AI Security Atlas › All entries
All entries
74 threats, vulnerabilities, and guardrails for AI agents, LLM applications, and RAG systems, each mapped to OWASP, MITRE ATLAS, and NIST AI RMF. Open the interactive atlas to explore how they connect.
Autonomous Agent & MCP Security
Agents that call tools and run code on your behalf: hijacked tool calls, code execution, manipulated human approvals, and agents that go rogue.
Threats
- Agent Tool Hijacking High severity
- Goal Alignment Drift High severity
- Prompt-to-Code Execution in Agents High severity
- Rogue or Compromised Agent High severity
- Unbounded MCP Tool Calls Medium severity
- Human Approval Manipulation Medium severity
Vulnerabilitys
- Excessive Tool Permissions Critical severity
- Unvalidated Function Arguments High severity
- Dynamic Code Execution High severity
- No Behavioral Monitoring or Kill Switch High severity
- Approvals Based on Agent-Written Summaries Medium severity
Guardrails
- MCP Permission Scoping Fixes critical risks
- Dual-Agent Approval Loop Fixes high risks
- Deterministic Tool Schema Validation Fixes high risks
- Hardened Execution Sandbox Fixes high risks
- Agent Behavioral Monitoring & Kill Switch Fixes high risks
- Verifiable Action Previews for Approvers Fixes medium risks
RAG & Knowledge Retrieval Security
Chatbots that answer from your documents: poisoned sources, injected instructions, leaked files, and embeddings that give away their source text.
Threats
- Indirect Prompt Injection via Documents Critical severity
- Vector DB Poisoning High severity
- Unauthorized Document Exfiltration High severity
- Embedding Inversion & Membership Inference Medium severity
Vulnerabilitys
- Lack of Context Sanitization High severity
- Over-Privileged Retrieval Indexing High severity
- Missing Document ACLs High severity
- Embeddings Treated as Non-Sensitive Medium severity
Guardrails
- Pre-Ingestion Scanning Pipeline Fixes critical risks
- Output Filtering & PII Anonymization Fixes critical risks
- Document-Level Access Enforcement Fixes high risks
- Protect Embeddings as Sensitive Data Fixes medium risks
Model Supply Chain & Training Integrity
Where your model, data, and code come from: poisoned training sets, malicious model files, hallucinated packages, and memorized secrets.
Threats
- Malicious Model Artifacts Critical severity
- Training & Fine-Tune Data Poisoning High severity
- Model Extraction via Inference API High severity
- Hallucinated Package Squatting High severity
- Training Data Memorization Leakage High severity
Vulnerabilitys
- Unsafe Model Deserialization Critical severity
- Unverified Data & Model Provenance High severity
- Unrestricted Inference Endpoints High severity
- Unreviewed AI-Suggested Code & Dependencies High severity
- Unscrubbed Fine-Tuning Data Medium severity
Guardrails
- Signed Model Registry & AIBOM Fixes critical risks
- Safe Artifact Loading Policy Fixes critical risks
- Dataset Provenance & Poison Screening Fixes high risks
- Inference Quotas & Output Watermarking Fixes high risks
- Dependency Allowlisting & Package Verification Fixes high risks
- PII Scrubbing & Privacy-Preserving Training Fixes high risks
LLM Application & Output Security
The app around the model: leaked prompts, jailbreaks, data-stealing output, confident wrong answers, and runaway costs.
Threats
- Jailbreak & Safety Bypass High severity
- Output-Rendered Data Exfiltration High severity
- Hallucinated Answers Acted On High severity
- System Prompt Extraction Medium severity
- Denial of Wallet & Resource Exhaustion Medium severity
Vulnerabilitys
- Unsanitized Output Rendering High severity
- Ungrounded, Unverified Answers High severity
- Secrets & Policy in System Prompt Medium severity
- Single-Layer Safety Reliance Medium severity
- Interface Invites Overreliance Medium severity
- No Per-Request Resource Limits Medium severity
Guardrails
- Output Encoding & Strict CSP Fixes high risks
- Input/Output Safety Classifiers Fixes high risks
- Grounding & Citation Verification Fixes high risks
- Uncertainty Labeling & High-Stakes Review Fixes high risks
- Prompt Hygiene & Canary Detection Fixes medium risks
- Resource Budgets, Timeouts & Graceful Degradation Fixes medium risks
Multi-Agent & Memory Trust
Agents that remember and talk to each other: poisoned memory, tampered tools, impersonation, and failures that cascade.
Threats
- Persistent Memory Poisoning Critical severity
- MCP Tool Description Poisoning Critical severity
- Cascading Multi-Agent Failure High severity
- Inter-Agent Impersonation Medium severity
Vulnerabilitys
- Memory Writes Without Provenance Critical severity
- Mutable Tool Manifests Critical severity
- No Isolation Between Agents High severity
- Unauthenticated Agent Channels Medium severity
Guardrails
- Memory Provenance & Review Fixes critical risks
- Tool Manifest Pinning & Review Fixes critical risks
- Blast-Radius Isolation & Circuit Breakers Fixes high risks
- Agent Workload Identity & Signed Tasks Fixes medium risks