A catalog of ways attackers can abuse AI agents on workstations, in development containers, and in CI runners.
EAA describes how attackers launch agents, alter their instructions and configuration, collect their data, and use their access to files, tools, and services. Each technique identifies the attacker action and its prerequisites. Cases record what the public evidence shows happened.
The catalog focuses on agents that run for a victim user or organization. Product versions, operating systems, trust decisions, and approval settings determine whether a technique applies. See the scope and evidence model for the inclusion criteria.
techniques/index.md— main catalogatlas.md— selected mechanism comparisons with MITRE ATLAS and case-selection decisionsscope.md— what belongs in the catalogsurfaces.md— where a technique actstactics.md— why the attacker actscases.md— incidents, malicious artifacts, and research, mapped to techniqueshunting.md— detection ideas, required telemetry, and limitationscandidates.md— ideas that need more evidenceevidence.md— how evidence, maturity, outcomes, and confidence are recordeddata/catalog.json— machine-readable catalogdata/catalog.schema.json— catalog schemaCONTRIBUTING.md— entry and source requirements
Technique maturity describes how much has been established:
feasible— the required product behavior and abuse path are documented, but no public implementation is known;demonstrated— public research or a malicious artifact implements the technique;observed— an incident or campaign report confirms that the attacker performed the action described by the technique. Planting a hook, for example, does not prove that it later ran.
Cases separately record whether a procedure was present, planted, attempted, executed, or produced confirmed impact. An observed technique does not mean that every cited artifact executed successfully or that every reported downstream effect was confirmed. See evidence.md for the full rules.
| ID | Technique | Primary surface | Tactics | Maturity |
|---|---|---|---|---|
| EAA-001 | Agent CLI invocation by adversary-controlled initiator | Launcher | Execution | demonstrated |
| EAA-002 | Permissive or unattended agent execution | Launcher | Execution | demonstrated |
| EAA-003 | Lifecycle hook planting | Control Plane | Execution, Persistence | observed |
| EAA-004 | Persistent instruction or memory poisoning | Control Plane | Persistence | observed |
| EAA-005 | Transcript and agent-state collection | State & Telemetry | Credential Access, Collection | observed |
| EAA-006 | MCP or tool configuration abuse | Tools & Integrations | Execution, Persistence | observed |
| EAA-007 | Hostile model/API gateway routing | Runtime & Environment | Collection, Exfiltration | demonstrated |
| EAA-008 | Shadow agent profile or config directory | Runtime & Environment | Execution, Defense Evasion | demonstrated |
| EAA-009 | Remote plugin or skill installation | Control Plane | Execution, Persistence | demonstrated |
| EAA-010 | MCP tool poisoning or definition drift | Tools & Integrations | Execution, Collection, Exfiltration | observed |
| EAA-011 | Environment-variable manipulation of MCP activation | Tools & Integrations | Execution | feasible |
| EAA-012 | Telemetry redirection or sensitive logging | State & Telemetry | Execution, Collection, Exfiltration | demonstrated |
| EAA-013 | Cloud-hosted skill poisoning and sync | Control Plane | Execution, Persistence | feasible |
| EAA-014 | Cross-agent control-plane fan-out planting | Control Plane | Persistence | observed |
| EAA-015 | Inherited authority abuse | Identity & Authority | Execution, Collection, Exfiltration | observed |
| EAA-016 | Agent environment discovery | Runtime & Environment | Discovery | demonstrated |
| EAA-017 | Agent-native evidence tampering | State & Telemetry | Defense Evasion | observed |
| EAA-018 | Indirect instruction injection through task context | Task & Retrieved Context | Execution | demonstrated |
| EAA-019 | Agent preflight helper execution through repository metadata | Runtime & Environment | Execution | demonstrated |
| EAA-020 | Agent-consumed reference takeover | Task & Retrieved Context | Execution | demonstrated |
| EAA-021 | Agent tool implementation poisoning | Tools & Integrations | Execution, Collection, Exfiltration | demonstrated |
Run the dependency-free validator before submitting changes:
python3 scripts/validate.pyThe validator checks the JSON catalog, its Markdown tables, references, versions, and local links. Sources and technical claims still need to be reviewed separately.
Current catalog version: 0.5.1.
Bump minor versions for taxonomy, surface, evidence, or naming changes. Patch versions are enough for wording fixes, source updates, and new examples that do not change the model.
Released under CC0 1.0 Universal.