Agent-Security Frontier
6 attack vectors, assessing the attack surface once an AI agent holds tool-calling permissions
AI Agent
Tool-calling permissions
Agent-to-agent (A2A) injection
Agent-A's output is executed by Agent-B as a trusted instruction
ReAct chain hijacking
Injecting fake Observations to poison the scratchpad
Multimodal prompt-chain injection
OCR · audio transcription · cross-modal injection via web content
Tool-schema confusion
Bypassing additionalProperties / oneOf constraints
Summarize-tool exfiltration
Using a legitimate summarize tool as a data-exfiltration channel
Delayed trigger
Injected instructions embedded in a document, triggered by a future date
Evaluation output:
resisted injection? · detected tool misuse? · caught data leak? · attack-chain description · CVSS severity score
Mirrors the security-assessment work an AI-safety team does before an agent ships