AI Agent Security Glossary

Agent Goal Hijacking

An attack in which adversary-supplied input redirects an AI agent away from its operator's objective toward an attacker-controlled one. It is the agentic counterpart of prompt injection, but with action consequences rather than merely textual ones. Catalogued as ASI01 in the OWASP Top 10 for Agentic Applications.

Reference: Agentic AI Security →

Agentic AI Security

The practice of protecting autonomous AI agents — systems that plan, call tools, and take actions on a user's behalf — from being manipulated into harmful behavior, and of limiting the damage they can do when they are. It differs from traditional AI security because an agent acts, using real credentials, rather than only generating text.

Reference: Agentic AI Security →

AI Agent

An AI system that does not merely generate text but takes actions to accomplish goals: it plans, calls tools and APIs, reads and writes data, reaches the network, and executes, often across multiple steps with limited human review. The ability to act is what distinguishes an agent from a chatbot and what defines its security profile.

Cascading Failure

A failure mode of multi-agent systems in which an error or compromise in one agent propagates across the system as downstream agents act on upstream output. Catalogued as ASI08 in the OWASP Top 10 for Agentic Applications.

Credential Exfiltration

An attack in which an AI agent is induced to read and disclose secrets — API keys, SSH keys, cloud credentials, environment variables — typically by exfiltrating them to an attacker-controlled destination.

EchoLeak

A zero-click indirect prompt-injection vulnerability in Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3), disclosed by Aim Security in June 2025. A single crafted email caused Copilot to autonomously read internal data and exfiltrate it through an allowlisted domain, with no user interaction. The first documented case of prompt injection weaponized for concrete data exfiltration in a production AI system.

Reference: Indirect Prompt Injection →

Full-Schema Poisoning

A generalization of tool poisoning, demonstrated by CyberArk, in which the injection is placed not only in a tool's description but anywhere in its schema — parameter names or the input schema itself — all of which enter the model's context.

Reference: Tool Poisoning →

Indirect Prompt Injection

An attack in which malicious instructions are hidden inside content an AI agent reads — an email, document, web page, or tool response — rather than typed by a user, causing the model to follow the embedded instructions when it processes that content.

Reference: Indirect Prompt Injection →

Least Agency

The agentic counterpart of least privilege: the principle that an AI agent should be granted only the minimum autonomy required to complete a safe, bounded task — the narrowest set of tools, the least standing access, the smallest scope of action.

Reference: Agentic AI Security →

LLM Scope Violation

The underlying pattern of attacks like EchoLeak: untrusted external input commandeers a language model into accessing and leaking privileged data that the model is legitimately permitted to reach. The attack violates no permission; it abuses legitimate access.

MCP (Model Context Protocol)

An emerging standard, introduced by Anthropic, by which AI agents discover and call external tools and data sources. Widely adopted across the agent ecosystem. Its security-relevant property is that it merges an agent's reasoning and control flow in a shared context.

Reference: MCP Security →

MCP Security

The practice of protecting AI agents that use the Model Context Protocol from attacks unique to how it handles trust — chiefly tool poisoning, rug pulls, and cross-server shadowing — which arise because tool descriptions and instructions share the model's context without strong isolation.

Reference: MCP Security →

Memory Poisoning

An attack on an AI agent's persistent state — its stored preferences, learned facts, standing instructions, or retrieval index — such that a single successful injection changes the agent's behavior across future sessions, long after the poisoned input is gone. Catalogued as ASI06 in the OWASP Top 10 for Agentic Applications.

Non-Human Identity (NHI)

An identity assigned to a non-human actor — a service account, an API key, or an AI agent — as opposed to a human user. Securing agents as non-human identities, with scoped least-privilege permissions and a defined owner, is the identity layer of agent security.

OWASP Agentic Top 10

The OWASP Top 10 for Agentic Applications (2026), published December 2025 by the OWASP GenAI Security Project — the first peer-reviewed taxonomy of risks specific to autonomous AI agents, using identifiers ASI01 through ASI10. Distinct from the OWASP LLM Top 10, which addresses model-level rather than agent-level risk.

Prompt Injection

The general class of attack in which untrusted input causes a language model to follow instructions it should not. Includes direct injection (typed by a user) and indirect injection (hidden in content the model reads).

Rogue Agent

An AI agent that operates outside policy — by design failure, drift, or compromise — taking actions no one authorized. The July 2025 Replit incident, in which an AI coding agent deleted a production database, is the canonical example. Catalogued as ASI10 in the OWASP Top 10 for Agentic Applications.

Rug Pull (MCP)

An MCP attack that exploits one-time review: a server presents a benign tool definition when the agent first approves it, then swaps in a malicious definition later.

Reference: MCP Security →

Runtime Enforcement / Runtime Agent Security

The security layer that inspects what an AI agent actually does — its tool calls, data access, and network egress — as it happens, and blocks the dangerous actions. It answers whether what an agent is doing, within the access it has, is an attack — a question identity controls do not address.

Shadowing / Cross-Server Shadowing (MCP)

An MCP attack in which a malicious server's tool description manipulates the agent's use of a different, trusted server's tools, compromising the agent even with respect to infrastructure it trusts.

Reference: MCP Security →

Tool Poisoning

An attack on AI agents in which malicious instructions are hidden inside the description or schema of a tool the agent uses, causing the agent's model to follow the attacker's instructions instead of the user's. First demonstrated by Invariant Labs in April 2025; the most prevalent client-side MCP vulnerability.

Reference: Tool Poisoning →