--- title: Agent Attack Taxonomy (AAT) and A2OSF Methodology description: The ZioSec Agent Attack Taxonomy classifies 62 agent attack techniques across 8 layers, 10 tactics, and 10 threat scopes, with cross-maps to OWASP ASI and MITRE ATLAS. url: https://ziosec.com/methodology --- # Agent Attack Taxonomy (AAT) and A2OSF Methodology The common language for agent attacks. Agent Attack Taxonomy (AAT) classifies how enterprise AI agents are attacked, where each attack lands, and what business risk it creates. Agentic AI Offensive Security Framework (A2OSF) is the operational methodology ZioSec uses to apply that language through attack creation, remediation, reporting, dashboards, and continuous testing. - Download AAT v2.0: https://ziosec.com/downloads/ziosec-agent-attack-taxonomy.pdf - Run an AAT evaluation: https://ziosec.com/demo ## What the two names mean The **Agent Attack Taxonomy (AAT)** is the common language for agent attacks. It classifies each finding by attack layer, tactic and technique, and threat scope, while carrying the existing standards mappings and stable identifiers used in ZioSec reports. The **Agentic AI Offensive Security Framework (A2OSF)** is the methodology for putting that language to work. It defines how agentic systems are scoped, attacked, measured, reported, and continuously retested. The distinction is organizational, not technical: AAT gives the existing taxonomy within A2OSF a clear public identity. It does not change or replace its named conventions, identifiers, or mappings. AAT is the classification taxonomy contained within A2OSF. A2OSF is the broader offensive-security methodology used to generate, classify, measure, and remediate those findings. ## One finding. Three coordinates. AAT classifies every finding across three orthogonal dimensions: **where** the attack landed, **how** it worked, and **why you care**. The result is a shared language that security teams can count, compare, trend, route, and report. AAT is the language. A2OSF is the methodology. ZioSec is the engine that continuously executes the methodology and produces AAT-classified findings. ### Dimension 1, Where: 8 attack layers Layer totals are technique-to-layer assignments, not eight mutually exclusive buckets. 62 techniques produce 82 tags because 20 techniques span multiple layers. - **L-INT Interface** (8 technique tags). User-facing input surfaces and indirect data-ingestion paths. - **L-ORC Orchestration** (12 technique tags). Planner, router, supervisor, task decomposition, and policy enforcement. - **L-MEM Memory** (12 technique tags). Context, RAG, vector stores, long-term state, and memory provenance. - **L-TOO Tooling** (12 technique tags). APIs, sandboxes, browsers, file systems, databases, and MCP tools. - **L-MAG Multi-Agent** (11 technique tags). Inter-agent messaging, trust, routing, shared state, and A2A coordination. - **L-IAM Identity and Access** (10 technique tags). Agent identities, credentials, delegation, token scope, and permission boundaries. - **L-SUP Supply Chain** (10 technique tags). Registries, packages, templates, agent cards, models, and runtime dependencies. - **L-HAB Human-Agent Boundary** (7 technique tags). Approval flows, alerts, trust signals, and human oversight interfaces. ### Dimension 2, How: 10 tactics, 62 techniques - **T-INM Input Manipulation** (5 techniques) - **T-LPS Logic and Planning Subversion** (7 techniques) - **T-TEE Tool and Environment Exploitation** (10 techniques) - **T-MKP Memory and Knowledge Poisoning** (6 techniques) - **T-MAC Multi-Agent Exploitation** (7 techniques) - **T-ICE Identity and Credential Exploitation** (6 techniques) - **T-SCC Supply Chain Compromise** (6 techniques) - **T-HTE Human Trust Exploitation** (6 techniques) - **T-DEV Defense Evasion** (5 techniques) - **T-PER Persistence** (4 techniques) ### Dimension 3, Why you care: 10 threat scopes - **TS-UA Unauthorized Action** (Critical). The agent executed a state-changing action without approval or outside its authorized scope. - **TS-PE Privilege Escalation** (High). Access to internal tools, data, or systems restricted from the current session, user, or agent role. - **TS-DE Data Exfiltration** (High). Sensitive context, system prompts, user data, or business info leaked via agent output or side channels. - **TS-KC Knowledge Corruption** (Medium). Agent reliability destroyed via persistent bias, poisoned knowledge, or corrupted state. - **TS-RB Regulatory Breach** (High). Agent actions violate legal frameworks (GDPR, HIPAA, PCI-DSS, EU AI Act) or compliance policies. - **TS-RE Resource Exhaustion** (Low/Medium). Forced high compute costs, API quota depletion, or infrastructure overload. - **TS-CF Cascading System Failure** (Critical). A single compromised agent triggers chain-reaction failures across downstream systems. - **TS-SC Supply Chain Contamination** (Critical). A compromised upstream component propagates malicious behavior to all consumers. - **TS-HM Human Manipulation** (Medium/High). Agent generates deceptive outputs that manipulate human decision-making. - **TS-BI Behavioral Integrity Loss** (High). Agent appears compliant but pursues hidden objectives or drifts from intended behavior. Threat Scope is the dimension that prioritizes remediation, and the dimension that aligns a technical finding to the risk vocabulary compliance frameworks already use. ### The AAT Coverage Matrix AAT's attack layers and tactics form an 8 by 10 matrix. Each cell shows which techniques can be exploited at that layer using that tactic. Populate the same matrix with test results to expose untested surface, findings density, and drift over time. Measure coverage, not activity. - 62 techniques - 82 layer tags - 20 multi-layer techniques ### Classify once, report in the vocabulary each reader needs A finding is classified once with an AAT layer, technique, and threat scope. Technique cross-maps and governance alignment are carried alongside. **Technique cross-maps.** - **OWASP ASI.** AAT techniques carry OWASP ASI references. In the worked supplier-invoice exfiltration chain, T-INM.002 maps to ASI01 (Agent Goal Hijack) and T-TEE.006 maps to ASI02 (Tool Misuse and Exploitation). - **MITRE ATLAS.** AAT carries technique-level MITRE ATLAS identifiers where a corresponding behavior exists. The example chain maps to AML.T0051.001 (Indirect Prompt Injection) and AML.T0086 (Exfiltration). **Governance and assurance alignment.** These are indicative alignment notes, not certification claims. Direct control-by-control mappings remain a planned extension. - **NIST AI RMF (MAP / MEASURE).** AAT Threat Scope aligns the finding to NIST AI RMF risk vocabulary covering data provenance, privacy, and security risk. - **ISO/IEC 42001 (Annex A).** AAT Threat Scope connects the technical finding to relevant management-system and Annex A control areas. - **EU AI Act (Art. 10 / 15).** A data-exfiltration finding aligns to the requirements covering data governance, robustness, and cybersecurity. - **AIUC-1.** The AAT Coverage Matrix and per-finding technique tags provide assurance evidence as a by-product of running A2OSF. ### AAT in the product The moment A2OSF confirms a finding, ZioSec tags it with its AAT layer, technique, and threat scope. OWASP ASI and MITRE ATLAS references are carried alongside, while governance alignment can be routed into risk and audit workflows. ## FAQ **What is the difference between AAT and A2OSF?** AAT is the classification system used to name and report agent attacks. A2OSF is the operational methodology for designing, chaining, executing, measuring, and continuously repeating those attacks. **Is AAT a competing standard?** No. AAT is a self-contained attack taxonomy, not a certification standard. It does not replace OWASP or MITRE ATLAS. It sits beneath them at the resolution an offensive tester works at and carries references upward into engineering, risk, and audit workflows. **Why not just use MITRE ATLAS or OWASP directly?** OWASP identifies priority agentic risk categories, while MITRE ATLAS describes adversary behavior across the attack lifecycle. AAT adds tester-resolution attack layers, techniques, threat scopes, and coverage measurement, then cross-references findings into those existing vocabularies. **How do AAT cross-maps work?** A finding is classified once with an AAT layer, technique, and threat scope. OWASP ASI and MITRE ATLAS references are populated from the technique metadata. Threat Scope aligns the finding to the risk vocabulary used by NIST AI RMF, ISO/IEC 42001, and the EU AI Act. **Does my team have to adopt AAT?** You can use AAT with your internal red team, require AAT identifiers from external testing vendors, or receive AAT-classified findings from ZioSec. The value compounds when findings from every source use the same stable identifiers, while each reader can still receive the standards view they need. ## Related - The Platform: https://ziosec.com/platform - Sample Report: https://ziosec.com/sample-report - AI Compliance Coverage: https://ziosec.com/ai-compliance ## Contact - Email: info@ziosec.com - Phone: +1-720-807-2737 - Book a demo: https://ziosec.com/demo