AI Agents Attack Matrix

AI Agents Attack Matrix Overview

AI Agents Attack Lifecycle - Complete flow from reconnaissance through impact showing all 6 attack stages

Complete attack lifecycle showing the progression from reconnaissance through impact, with defense controls at each stage.

Attack Matrix Table

Comprehensive mapping of attack techniques across the AI agent attack lifecycle based on ttps.ai research

AI Agents Attack Matrix Visualization - Visual representation of all attack stages, techniques, and risk levels

Attack Stage	Techniques	Primary Targets	Risk Level	Detection Difficulty
Reconnaissance	12 techniques	ML Models, APIs, Code Repos	Medium	Low
Initial Access	8 techniques	Agent Systems, APIs	High	Medium
Execution	15 techniques	LLMs, Prompts, Tools	Critical	High
Persistence	6 techniques	Memory, RAG, Training Data	Critical	Critical
Collection	7 techniques	Data, Credentials, Models	High	Medium
Impact	9 techniques	Services, Data, Systems	Critical	Low

Critical Techniques

LLM Prompt InjectionCritical

RAG PoisoningCritical

Memory InfectionCritical

Tool Definition DiscoveryCritical

Defense Priorities

Input ValidationEssential

RAG SecurityEssential

Memory ProtectionEssential

Tool Access ControlEssential

Threat Landscape

Execution Stage RiskCritical

Persistence ThreatsCritical

Detection CapabilityMedium

Reconnaissance Stage

Information Gathering Techniques

Information gathering techniques targeting AI systems and infrastructure

Target Discovery

Gather RAG-Indexed Targets

Medium

Identify and catalog RAG systems and their indexed content for potential exploitation

Active Scanning

Medium

Probe AI systems and APIs to identify vulnerabilities and access points

Search for Victim's Code Repositories

Low

Analyze public repositories for AI model implementations and configurations

Intelligence Gathering

Search Open Technical Databases

Low

Mine technical databases for AI system configurations and vulnerabilities

Search Application Repositories

Low

Examine application code for AI integration patterns and security weaknesses

Search Victim-Owned Websites

Low

Analyze target websites for AI-powered features and potential attack vectors

Mitigation Strategies

Limit public exposure of AI system details

Implement proper access controls on repositories

Monitor for reconnaissance activities

Use honeypots to detect scanning

Detection Indicators

Unusual API endpoint probing

Systematic repository access patterns

Automated scanning signatures

Information gathering queries

Initial Access Stage

Gaining Initial Foothold

Techniques for gaining initial foothold in AI systems and environments

System Compromise

AI Supply Chain Compromise

Critical

Compromise AI model supply chains to inject malicious components

Exploit Public-Facing Application

High

Exploit vulnerabilities in public AI applications and APIs

Drive-By Compromise

Medium

Compromise systems through malicious websites targeting AI developers

Account Access

Valid Accounts

High

Use compromised credentials to access AI systems and platforms

Phishing

Medium

Target AI researchers and developers with specialized phishing campaigns

Trusted Relationship

Medium

Leverage trusted partnerships to gain access to AI systems

Execution Stage

Critical Execution Techniques

Critical techniques for executing malicious code and commands in AI systems

LLM Attacks

LLM Prompt Injection

Critical

Inject malicious prompts to manipulate LLM behavior and outputs

LLM Jailbreak

Critical

Bypass LLM safety constraints and content filters

Crescendo LLM Jailbreak

Critical

Gradually escalate prompt complexity to bypass safety measures

System Manipulation

User Execution

High

Trick users into executing malicious AI-generated content

Command and Scripting Interpreter

Critical

Execute commands through AI system interpreters and tools

Web Request Triggering

High

Trigger malicious web requests through AI system interactions

Advanced Techniques

ASCII Smuggling

Medium

Hide malicious content using ASCII encoding techniques

Off-Target Language

Medium

Use non-English languages to bypass content filters

System Instruction Keywords

High

Exploit system instruction keywords to manipulate AI behavior

Persistence Stage

Long-Term Access Techniques

Techniques for maintaining long-term access to AI systems and data

Memory & Data Persistence

Memory Infection

Critical

Inject persistent malicious content into AI system memory

RAG Poisoning

Critical

Poison Retrieval-Augmented Generation systems with malicious data

Poison Training Data

Critical

Inject malicious data into training datasets for long-term impact

System Persistence

Thread Infection

High

Maintain persistence through conversation thread manipulation

LLM Plugin Compromise

High

Compromise LLM plugins to maintain system access

Shared Resource Poisoning

High

Poison shared resources used by multiple AI systems

Collection Stage

Data Collection Techniques

Techniques for collecting sensitive data, credentials, and model information from AI systems

Data Exfiltration

LLM Data Leakage

Critical

Extract sensitive data from LLM training data or context through prompt manipulation

RAG Data Collection

High

Extract indexed data from RAG systems through crafted queries

Memory Data Extraction

High

Extract stored information from AI agent memory systems

Model & Credential Theft

Model Extraction

High

Extract AI model parameters and architecture through API queries

Credential Access

High

Extract API keys and credentials from AI system configurations

Tool Definition Discovery

Critical

Discover available tools and their capabilities through probing

Impact Stage

Final Impact Techniques

Final stage techniques causing direct harm to systems and data

Service Disruption

Denial of ML Service

Critical

Overwhelm ML services to cause denial of service

Spamming ML System with Chaff Data

High

Flood ML systems with irrelevant data to degrade performance

Cost Harvesting

High

Exploit AI systems to generate excessive costs for victims

Data Impact

Erode Dataset Integrity

Critical

Systematically corrupt datasets to degrade AI performance

Erode ML Model Integrity

Critical

Compromise ML model integrity through targeted attacks

Data Destruction

Critical

Delete or corrupt critical data through AI system manipulation

External Harm

External Harms

Critical

Cause harm to external systems and individuals through AI manipulation

Mutative Tool Invocation

High

Use AI tools to make unauthorized changes to external systems

Evade ML Model

Medium

Develop techniques to evade ML-based security systems

Critical Impact Warning

Impact stage attacks can cause irreversible damage to AI systems, data integrity, and external entities. Implement comprehensive monitoring and incident response procedures to detect and mitigate these threats.

Get Threat Intelligence Alerts