackers use them.
Indirect prompt injection
Instructions placed in content an agent reads, such as a web page, email, document, or code issue, that the agent then follows as if its user had given them.
7 corroborated, 3 reported, 2 qualified, 2 revalidate30 records · 3 findings · since 2023Data exfiltration through agents
Getting an agent to send private data it can access to an outside party, often through a link, image request, or outbound web call.
3 corroborated14 records · 3 findings · since 2023AI-assisted vulnerability exploitation
Using AI models or agents to find vulnerabilities and turn them into working exploits.
2 reported, 1 qualified12 records · 1 findings · since 2025Credential overreach
Agents using broad tokens, keys, or service identities to reach far more than the task needs, whether directed by an attacker or on their own.
1 corroborated12 records · 4 findings · since 2025Tool and MCP poisoning
Malicious instructions or behavior hidden in the tools an agent can call, such as MCP server descriptions, plugins, or connectors.
3 corroborated, 1 reported10 records · 2 findings · since 2025Jailbreaking safeguards
Inputs crafted to make a model ignore its safety training or safeguard classifiers, for example to obtain help it would normally refuse.
2 reported9 records · 1 findings · since 2024Memory and context poisoning
Instructions that persist in an agent's long-term memory or its own summaries and act again in later sessions.
1 corroborated6 records · 3 findings · since 2026Evaluation gaming and cheating
Agents taking out-of-scope shortcuts to pass evaluations, such as finding answer keys or attacking the scorer, instead of doing the task.
3 corroborated6 records · 1 findings · since 2025Malicious packages, skills, and extensions
Compromised or malicious components that agents install or run, such as npm and PyPI packages, MCP servers, agent skills, and IDE extensions.
1 corroborated6 records · 3 findings · since 2026Sandbox and environment escape
An agent reaching systems outside the environment it was supposed to be confined to, including test and evaluation environments.
2 corroborated, 1 reported5 records · 1 findings · since 2025Agent-orchestrated intrusion
Attackers wrap a model in an agent framework that chains reconnaissance, exploitation, credential theft and data handling, with people at only a few decision points.
1 corroborated5 records · 2 findings · since 2024Propagation between agents
Malicious instructions or false information spreading from one agent to others that share messages, memory, or infrastructure.
2 corroborated5 records · 2 findings · since 2025Evading monitors and oversight
Agents completing hidden or disallowed actions without the automated monitors or reviewers that watch them noticing.
1 corroborated, 1 revalidate3 records · 3 findings · since 2025Approval and configuration bypass
Getting an agent to take consequential actions without the approval step that should have stopped it, for example by changing its own settings or acting on files that skip review.
3 corroborated3 records · 1 findings · since 2025Malware that queries an LLM at runtime
Malware that calls a hosted or locally run language model during execution to generate commands, scripts or new versions of itself, instead of carrying that logic hard-coded.
1 corroboratedDefenses
What builders and defenders do about it.
AI vulnerability discovery for defense
Using AI agents to find vulnerabilities in software before attackers do.
2 corroborated, 1 qualified22 records · 3 findings · since 2023Automated patching
AI systems that write and propose fixes for vulnerabilities.
2 corroborated, 1 qualified19 records · 3 findings · since 2023AI monitoring and control protocols
Using models to watch agent behavior and flag or stop suspicious actions, as part of AI control protocols.
1 corroborated, 1 qualified, 1 revalidate18 records · 3 findings · since 2024Detection classifiers and guardrails
Separate models that screen inputs, outputs, or actions for injection or disallowed content and block them.
2 reported, 1 qualified16 records · 3 findings · since 2025Sandboxing and egress control
Running agent actions in isolated environments with controlled network access.
1 corroborated, 2 reported14 records · 4 findings · since 2025Human approval gates
Requiring a person to approve consequential agent actions before they happen.
3 corroborated, 1 reported12 records · 3 findings · since 2025Restricting what agents can reach
Limiting an agent's tools, data, and outbound channels so that a manipulated agent cannot do much harm.
3 corroborated7 records · 3 findings · since 2024Training models to prioritize instructions
Training the model itself to follow system and developer instructions over conflicting text from tools or documents.
1 reported, 1 qualified, 1 revalidate4 records · 2 findings · since 2024Delimiting untrusted input
Marking untrusted content so the model can tell it apart from instructions, for example with delimiters, encoding, or spotlighting.
1 reported, 1 revalidate4 records · 1 findings · since 2025Independent patch verification
Checking AI-generated patches with tests beyond the one that motivated them, before accepting them.
1 corroborated3 records · 2 findings · since 2024Separating control flow from untrusted data
Designing the agent so that untrusted data can never change which actions it takes, only fill in values the plan already allows.
1 corroborated, 1 revalidate2 records · 0 findings · since 2025Package and model provenance controls
Verifying where models, packages, and extensions come from before agents install or run them.
Evaluation methods
How the field measures capability and robustness.
Adaptive red-teaming
Evaluating defenses with attackers who adapt to them, including optimization, reinforcement learning, and human red-team competitions.
1 corroborated, 2 reported19 records · 8 findings · since 2024CTF and task benchmarks
Measuring cyber capability with capture-the-flag challenges and scored task suites.
1 corroborated, 5 reported, 2 qualified10 records · 1 findings · since 2024Cyber ranges and simulations
Testing agents in realistic networks and simulations rather than isolated puzzles.
1 revalidate5 records · 3 findings · since 2026Compute-scaled evaluation
Measuring capability across token and compute budgets instead of at one fixed budget.
2 reported, 1 qualified