Frameworks

AML.T0010 AI Supply Chain Compromise

• A hallucinated package name is an open registration
• A checkpoint is not inert data

AML.T0010.005 AI Agent Tool

• The MCP server added one BCC

AML.T0011.002 Poisoned AI Agent Tool

• A skill's prerequisites section is the payload

AML.T0012 Valid Accounts

• MCP access is now an IdP problem

AML.T0020 Poison Training Data

• A poisoning budget does not scale with the corpus

AML.T0024 Exfiltration via AI Inference API

• Every response is a training label

AML.T0024.002 Extract AI Model

• Every response is a training label

AML.T0034 Cost Harvesting

• A decoy puzzle is a denial of wallet
• The budget reset with the conversation

AML.T0051 LLM Prompt Injection

• A retrieved chunk is not a trusted source
• A cache hit is not a trust grant
• A tool result is not a system message
• Visible text is not the filter string

AML.T0051.000 Direct

• Prompt secrecy is not a security control

AML.T0051.001 Indirect

• A URL fragment is a prompt the server never sees
• The issue body ran with the maintainer's token
• The trusted config was the one the attacker could write
• The screenshot is a prompt, not a witness
• A retry is not a replay
• A tool result is not a system message

AML.T0053 AI Agent Tool Invocation

• A hook is not a security boundary
• Deny has to mean deny
• Two allowed actions can still be the breach

AML.T0054 LLM Jailbreak

• The guardrail judged the message, not the conversation
• A blocklist is not a jailbreak gate

AML.T0056 Extract LLM System Prompt

• Prompt secrecy is not a security control

AML.T0068 LLM Prompt Obfuscation

• A blocklist is not a jailbreak gate
• Visible text is not the filter string

AML.T0070 RAG Poisoning

• A decoy puzzle is a denial of wallet
• A retrieved chunk is not a trusted source
• A retrieved chunk is not a data point

AML.T0080 AI Agent Context Poisoning

• Memory without provenance is delayed authority

AML.T0080.000 Memory

• Memory without provenance is delayed authority

AML.T0081 Modify AI Agent Configuration

• The trusted config was the one the attacker could write
• The agent edited its own policy

AML.T0086 Exfiltration via AI Agent Tool Invocation

• The issue body ran with the maintainer's token
• Two allowed actions can still be the breach

AML.T0091 Use Alternate Authentication Material

• A valid token is not your audience
• MCP access is now an IdP problem

AML.T0091.000 Application Access Token

• A valid token is not your audience
• MCP access is now an IdP problem

AML.T0104 Publish Poisoned AI Agent Tool

• A skill's prerequisites section is the payload
• The MCP server added one BCC

T1078 Valid Accounts

• MCP access is now an IdP problem

T1195 Supply Chain Compromise

• A checkpoint is not inert data
• The install step ran the pull request

T1195.002 Compromise Software Supply Chain

• A hallucinated package name is an open registration
• The MCP server added one BCC
• The install step ran the pull request

T1204 User Execution

• A skill's prerequisites section is the payload

T1528 Steal Application Access Token

• A valid token is not your audience
• MCP access is now an IdP problem

T1562 Impair Defenses

• The hook went quiet; traffic did not
• A hook is not a security boundary
• Deny has to mean deny

T1567 Exfiltration Over Web Service

• Two allowed actions can still be the breach

LLM01 Prompt Injection

• A URL fragment is a prompt the server never sees
• The guardrail judged the message, not the conversation
• The issue body ran with the maintainer's token
• The trusted config was the one the attacker could write
• A retrieved chunk is not a trusted source
• The screenshot is a prompt, not a witness
• A tool result is not a system message
• A blocklist is not a jailbreak gate
• Visible text is not the filter string

LLM03 Supply Chain

• A hallucinated package name is an open registration
• A skill's prerequisites section is the payload
• The MCP server added one BCC
• A checkpoint is not inert data
• The LLM API reseller is the new bulletproof host

LLM04 Data and Model Poisoning

• A poisoning budget does not scale with the corpus
• A retrieved chunk is not a trusted source
• A retrieved chunk is not a data point
• Memory without provenance is delayed authority

LLM06 Excessive Agency

• The issue body ran with the maintainer's token
• The trusted config was the one the attacker could write
• A retry is not a replay
• The agent edited its own policy
• A hook is not a security boundary
• Deny has to mean deny
• Two allowed actions can still be the breach

LLM07 System Prompt Leakage

• Prompt secrecy is not a security control

LLM08 Vector and Embedding Weaknesses

• A decoy puzzle is a denial of wallet
• A retrieved chunk is not a trusted source
• A retrieved chunk is not a data point

LLM09 Misinformation

• A hallucinated package name is an open registration

LLM10 Unbounded Consumption

• A decoy puzzle is a denial of wallet
• Every response is a training label
• The budget reset with the conversation

ASI01 Agent Goal Hijack

• A URL fragment is a prompt the server never sees
• The issue body ran with the maintainer's token
• The screenshot is a prompt, not a witness
• A tool result is not a system message

ASI02 Tool Misuse and Exploitation

• The issue body ran with the maintainer's token
• The budget reset with the conversation
• A retry is not a replay
• A hook is not a security boundary
• Deny has to mean deny
• Two allowed actions can still be the breach

ASI03 Identity and Privilege Abuse

• A valid token is not your audience
• The agent edited its own policy
• Two allowed actions can still be the breach
• MCP access is now an IdP problem

ASI04 Agentic Supply Chain Vulnerabilities

• A hallucinated package name is an open registration
• A skill's prerequisites section is the payload
• The MCP server added one BCC
• A checkpoint is not inert data

ASI05 Unexpected Code Execution

• The trusted config was the one the attacker could write

ASI06 Memory and Context Poisoning

• A retrieved chunk is not a data point
• Memory without provenance is delayed authority