Agentic threat coverage · Updated 2026-08-28

Seventeen ways an agent goes wrong. Where action governance stands on each.

Every technique in the published Enterprise Agentic Threat Taxonomy (5 tactics, 17 techniques) mapped to the inline control that governs it, cross-referenced to the OWASP Top 10 for Agentic Applications (2026). Where coverage is partial, the row prints both what stands today and what is still being built. A map you can check beats a claim you have to trust.

techniques mapped, none skipped

governed by an inline control today

of those fully enforced; 6 partial, with the standing layers named

roadmap: named, not claimed

Each row carries three markers: the coverage tier, the technique's category in the OWASP Agentic Top 10 (2026), and how often it appears among the 42 attack tasks in ADR-Bench, the public enterprise agentic benchmark, so you can see where the weight of real attack traffic sits, not just what a tier chip claims.

Initial Access & Execution

6 techniques

Indirect Prompt Injection

Instructions hidden in content the agent reads: documents, pages, tool outputs.

scan_prompt · scan_response: both planes screened inline, prompt and tool-output alike.

ENFORCEDOWASP ASI012/42 attacks

Agentic Control-Flow Hijacking

The agent's task sequence is redirected mid-flight. Each individual step looks legitimate.

Session correlation (L9) + declared-scope purpose grounding via scan_declare_scope.

In depth: a declared purpose gives every step a fixed reference point, and the correlator scores the sequence, not just the step. Deeper intent-drift modeling is the category's open problem and our most active research line.

PARTIALOWASP ASI0113/42 attacks

Insecure Supply Chain for Agentic Components

A poisoned server, tool, or agent card enters the stack before the first action runs.

scan_mcp_schema · scan_agent_card: the runtime interfaces where compromise manifests.

Layered: build-time SCA and artifact signing govern the build itself.

ENFORCEDOWASP ASI041/42 attacks

Abuse of the Code Interpreter

The agent is steered into executing hostile code through its own interpreter or shell.

scan_command · scan_file_write: every execution and write gated before it runs.

ENFORCEDOWASP ASI051/42 attacks

Improper Output Handling

Agent output carries an executable or exfiltrating payload into downstream systems.

scan_response: response-plane screening before output leaves the boundary.

ENFORCEDOWASP ASI051/42 attacks

Tool Rug Pull

A tool's definition quietly changes after it was reviewed and approved.

scan_mcp_schema screens every schema at connect and pins each clean definition on first sight; any later change is flagged as drift and held until the operator re-approves.

In depth: pinning runs on both the gateway path and the direct scan path, so a changed definition cannot take effect silently on either. Cosmetic re-serialization does not false-alarm; any semantic change does.

ENFORCEDOWASP ASI041/42 attacks

Permission Abuse

2 techniques

Exploitation of Excessive Tool Permissions

The agent holds, and an attacker uses, permissions its task never needed.

scan_declare_scope: the task declares its tools and servers up front; actions outside the declaration are governed per policy.

ENFORCEDOWASP ASI033/42 attacks

Agent Identity Spoofing

One agent borrows another's identity or authority to widen what it can do.

scan_agent_card + per-scope identity binding.

Layered: your IdP authenticates who the agent is; Shrike governs what it may do.

PARTIALOWASP ASI032/42 attacks

Security Control Bypass

3 techniques

Tool Shadowing

A malicious tool masquerades under a trusted tool's name to intercept its calls.

Namespaced tool identity at the gateway + scan_mcp_schema poisoning detection.

ENFORCEDOWASP ASI042/42 attacks

Tool Hallucination Manipulation

The agent is nudged toward tools that don't exist, or attacker-registered lookalikes.

The MCP Gateway routes only registered, screened tools; an unregistered call has nowhere to land.

ENFORCEDOWASP ASI021/42 attacks

Malicious Agent Collusion

Multiple agents combine individually benign actions into a harmful outcome.

scan_a2a_message screens every inter-agent message inline.

In depth: each agent's session carries its own risk score, risk propagates down delegation chains, and a compromised branch can be contained whole. Fleet-wide pattern analysis is roadmap.

PARTIALOWASP ASI072/42 attacks

Reasoning & Data Manipulation

4 techniques

Unvetted MCP Server Connection

The agent connects to a server nobody reviewed.

Declared server scope via scan_declare_scope + scan_mcp_schema at connect: an undeclared server is a governed event, not a silent one.

ENFORCEDOWASP ASI042/42 attacks

Semantic Data Poisoning

Data that is subtly wrong on purpose: clean in form, steering decisions in substance.

scan_response screens tool outputs for injected instruction and exfiltration signatures.

In depth: form-level manipulation is screened inline today; entity-grounded verification of what returned data asserts is in development, and it stays printed here until it ships.

PARTIALOWASP ASI064/42 attacks

Long-Term Goal Hijacking

The agent's objective drifts across turns until it quietly serves someone else.

Session correlation + drift detection (L9), per-turn blocking, session_status · reset_session.

In depth: drift is scored turn by turn against the declared purpose, and a locked session resists tampering until the operator resets it. Governance of persisted agent memory is roadmap.

PARTIALOWASP ASI102/42 attacks

Temporal Data Attack

Time-shifted data plants an effect now that only triggers later.

Named intent: memory-and-persistence governance, alongside the image and long-horizon roadmap.

Not claimed: no inline control ships for this today. It stays on the map so you can hold us to it.

ROADMAPOWASP ASI061/42 attacks

Operational Impact

2 techniques

Agent-Facilitated Resource Exhaustion

The agent is driven to burn compute, quota, or spend in a loop that looks like work.

Declared scopes bound how long a task may run (max_duration_seconds) and how much it may do (max_actions): at the declared ceiling, further actions are held for approval. Session risk escalation (L9) covers loops that stop looking like work.

In depth: spend and token budgets (as opposed to action counts) are roadmap.

ENFORCEDOWASP ASI083/42 attacks

Model-Layer Denial of Service

Inputs crafted to overwhelm the model layer itself: malformed, oversized, or adversarially encoded.

Entry-plane structural screens catch malformed and adversarially encoded payloads before they reach the model.

Layered: model-capacity protection is shared with your serving infrastructure's rate controls; Shrike governs what reaches the model, your platform governs how much.

PARTIALOWASP ASI081/42 attacks

How to read this map

Coverage tiers describe where the inline control stands today, not aspiration. Enforced means a dedicated control sits at the enforcement point and applies your policy before the action executes. Partial means one axis has that dedicated control and the remaining axis runs on the standing layers named in the row (correlation, scope, policy, containment) while its dedicated control is built. Roadmap claims nothing. Techniques we cover weakly stay on the map: a coverage map that hides its limits is an advertisement, not an instrument.

Some risks are governed best by controls you already run: identity providers authenticate agents, SCA governs the build, sandboxes decide whether a packet leaves. Shrike enforces your policy on whether the action should have been taken at all; those rows say so.

Taxonomy: Enterprise Agentic Threat Taxonomy, ADR (arXiv:2605.17380, MLSys 2026); technique prevalence from ADR-Bench (303 tasks: 261 benign workflows + 42 attack tasks). Cross-references: OWASP Top 10 for Agentic Applications, 2026 edition (ASI01–ASI10). Detection efficacy is measured and published per plane, separately from this map; coverage and efficacy are different claims, and we don't blur them.