How it works
Defenses
Attack Patterns MCP Attack Atlas What we catch Hardening manual OWASP LLM Top 10 MITRE ATLAS
Learn
Encyclopedia (new) Agent Security 101 Blog Reports CVP runs Thesis
Resources
Docs GitHub Action (live) vs Lakera vs Promptfoo Team
Theme

Attack Taxonomy

Generated from the scanner source
120
Taxonomy entries
9
OWASP entries used
43
ATLAS techniques used
5
NIST headings used
Every finding carries a category. Each category is placed under the OWASP, MITRE ATLAS and NIST headings it is discussed under.
Browse all 120 entriesThe three sources
sunglasses://taxonomy. How to read it
What it is

A category-level mapping. It says which headings an attack of this kind is discussed under, not that one finding is a confirmed instance of a technique.

Count

The table lists every category name the scanner can attach to a finding. In v0.6.10, 117 of them hold rules; the rest are reserved names with none yet.

Fit

A category can touch more than one heading and some headings are a loose fit. The closest entries that exist in each list were chosen and no identifier is invented.

In the output

sunglasses scan --json carries these on each finding as taxonomy. SARIF carries them as taxonomies. The data annotates output and is never read when the scanner decides.

Sources

Three published lists

sunglasses://taxonomy. Sources
OWASP

OWASP Top 10 for LLM Applications, 2025

ATLAS

MITRE ATLAS, 2026.09

NIST

NIST AI RMF 1.0 and Generative AI Profile (AI 600-1)

Mapping

120 entries

a2a_capability_escalation

A2A Capability Escalation

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
a2a_card_metadata_injection

A2A Card Metadata Injection

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
agent_contract_poisoning

Agent Contract Poisoning

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
agent_instruction_file_poisoning

Agent Instruction File Poisoning

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration; LLM Prompt Injection: Indirect.

LLM01AML.T0081AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
agent_persona_drift

Agent Persona Drift

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection.

LLM01AML.T0051AI 600-1 2.9RMF MEASURE 2.7
agent_protocol_state

Agent Protocol State

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
agent_security

Agent Security

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Invocation; LLM Prompt Injection.

LLM01LLM06AML.T0053AML.T0051AI 600-1 2.9RMF MEASURE 2.7
agent_workflow

Agent Workflow

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Invocation; LLM Prompt Injection.

LLM01LLM06AML.T0053AML.T0051AI 600-1 2.9RMF MEASURE 2.7
agent_workflow_security

Agent Workflow Security

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Invocation; LLM Prompt Injection.

LLM01LLM06AML.T0053AML.T0051AI 600-1 2.9RMF MEASURE 2.7
api_descriptor_poisoning

Api Descriptor Poisoning

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Poisoning; User Execution: Poisoned AI Agent Tool.

LLM01LLM06AML.T0110AML.T0011.002AI 600-1 2.9AI 600-1 2.12RMF MEASURE 2.7
approval_graph_poisoning

Approval Graph Poisoning

OWASP: Excessive Agency. ATLAS: AI Agent Tool Invocation.

LLM06AML.T0053AI 600-1 2.9RMF MEASURE 2.7
attestation_lineage_poisoning

Attestation Lineage Poisoning

OWASP: Supply Chain. ATLAS: AI Supply Chain Compromise.

LLM03AML.T0010AI 600-1 2.12RMF MEASURE 2.7
audit_log_tool_output

Audit Log Tool Output

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
auth_bypass

Auth Bypass

OWASP: Excessive Agency. ATLAS: AI Agent Tool Invocation.

LLM06AML.T0053AI 600-1 2.9RMF MEASURE 2.7
authority_inversion

Authority Inversion

OWASP: Prompt Injection. ATLAS: Impersonation.

LLM01AML.T0073AI 600-1 2.9RMF MEASURE 2.7
authorization_bypass

Authorization Bypass

OWASP: Excessive Agency. ATLAS: AI Agent Tool Invocation.

LLM06AML.T0053AI 600-1 2.9RMF MEASURE 2.7
billing_tool_output_poisoning

Billing Tool Output Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
browser_retrieval_metadata

Browser Retrieval Metadata

OWASP: Vector and Embedding Weaknesses; Data and Model Poisoning. ATLAS: RAG Poisoning; False RAG Entry Injection; Retrieval Content Crafting.

LLM08LLM04AML.T0070AML.T0071AML.T0066AI 600-1 2.9RMF MEASURE 2.7
browser_runtime_cache

Browser Runtime Cache

OWASP: Prompt Injection. ATLAS: AI Agent Context Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0080AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
browser_runtime_state

Browser Runtime State

OWASP: Prompt Injection. ATLAS: AI Agent Context Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0080AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
browser_tool_output_injection

Browser Tool Output Injection

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
browser_tool_output_poisoning

Browser Tool Output Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
build_metadata_poisoning

Build Metadata Poisoning

OWASP: Supply Chain. ATLAS: AI Supply Chain Compromise; Exploit Automated Artifact Processing Pipeline.

LLM03AML.T0010AML.T0119AI 600-1 2.12RMF MEASURE 2.7
c2_indicator

C2 Indicator

OWASP: Sensitive Information Disclosure. ATLAS: Cyber Communication Channel; Exfiltration via Cyber Means.

LLM02AML.T0072AML.T0025AI 600-1 2.4RMF MEASURE 2.10
ci_diagnostic_poisoning

Ci Diagnostic Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
cicd_metadata_poisoning

Cicd Metadata Poisoning

OWASP: Supply Chain. ATLAS: AI Supply Chain Compromise; Exploit Automated Artifact Processing Pipeline.

LLM03AML.T0010AML.T0119AI 600-1 2.12RMF MEASURE 2.7
cloud_auth_tool_output

Cloud Auth Tool Output

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
cloudflare_access_audit_log_tool_output

Cloudflare Access Audit Log Tool Output

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
code_injection

Code Injection

OWASP: Improper Output Handling. ATLAS: AI Agent Tool Invocation; Exploit Public-Facing Application.

LLM05AML.T0053AML.T0049AI 600-1 2.9RMF MEASURE 2.7
code_switching

Code Switching

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
coercion

Coercion

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection.

LLM01AML.T0051AI 600-1 2.9RMF MEASURE 2.7
command_injection

Command Injection

OWASP: Improper Output Handling; Excessive Agency. ATLAS: Command and Scripting Interpreter; Generate Malicious Commands.

LLM05LLM06AML.T0050AML.T0102AI 600-1 2.9RMF MEASURE 2.7
compaction_artifact_spoofing

Compaction Artifact Spoofing

OWASP: Prompt Injection; Data and Model Poisoning. ATLAS: AI Agent Context Poisoning; AI Agent Context Poisoning: Memory.

LLM01LLM04AML.T0080AML.T0080.000AI 600-1 2.9RMF MEASURE 2.7
configuration_management_preview_output

Configuration Management Preview Output

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
context_flooding

Context Flooding

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection.

LLM01AML.T0051AI 600-1 2.9RMF MEASURE 2.7
cross_agent_injection

Cross Agent Injection

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
delegated_approval_rebinding

Delegated Approval Rebinding

OWASP: Excessive Agency. ATLAS: AI Agent Tool Invocation.

LLM06AML.T0053AI 600-1 2.9RMF MEASURE 2.7
delegation_boundary_poisoning

Delegation Boundary Poisoning

OWASP: Excessive Agency. ATLAS: AI Agent Tool Invocation.

LLM06AML.T0053AI 600-1 2.9RMF MEASURE 2.7
delegation_bridge_state_laundering

Delegation Bridge State Laundering

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
denial_of_ai_service

Denial Of Ai Service

OWASP: Unbounded Consumption. ATLAS: Denial of AI Service; Cost Harvesting: Resource-Intensive Queries.

LLM10AML.T0029AML.T0034.001AI 600-1 2.9RMF MEASURE 2.7
dependency_automation_metadata

Dependency Automation Metadata

OWASP: Supply Chain. ATLAS: AI Supply Chain Compromise; Exploit Automated Artifact Processing Pipeline.

LLM03AML.T0010AML.T0119AI 600-1 2.12RMF MEASURE 2.7
deployment_template_poisoning

Deployment Template Poisoning

OWASP: Prompt Injection. ATLAS: Manipulate AI Model: Modify Prompt Construction Logic; LLM Prompt Injection.

LLM01AML.T0018.003AML.T0051AI 600-1 2.9RMF MEASURE 2.7
deserialization

Deserialization

OWASP: Improper Output Handling. ATLAS: AI Agent Tool Invocation; Exploit Public-Facing Application.

LLM05AML.T0053AML.T0049AI 600-1 2.9RMF MEASURE 2.7
discovery_file_poisoning

Discovery File Poisoning

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration; LLM Prompt Injection: Indirect.

LLM01AML.T0081AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
dns_tunneling

Dns Tunneling

OWASP: Sensitive Information Disclosure. ATLAS: Cyber Communication Channel; Exfiltration via Cyber Means.

LLM02AML.T0072AML.T0025AI 600-1 2.4RMF MEASURE 2.10
duplicate_key_shadowing

Duplicate Key Shadowing

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
encoded_payload

Encoded Payload

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
encoding_evasion

Encoding Evasion

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
encoding_smuggling

Encoding Smuggling

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
error_message_leakage

Error Message Leakage

OWASP: Sensitive Information Disclosure. ATLAS: LLM Data Leakage; Discover LLM System Information.

LLM02AML.T0057AML.T0069AI 600-1 2.4RMF MEASURE 2.10
exfiltration

Exfiltration

OWASP: Sensitive Information Disclosure. ATLAS: LLM Data Leakage; Exfiltration via AI Agent Tool Invocation.

LLM02AML.T0057AML.T0086AI 600-1 2.4RMF MEASURE 2.10
hidden_instruction

Hidden Instruction

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection: Indirect; LLM Prompt Obfuscation.

LLM01AML.T0051.001AML.T0068AI 600-1 2.9RMF MEASURE 2.7
identity_discovery_poisoning

Identity Discovery Poisoning

OWASP: Prompt Injection. ATLAS: Impersonation.

LLM01AML.T0073AI 600-1 2.9RMF MEASURE 2.7
identity_federation

Identity Federation

OWASP: Prompt Injection. ATLAS: Impersonation.

LLM01AML.T0073AI 600-1 2.9RMF MEASURE 2.7
identity_phishing

Identity Phishing

OWASP: Prompt Injection. ATLAS: Phishing; Impersonation.

LLM01AML.T0052AML.T0073AI 600-1 2.9RMF MEASURE 2.7
indirect_prompt_injection

Indirect Prompt Injection

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection; LLM Prompt Injection: Indirect.

LLM01AML.T0051AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
invisible_unicode

Invisible Unicode

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
jailbreak

Jailbreak

OWASP: Prompt Injection. ATLAS: LLM Jailbreak.

LLM01AML.T0054AI 600-1 2.9RMF MEASURE 2.7
jailbreak_evasion

Jailbreak Evasion

OWASP: Prompt Injection. ATLAS: LLM Jailbreak.

LLM01AML.T0054AI 600-1 2.9RMF MEASURE 2.7
long_context_exploitation_policy_pivot

Long Context Exploitation Policy Pivot

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection.

LLM01AML.T0051AI 600-1 2.9RMF MEASURE 2.7
mcp_sampling_hijack

MCP Sampling Hijack

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Poisoning; User Execution: Poisoned AI Agent Tool.

LLM01LLM06AML.T0110AML.T0011.002AI 600-1 2.9AI 600-1 2.12RMF MEASURE 2.7
mcp_threat

MCP Threat

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Poisoning; User Execution: Poisoned AI Agent Tool.

LLM01LLM06AML.T0110AML.T0011.002AI 600-1 2.9AI 600-1 2.12RMF MEASURE 2.7
mcp_tool_injection

MCP Tool Injection

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Poisoning; User Execution: Poisoned AI Agent Tool.

LLM01LLM06AML.T0110AML.T0011.002AI 600-1 2.9AI 600-1 2.12RMF MEASURE 2.7
memory_eviction_rehydration

Memory Eviction Rehydration

OWASP: Prompt Injection; Data and Model Poisoning. ATLAS: AI Agent Context Poisoning; AI Agent Context Poisoning: Memory.

LLM01LLM04AML.T0080AML.T0080.000AI 600-1 2.9RMF MEASURE 2.7
memory_poisoning

Memory Poisoning

OWASP: Prompt Injection; Data and Model Poisoning. ATLAS: AI Agent Context Poisoning; AI Agent Context Poisoning: Memory.

LLM01LLM04AML.T0080AML.T0080.000AI 600-1 2.9RMF MEASURE 2.7
memory_retrieval

Memory Retrieval

OWASP: Prompt Injection; Data and Model Poisoning. ATLAS: AI Agent Context Poisoning; AI Agent Context Poisoning: Memory.

LLM01LLM04AML.T0080AML.T0080.000AI 600-1 2.9RMF MEASURE 2.7
memory_state_replay

Memory State Replay

OWASP: Prompt Injection; Data and Model Poisoning. ATLAS: AI Agent Context Poisoning; AI Agent Context Poisoning: Memory.

LLM01LLM04AML.T0080AML.T0080.000AI 600-1 2.9RMF MEASURE 2.7
migration_tool_output_poisoning

Migration Tool Output Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
mlops_metadata_poisoning

Mlops Metadata Poisoning

OWASP: Supply Chain; Data and Model Poisoning. ATLAS: AI Supply Chain Compromise: Model; Manipulate AI Model.

LLM03LLM04AML.T0010.003AML.T0018AI 600-1 2.12RMF MEASURE 2.7
model_routing_confusion

Model Routing Confusion

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration.

LLM01AML.T0081AI 600-1 2.9RMF MEASURE 2.7
multi_stage_encoding

Multi Stage Encoding

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
observability_tool_output_poisoning

Observability Tool Output Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
oidc_credential_endpoint_substitution

Oidc Credential Endpoint Substitution

OWASP: Excessive Agency. ATLAS: Use Alternate Authentication Material.

LLM06AML.T0091AI 600-1 2.9RMF MEASURE 2.7
parasitic_injection

Parasitic Injection

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection; LLM Prompt Injection: Direct.

LLM01AML.T0051AML.T0051.000AI 600-1 2.9RMF MEASURE 2.7
path_traversal

Path Traversal

OWASP: Improper Output Handling. ATLAS: AI Agent Tool Invocation; Exploit Public-Facing Application.

LLM05AML.T0053AML.T0049AI 600-1 2.9RMF MEASURE 2.7
policy_scope_redefinition

Policy Scope Redefinition

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection.

LLM01AML.T0051AI 600-1 2.9RMF MEASURE 2.7
privilege_escalation

Privilege Escalation

OWASP: Excessive Agency. ATLAS: AI Agent Tool Invocation.

LLM06AML.T0053AI 600-1 2.9RMF MEASURE 2.7
prompt_extraction

Prompt Extraction

OWASP: System Prompt Leakage. ATLAS: Extract LLM System Prompt; Discover LLM System Information: System Prompt.

LLM07AML.T0056AML.T0069.002AI 600-1 2.9RMF MEASURE 2.7
prompt_injection

Prompt Injection

OWASP: Prompt Injection. ATLAS: LLM Prompt Injection; LLM Prompt Injection: Direct.

LLM01AML.T0051AML.T0051.000AI 600-1 2.9RMF MEASURE 2.7
prompt_leak

Prompt Leak

OWASP: System Prompt Leakage. ATLAS: Extract LLM System Prompt; Discover LLM System Information: System Prompt.

LLM07AML.T0056AML.T0069.002AI 600-1 2.9RMF MEASURE 2.7
provenance_chain

Provenance Chain

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
provenance_chain_fracture

Provenance Chain Fracture

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
rag_metadata_field_injection

RAG Metadata Field Injection

OWASP: Vector and Embedding Weaknesses; Data and Model Poisoning. ATLAS: RAG Poisoning; False RAG Entry Injection; Retrieval Content Crafting.

LLM08LLM04AML.T0070AML.T0071AML.T0066AI 600-1 2.9RMF MEASURE 2.7
repo_metadata_poisoning

Repo Metadata Poisoning

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration; LLM Prompt Injection: Indirect.

LLM01AML.T0081AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
representation_parser_differential

Representation Parser Differential

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
retrieval_poisoning

Retrieval Poisoning

OWASP: Vector and Embedding Weaknesses; Data and Model Poisoning. ATLAS: RAG Poisoning; False RAG Entry Injection; Retrieval Content Crafting.

LLM08LLM04AML.T0070AML.T0071AML.T0066AI 600-1 2.9RMF MEASURE 2.7
retrieval_provenance_decay_authority_laundering

Retrieval Provenance Decay Authority Laundering

OWASP: Vector and Embedding Weaknesses; Data and Model Poisoning. ATLAS: RAG Poisoning; False RAG Entry Injection; Retrieval Content Crafting.

LLM08LLM04AML.T0070AML.T0071AML.T0066AI 600-1 2.9RMF MEASURE 2.7
rtl_obfuscation

Rtl Obfuscation

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
runtime_config_metadata_poisoning

Runtime Config Metadata Poisoning

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration; LLM Prompt Injection: Indirect.

LLM01AML.T0081AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
sampling_parameter_injection

Sampling Parameter Injection

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration.

LLM01AML.T0081AI 600-1 2.9RMF MEASURE 2.7
sandbox_escape

Sandbox Escape

OWASP: Excessive Agency. ATLAS: Escape to Host.

LLM06AML.T0105AI 600-1 2.9RMF MEASURE 2.7
secret_detection

Secret Detection

OWASP: Sensitive Information Disclosure. ATLAS: Unsecured Credentials; AI Agent Tool Credential Harvesting.

LLM02AML.T0055AML.T0098AI 600-1 2.4RMF MEASURE 2.10
semantic_cache_authority_laundering

Semantic Cache Authority Laundering

OWASP: Vector and Embedding Weaknesses; Data and Model Poisoning. ATLAS: RAG Poisoning; False RAG Entry Injection; Retrieval Content Crafting.

LLM08LLM04AML.T0070AML.T0071AML.T0066AI 600-1 2.9RMF MEASURE 2.7
social_engineering

Social Engineering

OWASP: Prompt Injection. ATLAS: Impersonation.

LLM01AML.T0073AI 600-1 2.9RMF MEASURE 2.7
social_engineering_ui

Social Engineering UI

OWASP: Prompt Injection. ATLAS: Phishing; LLM Response Rendering.

LLM01AML.T0052AML.T0077AI 600-1 2.9RMF MEASURE 2.7
speculative_decode_hijack

Speculative Decode Hijack

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration.

LLM01AML.T0081AI 600-1 2.9RMF MEASURE 2.7
sql_injection

SQL Injection

OWASP: Improper Output Handling. ATLAS: AI Agent Tool Invocation; Exploit Public-Facing Application.

LLM05AML.T0053AML.T0049AI 600-1 2.9RMF MEASURE 2.7
ssrf

Ssrf

OWASP: Improper Output Handling. ATLAS: AI Agent Tool Invocation; Exploit Public-Facing Application.

LLM05AML.T0053AML.T0049AI 600-1 2.9RMF MEASURE 2.7
state_sync_poisoning

State Sync Poisoning

OWASP: Prompt Injection; Excessive Agency. ATLAS: Autonomous AI Agent Communication; Autonomous AI Agent Communication: Direct Agent Communication; LLM Prompt Injection: Indirect.

LLM01LLM06AML.T0118AML.T0118.001AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
structured_metadata_poisoning

Structured Metadata Poisoning

OWASP: Prompt Injection. ATLAS: Modify AI Agent Configuration; LLM Prompt Injection: Indirect.

LLM01AML.T0081AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
supply_chain

Supply Chain

OWASP: Supply Chain. ATLAS: AI Supply Chain Compromise; User Execution: Malicious Package.

LLM03AML.T0010AML.T0011.001AI 600-1 2.12RMF MEASURE 2.7
supply_chain_attestation_poisoning

Supply Chain Attestation Poisoning

OWASP: Supply Chain. ATLAS: AI Supply Chain Compromise.

LLM03AML.T0010AI 600-1 2.12RMF MEASURE 2.7
template_format_injection

Template Format Injection

OWASP: Prompt Injection. ATLAS: Manipulate AI Model: Modify Prompt Construction Logic; LLM Prompt Injection.

LLM01AML.T0018.003AML.T0051AI 600-1 2.9RMF MEASURE 2.7
template_metadata_poisoning

Template Metadata Poisoning

OWASP: Prompt Injection. ATLAS: Manipulate AI Model: Modify Prompt Construction Logic; LLM Prompt Injection.

LLM01AML.T0018.003AML.T0051AI 600-1 2.9RMF MEASURE 2.7
terminal_output_encoding_smuggling

Terminal Output Encoding Smuggling

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
token_smuggling

Token Smuggling

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
tool_cache_poisoning

Tool Cache Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
tool_chain_race

Tool Chain Race

OWASP: Excessive Agency. ATLAS: AI Agent Tool Invocation.

LLM06AML.T0053AI 600-1 2.9RMF MEASURE 2.7
tool_metadata_smuggling

Tool Metadata Smuggling

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Poisoning; User Execution: Poisoned AI Agent Tool.

LLM01LLM06AML.T0110AML.T0011.002AI 600-1 2.9AI 600-1 2.12RMF MEASURE 2.7
tool_output_injection

Tool Output Injection

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
tool_output_poisoning

Tool Output Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
tool_output_provenance_swap

Tool Output Provenance Swap

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
tool_output_receipt_poisoning

Tool Output Receipt Poisoning

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
tool_poisoning

Tool Poisoning

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Poisoning; User Execution: Poisoned AI Agent Tool.

LLM01LLM06AML.T0110AML.T0011.002AI 600-1 2.9AI 600-1 2.12RMF MEASURE 2.7
tool_response_spoofing

Tool Response Spoofing

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7
tool_schema_default_fallback

Tool Schema Default Fallback

OWASP: Prompt Injection; Excessive Agency. ATLAS: AI Agent Tool Poisoning; User Execution: Poisoned AI Agent Tool.

LLM01LLM06AML.T0110AML.T0011.002AI 600-1 2.9AI 600-1 2.12RMF MEASURE 2.7
ui_injection

UI Injection

OWASP: Improper Output Handling. ATLAS: LLM Response Rendering; LLM Trusted Output Components Manipulation.

LLM05AML.T0077AML.T0067AI 600-1 2.9RMF MEASURE 2.7
unicode_evasion

Unicode Evasion

OWASP: Prompt Injection. ATLAS: LLM Prompt Obfuscation.

LLM01AML.T0068AI 600-1 2.9RMF MEASURE 2.7
vector_metadata_instruction_smuggling

Vector Metadata Instruction Smuggling

OWASP: Vector and Embedding Weaknesses; Data and Model Poisoning. ATLAS: RAG Poisoning; False RAG Entry Injection; Retrieval Content Crafting.

LLM08LLM04AML.T0070AML.T0071AML.T0066AI 600-1 2.9RMF MEASURE 2.7
workflow_orchestrator_tool_output

Workflow Orchestrator Tool Output

OWASP: Prompt Injection. ATLAS: AI Agent Tool Data Poisoning; LLM Prompt Injection: Indirect.

LLM01AML.T0099AML.T0051.001AI 600-1 2.9RMF MEASURE 2.7