Practise by OWASP risk

Prompt injection

Text the model reads overrides its instructions, typed by a user or hidden in content it processes.

• Level 1: The open vaultTest 01 · Prompt injection
• Level 2: Please don't tellTest 01 · Prompt injection
• Level 3: The word filterTest 01 · Prompt injection
• Level 4: Nothing gets outTest 01 · Prompt injection
• Level 5: The judgeTest 01 · Prompt injection
• Level 6: Piece by pieceTest 01 · Prompt injection
• Level 7: The hidden ruleTest 01 · Prompt injection
• The helpful inboxTest 02 · Agents
• The helpful answerTest 02 · Agents
• The calendar inviteTest 02 · Agents
• The code reviewerTest 02 · Agents
• The long memoryTest 02 · Agents
• The policy answerTest 02 · Agents
• The runaway agentTest 02 · Agents
• The poisoned toolTest 02 · Agents
• The trusted summaryTest 02 · Agents
• The config changeTest 02 · Agents
• Write the guardrailTest 03 · Blue team
• Architect: The support botTest 03 · Blue team
• Architect: The email agentTest 03 · Blue team
• The hijacked tweet botTest 04 · Case files
• Sydney's rulesTest 04 · Case files
• The shared docTest 04 · Case files
• The $1 TahoeTest 04 · Case files
• The bot that sworeTest 04 · Case files
• Architect: The coding agentTest 05 · Supply chain and agent systems
• Architect: The agent teamTest 05 · Supply chain and agent systems

Seen in: CurXecute, The support ticket that read the tokens table, EchoLeak, A public issue reads the private repos and 7 more

MITRE ATLAS AML.T0051.000AML.T0051.001AML.T0054

Sensitive information disclosure

Secrets, personal data or other users' data leave through the model's answers or actions.

• Level 4: Nothing gets outTest 01 · Prompt injection
• The helpful answerTest 02 · Agents
• The poisoned toolTest 02 · Agents
• The tool updateTest 02 · Agents
• Architect: The support botTest 03 · Blue team
• Architect: The email agentTest 03 · Blue team
• Architect: The documents assistantTest 03 · Blue team
• The shared docTest 04 · Case files
• Architect: The shared knowledge baseTest 05 · Supply chain and agent systems
• Architect: The coding agentTest 05 · Supply chain and agent systems

Seen in: The MCP server that BCC'd every email, The support ticket that read the tokens table, EchoLeak, A public issue reads the private repos and 6 more

MITRE ATLAS AML.T0024AML.T0136AML.T0077

Excessive agency

LLM06 in the 2025 list

An agent holds more tools, permissions or autonomy than its task needs, so a hijack does real damage.

• The helpful inboxTest 02 · Agents
• The calendar inviteTest 02 · Agents
• The code reviewerTest 02 · Agents
• The config changeTest 02 · Agents
• Architect: The email agentTest 03 · Blue team
• Architect: The documents assistantTest 03 · Blue team
• Scope the inbox agentTest 03 · Blue team
• Scope the payments agentTest 03 · Blue team
• Architect: The new toolTest 05 · Supply chain and agent systems
• Architect: The coding agentTest 05 · Supply chain and agent systems
• Architect: The agent teamTest 05 · Supply chain and agent systems

Seen in: The agent that deleted production, A wiper prompt in a coding-agent release

MITRE ATLAS AML.T0053AML.T0086AML.T0101

Supply chain

LLM03 in the 2025 list

Models, packages and tools from outside bring someone else's code or behaviour in with them.

• The tool updateTest 02 · Agents
• Architect: The model downloadTest 05 · Supply chain and agent systems
• Architect: The new toolTest 05 · Supply chain and agent systems

Seen in: The MCP server that BCC'd every email, A wiper prompt in a coding-agent release, Models that ran code on load, 38TB behind one sharing link

MITRE ATLAS AML.T0010AML.T0109AML.T0115

Data and model poisoning

LLM04 in the 2025 list

Training data, feedback or knowledge bases are shaped by an attacker to change what the model does.

• Architect: The model downloadTest 05 · Supply chain and agent systems
• Architect: The bot that learnsTest 05 · Supply chain and agent systems

Seen in: Tay learns from the worst of Twitter

MITRE ATLAS AML.T0020AML.T0018.000AML.T0070

Unbounded consumption

LLM10 in the 2025 list

Requests that run up cost or exhaust capacity, because nothing limits them.

• The runaway agentTest 02 · Agents
• Architect: The support botTest 03 · Blue team
• Architect: The documents assistantTest 03 · Blue team

Seen in: LLMjacking

MITRE ATLAS AML.T0034AML.T0034.002AML.T0029

Misinformation

LLM09 in the 2025 list

Confident, wrong answers that people act on, and that the organisation may be held to.

• The policy answerTest 02 · Agents
• The $1 TahoeTest 04 · Case files
• The chatbot's promiseTest 04 · Case files
• The official answerTest 04 · Case files

Seen in: The official answer, The chatbot's promise, The $1 Tahoe, Six court cases that didn't exist

MITRE ATLAS AML.T0048

Hidden context exposure

LLM07 in the 2025 list

Anything placed in the model's context that users shouldn't see (system instructions, retrieved policy text, tool definitions, keys) can come back out.

• Level 1: The open vaultTest 01 · Prompt injection
• Level 2: Please don't tellTest 01 · Prompt injection
• Level 3: The word filterTest 01 · Prompt injection
• Level 4: Nothing gets outTest 01 · Prompt injection
• Level 5: The judgeTest 01 · Prompt injection
• Level 6: Piece by pieceTest 01 · Prompt injection
• Level 7: The hidden ruleTest 01 · Prompt injection
• Write the guardrailTest 03 · Blue team
• Sydney's rulesTest 04 · Case files

Seen in: Sydney's rules

MITRE ATLAS AML.T0069.002AML.T0084.001AML.T0083

Vector and embedding weaknesses

LLM08 in the 2025 list

Retrieval crosses tenants or permissions, ranks planted content first, or leaks through stored vectors.

• Architect: The bot that learnsTest 05 · Supply chain and agent systems
• Architect: The shared knowledge baseTest 05 · Supply chain and agent systems

MITRE ATLAS AML.T0070AML.T0071AML.T0064

Improper output handling

LLM05 in the 2025 list

Model output is rendered or executed without checks, turning an answer into a request or a command.

• The helpful answerTest 02 · Agents
• Architect: The support botTest 03 · Blue team
• Architect: The documents assistantTest 03 · Blue team
• The shared docTest 04 · Case files

Seen in: EchoLeak, The shared doc

MITRE ATLAS AML.T0067AML.T0077AML.T0050

Agent goal hijack

Content the agent reads redirects it to an attacker's goal, using the tools and access it already has.

• The helpful inboxTest 02 · Agents
• The helpful answerTest 02 · Agents
• The calendar inviteTest 02 · Agents
• The trusted summaryTest 02 · Agents
• The config changeTest 02 · Agents
• Scope the inbox agentTest 03 · Blue team

Seen in: EchoLeak, A public issue reads the private repos

MITRE ATLAS AML.T0051.001AML.T0080

Tool misuse and exploitation

An agent uses its legitimate tools in harmful ways: deleting, sending or spending because it was misled or got the task wrong.

• The calendar inviteTest 02 · Agents

Seen in: The agent that deleted production

MITRE ATLAS AML.T0053AML.T0101AML.T0086

Identity and privilege abuse

An agent acts with broad or inherited access, so whatever it is tricked into doing reaches far beyond the task.

• Architect: The email agentTest 03 · Blue team
• Architect: The documents assistantTest 03 · Blue team
• Scope the inbox agentTest 03 · Blue team
• Scope the payments agentTest 03 · Blue team
• Architect: The agent teamTest 05 · Supply chain and agent systems

Seen in: The support ticket that read the tokens table, A public issue reads the private repos

MITRE ATLAS AML.T0098AML.T0083

Agentic supply chain

Tools, plugins and components an agent loads change after approval or aren't what they claim to be.

• The poisoned toolTest 02 · Agents
• The tool updateTest 02 · Agents
• Architect: The new toolTest 05 · Supply chain and agent systems

Seen in: The MCP server that BCC'd every email, CurXecute, A wiper prompt in a coding-agent release

MITRE ATLAS AML.T0110AML.T0109AML.T0010.005

Unexpected code execution

Content an agent reads becomes commands it runs.

• The code reviewerTest 02 · Agents
• The config changeTest 02 · Agents
• Architect: The coding agentTest 05 · Supply chain and agent systems

Seen in: CurXecute

MITRE ATLAS AML.T0081AML.T0102AML.T0050

Memory and context poisoning

Planted content becomes a lasting memory that steers the agent later.

• The long memoryTest 02 · Agents
• Architect: The coding agentTest 05 · Supply chain and agent systems

Seen in: A memory that kept reporting back

MITRE ATLAS AML.T0080.000

Insecure inter-agent communication

Agents trust messages and hand-offs from each other without checking who sent them or what they carry.

• Architect: The agent teamTest 05 · Supply chain and agent systems

MITRE ATLAS AML.T0118

Cascading failures

One agent's bad output triggers a chain of actions across a system of agents.

• Architect: The agent teamTest 05 · Supply chain and agent systems

Human-agent trust exploitation

An agent the user trusts is steered into persuading them to do the harmful thing themselves.

• The trusted summaryTest 02 · Agents
• Scope the payments agentTest 03 · Blue team

MITRE ATLAS AML.T0130AML.T0048.000

Rogue agents

An agent acts outside what it was meant to do, or misreports what it did, so the people relying on it can't trust its account.

No challenge practises this one yet.

Seen in: The agent that deleted production