Insecure Inter-Agent Communication

ASI01Agent Goal Hijack

An agent works towards an objective, and that objective is expressed in language the agent reads alongside untrusted content. Goal hijack is the redirection of the objective itself, so the agent pursues an attacker's aim while behaving, from its own perspective, entirely correctly. It is more consequential than prompt injection against a chat interface because the agent then applies its tools and credentials to the substituted goal, often across many steps.

ASI02Tool Misuse

Tools are how an agent affects the world, and they are the mechanism through which every other agentic risk becomes concrete. Tool misuse covers an agent invoking a legitimate tool for an illegitimate purpose, calling it with hostile arguments, or chaining tools to achieve something no single tool permits. Tool descriptions are themselves an injection surface, since the agent reads them to decide what to call.

ASI03Identity and Privilege Abuse

Agents need identities, and organisations frequently give them powerful shared ones. When an agent acts through a service account that aggregates the permissions of everyone it might serve, it becomes a confused deputy: a low-privilege user's request can be executed with high-privilege authority, and attribution is lost because every action appears to come from the same principal.

ASI04Agentic Supply Chain Vulnerabilities

Agentic systems assemble many third-party parts at runtime: models, agent frameworks, tool servers, connectors, plugins, and increasingly other organisations' agents. Much of this is discovered and connected dynamically, so the trust boundary moves after deployment and a compromised or impersonated component can be adopted without a code change or review.

ASI05Unexpected Code Execution

Many agents can write and run code, or reach tools that do, because that is what makes them broadly useful. It also means a manipulated agent can execute arbitrary code in whatever environment the tool provides. Where that environment holds credentials or network access to internal systems, code execution converts a language-level manipulation into full compromise of the host and everything it can reach.

ASI06Memory and Context Poisoning

Persistent memory is what makes an agent useful across sessions, and it is also a durable place to store an attack. Content written into memory or long-lived context is later read back as trusted background, so a single successful injection can influence behaviour indefinitely and across users where memory is shared. Poisoned memory is harder to detect than a poisoned prompt because the original hostile input is long gone.

ASI08Cascading Failures

Agentic systems are chains, and errors propagate along them. One agent's wrong conclusion becomes another's premise, and because each hop restates the result more confidently and less traceably, a small early mistake can end in a large automated action with no obvious point of origin. Speed compounds this: automated chains complete far faster than humans can notice and intervene.

ASI09Human-Agent Trust Exploitation

Agents present as competent, confident collaborators, and people extend them trust accordingly. That trust is exploitable in both directions: an attacker can use an agent's credibility to persuade a person to approve or disclose something, and an operator's habituation to approving routine agent requests turns a human checkpoint into a rubber stamp. The control that was meant to catch problems stops functioning without anyone noticing.

ASI10Rogue Agents

A rogue agent is one operating outside intended control: an unsanctioned agent someone deployed, an abandoned one still holding valid credentials, or a compromised one now serving another purpose. Because agents are easy to create and often keep long-lived access, organisations accumulate them without inventory or ownership. An agent nobody is monitoring, with credentials nobody has revoked, is both a standing risk and difficult to detect.