AI Agent Security Encyclopedia

Agent contract poisoning embeds authoritative suppression or authority-inversion instructions in agent-to-agent messages — abusing idempotency and retry tokens in protocols like A2A message/send to force scope downgrades an agent may obey. The message envelope meant to coordinate agents is turned into an instruction carrier.

Agent instruction file poisoning places hostile AGENTS.md, CLAUDE.md, SKILL.md, .cursor/rules, or copilot-instructions files in a repository that direct AI coding agents to suppress security scanning, bypass code review, or follow attacker rules. These files are read as authoritative operating instructions the agent adopts wholesale.

Agent persona drift labels untrusted retrieved content or delegate output with high-trust identity tags — "Role: system", "approved by lead agent", "Priority: P0" — so a planner upgrades it during context assembly. Soft identity boundaries let the attack nudge the agent's sense of what is authoritative.

Agent runtime trust confusion arises when lower-trust background or async runtime output is injected into trusted System-level events, and an intended trust-downgrade step is missed. Content that should have been marked untrusted is processed as authoritative because the runtime failed to demote it at the boundary.

Agent workflow security covers attacks on multi-step agent pipelines that fetch, generate, and act — where forged control-plane signals like "healthy", "verified", or "approved" are injected into tool outputs, logs, or bridge files so the workflow trusts them as gate signals and proceeds past checks it should enforce.

An agent-readable file is any file an AI coding or automation agent loads into its context as trusted guidance — READMEs, docs, prompts, and configuration such as .cursor, .windsurf, .claude, and MCP server definitions. Because agents treat these as authoritative, a poisoned one becomes an instruction the agent silently follows.

API descriptor poisoning hides agent-targeted instructions in API discovery metadata — OpenAPI or Swagger description, summary, and x-* fields, ai-plugin.json model-facing fields, and schema examples. An agent that treats descriptor metadata as trusted context can be told to suppress findings or take unauthorized actions.

Approval graph poisoning forges an approval quorum, sign-off, or vote snapshot to auto-approve an action or bypass recalculation of the approval graph. By faking the record of who approved what, the attack manufactures multi-party consensus that the real approvers never actually gave.

Approval-state evidence laundering fabricates or reuses signs that a review, check, or approval already passed, so an agent skips a control it should enforce. By presenting forged evidence of a completed approval, the attack suppresses the gate without ever satisfying it.

An AI agent's attack surface is every source of input it will read and act on — repositories, documentation, web pages, emails, tool and API responses, MCP servers, memory, and configuration files. Each source an agent trusts is a place an attacker can plant instructions, which makes the agent's readable inputs, not its code, the primary surface.

Authentication bypass exploits weak credential handling — truncated or partial token comparison — that lets different users collide on cache entries or defeat authentication entirely. The flaw is in how credentials are compared, not in the agent's reasoning, but it exposes agent-adjacent services to impersonation.

Authorization bypass exploits misconfigured permission scopes so an action lands in a weaker scope than it requires — an approval or pairing operation placed in a broad write scope, letting an unprivileged caller perform privileged operations. The check exists but guards the wrong boundary.

Build metadata poisoning plants agent-directed instructions in package build metadata — package.json description, custom ai/assistant/scanner fields, or dependency manifests — that AI coding agents read as trusted project context. The metadata, meant to describe a package, instead steers the agent inspecting it.

Capability escalation is a mechanism where an attack tricks an agent into using permissions or tools beyond what the current task requires — widening read access into write, or a low-privilege call into a privileged one. The escalation converts a limited foothold into broader control by abusing the agent's own authorized capabilities.

A carrier is the disguise or delivery form an attack hides inside — an HTML comment, a code block, a metadata field, a base64 blob, invisible Unicode. It is distinct from the mechanism, which is the underlying technique. One mechanism can appear through many carriers, which is why detection must generalize beyond any single disguise.

A channel is the kind of input a piece of content arrives through — a user message, a file, web content, or a tool or API response. Sunglasses classifies input by channel because the same text is riskier from some sources than others: an instruction in a tool response is more suspicious than the same words typed by the user.

CI/CD metadata poisoning hides agent-targeting instructions in automation metadata — Ansible playbook names and descriptions, role metadata, inventory comments, group_vars, ansible.cfg, or Galaxy collection descriptors — that an agent reads while assisting with pipelines. The infrastructure-as-code metadata becomes a covert instruction channel.

Code-switching evasion combines English override or bypass directives with multilingual connector words or non-Latin bypass synonyms — Spanish, French, German, Chinese, Russian, and more — to slip past filters tuned for a single language. Mixing scripts and languages hides the malicious intent from monolingual detection.

Command injection in agent contexts tricks an agent into running dangerous shell commands or abuses gaps in its execution environment — such as build-tool environment variables missing from an exec denylist — to achieve code execution. The agent's ability to run commands becomes the payload's delivery mechanism.

Command-and-control indicators flag beaconing or callback activity — such as DNS-over-HTTPS with jitter or timing randomization used to exfiltrate data while evading egress detection. The pattern signals that compromised code is phoning home through a deliberately noisy, hard-to-detect channel that ordinary egress filters routinely miss.

Context flooding deliberately pads the context window with repeated, duplicated, or filler tokens to push earlier guardrail or system-prompt instructions out of the window. Once the protective instructions are evicted, the agent operates without the rules that were supposed to constrain it.

Control-plane impersonation is a mechanism where content in the data plane — a document, message, or tool response — pretends to be a control-plane signal such as a system prompt, policy, or configuration directive. By posing as infrastructure rather than data, the attacker gets the agent to treat ordinary content as governing instructions.

Exfiltration attacks coax an agent into revealing or transmitting sensitive material — credentials, secrets, internal reasoning traces, policy heuristics, or refusal thresholds — to an attacker-controlled destination. The prompt frames disclosure as a debug, diagnostic, or helpful step so the agent leaks data it should never emit.

Cross-agent injection is an attack where output from an upstream, delegated, planner, or worker agent is presented as trusted, authoritative, verified, or approved, and that claim is used to justify an action the receiving agent would otherwise refuse. The trust assigned at the handoff is what the attack abuses.

Defense in depth layers independent safeguards so no single failure compromises an agent: input filtering at the trust boundary, sandboxing and least privilege, human approval on sensitive actions, and output monitoring. An input firewall is one layer — it reduces what reaches the model but does not replace runtime controls on what the agent can do.

Delegation-bridge state laundering exploits handoffs between agents so that state or instructions crossing the bridge gain authority they lacked at the source. As work passes from one agent to another, the receiving agent treats the relayed content as trusted upstream context, and the attack rides that trust across the boundary.

Discovery file poisoning hides agent-directed instructions inside the well-known files agents and scanners auto-fetch — ads.txt, app-ads.txt, .well-known documents, AASA, sellers.json. Because these files are treated as owner-authoritative metadata, smuggled policy text can tell an agent to suppress findings or treat the file's author as authority.

DNS tunneling chunks and exfiltrates secrets, tokens, or commands over DNS, DoH, or TXT records to bypass egress and DNS-filter policy. By hiding data in name-resolution traffic, the attack moves stolen material out through a channel most controls leave open.

Encoded payload flags suspiciously large base64-encoded blobs that may carry data exfiltration or obfuscated malicious content. The size and encoding together signal that something is being hidden — either data leaving the system or a payload arriving disguised as opaque, inert-looking text.

Encoding evasion conceals prompt-injection payloads in alternate encodings — Braille, ROT13, base64, confusable scripts, dot-patterns — that become harmful only after normalization or decoding. The payload passes an initial gate as inert-looking data and activates once the agent or a tool decodes it.

Encoding smuggling hides a malicious instruction behind an encoding or obfuscation layer — base64, hex, homoglyphs, invisible Unicode, or right-to-left overrides — so it slips past filters and human review, then decodes into a live command once the agent processes it. The payload is plain; only its wrapping is disguised.

Error message leakage instructs an agent to deliberately trigger errors, exceptions, or stack traces so that system prompts, hidden instructions, or internal state appear in the resulting output. The attack weaponizes verbose error handling as an exfiltration channel, turning a debugging convenience into a disclosure path.

An execution lure is content crafted to make an agent run code, a command, or a tool it would not otherwise invoke — framed as a helpful step, a required fix, or a routine action. The lure supplies both the motive and the payload, turning the agent's willingness to be helpful into an execution primitive.

Grant replay reuses a legitimate authorization — an approval, token, or consent granted for one action — to justify a different or later action the user never sanctioned. By replaying evidence of a past grant, the attack makes an unauthorized step look already-approved to the agent.

Hidden instruction uses behavior-shaping text in comments, markup, or low-visibility regions that avoids classic prompt-injection phrasing yet still redirects an agent's output, links, recommendations, or priorities toward attacker goals. Because it never issues an obvious override, it slips past filters tuned for explicit injection language.

Identity discovery poisoning embeds hostile agent policy inside identity and authority records agents resolve — DNS CAA records, DID configuration documents, linked-domain metadata, and zone-file comments. By poisoning the sources an agent uses to establish who is authoritative, the attack makes attacker-controlled identity read as owner authority.

Identity federation abuse forges or spoofs an OIDC, SAML, or identity-provider assertion carrying an escalated scope, role, or privilege claim to override or bypass authorization. The federated trust between identity systems is exploited by injecting a claim the real provider never issued.

Identity phishing poses as a helpdesk or support team and asks the user to share an OTP, MFA code, seed phrase, or recovery code through a portal or ticket. The message impersonates a trusted internal function to harvest the exact secrets that protect an account.

Indirect prompt injection delivers the attack through content the agent retrieves rather than through the user's own message. The malicious instruction lives inside a web page, document, repository file, email, or tool response, and activates when the agent reads that source. The user never sees it; the agent obeys it.

An input firewall inspects everything an AI agent is about to read and filters out embedded attacks before the agent processes them. Unlike a network firewall that filters packets, an input firewall filters natural-language and structured content — the channel through which agents are actually attacked. Sunglasses is a local, open-source input firewall.

Invisible Unicode injection inserts zero-width characters (U+200B, U+200C, U+200D, U+FEFF) to split override or bypass keywords like "ignore", "override", or "bypass" so they evade literal matching while still reading as directives to the model after normalization. The attack is invisible to a human reviewer.

Jailbreak evasion activates an alter-persona claimed to be unbound by safety policy — the DAN ("Do Anything Now") family — combining a persona activation, an "unbound" claim, and an answer-as-persona imperative to coax the model into ignoring its rules. It attacks the model's compliance directly rather than any surrounding metadata.

The Model Context Protocol is an open standard that lets AI agents connect to external tools and data sources through a common interface. An MCP server advertises tools with names, descriptions, and metadata that become part of the agent's context — which makes that metadata an attack surface, since the agent trusts it as tool documentation.

MCP descriptor spoofing plants misleading capability hints or authority claims in an MCP server's tool descriptors, so the agent misjudges what a tool is, does, or is allowed to do. The spoofed descriptor shapes the agent's model of its tools, steering tool selection and trust before any call is made.

MCP threats target the Model Context Protocol layer — prompt injection hidden in resource-template metadata, dynamic tool-list changes signaling capability drift or rug-pulls, and poisoned server descriptions. Because an agent treats MCP catalog data as trusted tool documentation, manipulated metadata reshapes what the agent believes its tools are and does.

MCP tool SQL injection exploits database MCP servers that enforce row limits by wrapping agent or user SQL in SELECT * FROM ({sql}) LIMIT N, creating a wrapper-breakout injection sink at the agent-tool boundary. Crafted SQL escapes the wrapper and executes unintended queries.

A mechanism is the underlying technique an attack uses to subvert an agent, independent of how it is disguised. Sunglasses groups attacks into canonical mechanism families — such as tool-output authority laundering or metadata instruction smuggling — so that a new disguise of a known technique is recognized as a variant, not mistaken for a brand-new threat.

Memory eviction and rehydration attacks claim a prior approval, consent, or human confirmation was carried forward through a restore, rehydration, or compaction step, so an agent inherits authorization that was never granted. The fabricated recovered state returns after memory processing looking like established history.

Memory poisoning frames untrusted tool or retrieval output as a durable policy update — "remember this forever", "replace the safety rule" — so an agent persists the exception across sessions and treats it as higher authority than its original instructions. The attack targets long-term memory rather than a single turn.

Memory-compaction authority laundering injects false state into an agent's summarized or persisted memory, so that when earlier context is compacted the fabricated 'recovered' fact returns carrying unearned authority. The attack survives context compression by hiding in the very summary the agent later trusts as its own history.

Metadata instruction smuggling hides agent-directed commands inside fields meant for description or configuration — HTML meta tags, OpenAPI extensions, front matter, annotations, or schema examples. The agent reads the metadata as context and executes the smuggled instruction, because the field is assumed to be inert documentation rather than a command channel.

Model routing confusion targets the router or effort layer rather than the model's own refusal, pushing an agent to switch to a cheaper, smaller, or less-guarded model to bypass safety. By attacking where requests are dispatched, it degrades protection without ever confronting the primary model's guardrails.

Multi-stage encoding splits an injection across layered transforms — URL encoding, base64, homoglyphs, polyglot JSON or markdown envelopes — so each stage looks benign to the first policy gate. A later decode step in a helper tool reconstitutes the intact malicious instruction only after the checks are passed.

Novelty-index verdict poisoning targets the system that decides whether an input is new or already-seen, gaming it so a malicious item is judged familiar and safe — or so a benign one is buried as noise. By corrupting the novelty verdict, the attack controls what gets scrutiny and what slips through unreviewed.

Parasitic injection hides a directive in a footer, HTML comment, metadata block, or invisible annotation that invokes execution while bypassing policy, guardrail, or approval controls. The instruction rides quietly inside otherwise benign content, activating only when the agent processes the hidden region.

Path traversal in prompt or template loading uses ../ sequences in file access to read arbitrary files outside the intended directory. When an agent framework loads templates or files by path, traversal lets an attacker pull secrets or configuration the agent was never meant to expose.

Policy scope redefinition abuses document structure to claim that an appendix, annex, footnote, sidebar, or metadata note takes precedence over the main policy, then uses that fake precedence to waive, bypass, or disable governing rules. The attack rewrites which text governs rather than attacking the rules directly.

Privilege escalation exploits hardcoded auto-approvals or policy gaps that let an agent operation run with more authority than intended — such as a UI that auto-approves shell commands and bypasses admin policy. A low-privilege path is elevated into a high-privilege one without proper authorization.

Prompt asset leak attempts to reveal or export hidden managed-environment assets — system prompts, tool schemas, trace internals, or auth metadata — from cloud AI workbenches. The attack targets the platform's protected configuration rather than the conversation, seeking the scaffolding behind the agent.

Prompt extraction uses forged support, debug, or diagnostic bundles that carry a hidden system prompt or internal instructions to dump or override an agent's protected context. The attack disguises itself as troubleshooting so the agent reveals or replaces its own governing instructions.

Prompt injection is an attack where instructions hidden in text an AI reads override what the user actually asked. Because a model cannot reliably separate the user's instructions from an attacker's, injected commands can make it leak data, misuse tools, or ignore its guardrails. It is the foundational attack class against language-model agents.

Provenance is the record of where a piece of content came from and how much authority it should carry. Many agent attacks work by faking provenance — claiming text is a system message, a prior approval, or a trusted upstream agent. Preserving true provenance lets a filter refuse content that impersonates a more-trusted source.

Provenance chain forgery presents a spoofed manifest, provenance chain, or attestation to bypass or waive integrity verification and release or deploy without approval. The forged chain claims an artifact's integrity was already established, so the agent skips the check that would have caught the tampering.

Provenance chain fracture packages payloads with forged trust signals — verified badges, fake [SYSTEM] preambles, signature-theater checksums, smuggled safe=true flags — so a planner inherits trust from the content's text rather than from real cryptographic provenance. The break between claimed and actual provenance is the vulnerability.

A provenance swap replaces the true origin of content with a more-trusted one, so text that arrived from an untrusted source is presented as coming from a system, an approver, or an upstream agent. The swap targets the authority attached to origin rather than the content itself, laundering untrusted input into trusted instruction.

Quarantine is a filter response that isolates suspicious content instead of blocking or passing it — holding a flagged file, tool response, or configuration so the agent does not act on it while a human or stricter check reviews. It is the middle verdict between allowing clean input and hard-blocking a confirmed attack.

Repository metadata poisoning embeds hostile instructions in GitHub issue and pull-request templates or their YAML config — files an AI coding agent fills out when opening issues and PRs. The template, treated as trusted scaffolding, injects directives into the content the agent generates.

Retrieval poisoning attacks the RAG layer, where a retrieved document, knowledge-base chunk, or top-ranked result carries instructions claiming to be authoritative, trusted, or higher-priority than the agent's rules. Fake lineage, provenance, or source-integrity warnings inside the chunk pressure the agent to obey attacker-planted content as vetted context.

Retrieval provenance-decay laundering exploits how source and trust information is lost as retrieved documents move through a RAG pipeline. By the time a chunk reaches the model, its origin has decayed, so attacker-planted text is treated as authoritative context stripped of the signals that would have flagged it as untrusted.

Right-to-left obfuscation uses Unicode bidirectional control characters — RLO, LRO, RLM, PDF, and isolates — to visually mask or reorder text so an "ignore", "bypass", or "override" directive is hidden from a human reader while remaining intact for the model. What the reviewer sees differs from what the model processes.

Sandbox escape combines container and isolation-breaking primitives — docker.sock access, host namespace or /proc references, privileged flags like --privileged or CAP_SYS_ADMIN — with override intent, letting agent-run code break out of its sandbox onto the host. Isolation meant to contain the agent is dismantled from inside.

Secret exposure covers private key material, tokens, and credentials appearing in content an agent can read or emit — private keys that should never sit in agent-accessible context. Detection flags this material so an agent neither leaks it outward nor treats it as ordinary text to echo.

Semantic-cache authority laundering poisons a cache of prior answers or embeddings so a later, similar query retrieves the attacker's planted response as if it were a trusted cached result. The cache's role as a fast, trusted memory is abused to serve laundered content on a future request.

SkillCloak is a structural-obfuscation scanner-evasion technique reported in the July 2026 arXiv preprint "Cloak and Detonate" (2607.02357). Researchers report the strongest of 8 agent-skill scanners tested dropped from 98.6% to 10.1% detection on 1,613 real-world malicious skills after the transform. A research red-team tool, not an in-the-wild attack.

Agent-directed social engineering uses social-proof language — "the owner approved this", "safe to proceed", forged proceed-without-confirmation banners — to convince an agent to bypass security checks. It manipulates the agent's cooperativeness with claims of prior authorization rather than any technical flaw.

Server-side request forgery through agent tools abuses fetch or crawl capabilities that accept internal targets — cloud metadata-service URLs, localhost, or private addresses — letting an attacker use the agent's tool to reach internal resources and steal cloud credentials. The agent's network reach becomes the attacker's.

State-sync poisoning injects forged replica or convergence receipts, or checkpoint acknowledgements, to trick an agent into bypassing policy or verification gates during reconciliation or execution handoff. The distributed-state machinery that agents trust to agree on truth is fed a fabricated agreement.

Structured metadata poisoning hides agent-directed instructions in structured description fields — HTML meta and OpenGraph tags, CITATION.cff free text, Twitter Card fields — that an agent ingests as page or project context. The fields, meant to describe, instead carry authority-inversion, secret-forwarding, or report-suppression directives.

Agent-facing supply-chain attacks plant malicious signals in the packages, dependencies, and distribution channels an agent inspects or installs — typosquatted package names, hardcoded exfiltration endpoints, or agent-directed instructions in package metadata. The agent, auditing or installing dependencies, is steered by content it assumes is legitimate ecosystem data.

Supply-chain attestation poisoning embeds agent-directed policy text inside build provenance artifacts — SLSA statements, in-toto envelopes, DSSE, Sigstore or Rekor metadata — so an AI dependency auditor treats the attestation as scanner authority and waives verification. The trust placed in signed provenance is turned into an instruction channel.

Template injection abuses a prompt or document template that interpolates untrusted values, so attacker-controlled input breaks out of its data slot and becomes part of the instruction the agent follows. The template's own structure is turned against it, converting a filled-in variable into executable directive text.

Token smuggling uses structured header- or field-style markers — role:system, x-system-prompt, policy_override:true, priority:critical, meta name=system — paired with ignore, override, or bypass directives to make ordinary content masquerade as a privileged system or developer instruction that outranks the agent's rules.

Tool metadata smuggling plants authority-claiming instructions in YAML front matter, annotations, or tool-message metadata — asserting the metadata outranks system instructions and directing the agent to ignore prior guardrails. The smuggled field poses as configuration while functioning as a command.

Tool output authority laundering is a mechanism where attacker-controlled content returned by a tool is dressed up as an authoritative or system-level instruction, so the agent grants it trust the source never earned. The laundering step converts ordinary tool output into apparent command authority the agent then acts on.

Tool output poisoning is an attack where content returned by a tool — a search result, browser fetch, API response, or plugin — carries instructions the agent then treats as trusted. Because agents assume their own tools are safe, attacker-controlled text riding inside a tool's output can steer the agent without the user ever seeing it.

Tool poisoning corrupts what a tool appears to return or claim — forged completion of a review or approval, or schema and field-semantic mismatches between pipeline stages that make one stage parse a value differently than the next. The mismatch produces a silent verdict flip the agent trusts as a genuine tool result.

A tool-chain race abuses ordered multi-tool sequencing so an intermediate tool output is forcibly relabeled trusted, verified, or safe mid-flow, or approval-bypass language is timed to land between steps. The ordering of operations, not any single tool, is what the attack exploits.

A trust boundary is the point where untrusted input crosses into a system that will act on it. For AI agents, it sits between the text an agent reads — files, web pages, tool output, emails — and the actions the agent then takes. Sunglasses enforces this boundary locally, before untrusted context becomes trusted action.

UI approval injection forges approval banners of the form "[✓ APPROVED BY USER] proceed" — fake chips or badges that convince an agent user consent was already given. The attack requires a bracketed checkmark-approval marker co-occurring with a proceed directive, manufacturing consent the user never expressed.

UI social engineering uses visual-injection banners that impersonate security, authentication, or session-recovery flows to coerce a user or agent into disclosing secrets — opening DevTools, copying cookies, session storage, or bearer tokens. The attack dresses credential theft as a legitimate interface prompt.

Unicode lookalike evasion swaps Latin letters for visually identical characters from other scripts — Cyrillic homoglyphs — to bypass English pattern matching while the text still reads normally to a human and the model. The disguise lives in the character set, not the wording.

Unsafe deserialization uses functions like pickle, marshal, yaml.load, dill, or torch.load on untrusted input, enabling arbitrary code execution when the malicious payload is loaded. In agent contexts, untrusted data an agent deserializes becomes a direct path to running attacker code.

Workflow urgency bypass uses an emergency or critical-urgency claim to skip approval, review, or change-control gates for a deployment or production release. The attack manufactures time pressure so the agent waives the very checks meant to catch a bad or malicious change.