Attacks

The attack techniques AIUC-1 evals use to probe an AI agent, with the incidents and research behind each. This taxonomy covers the attack techniques typically used in AIUC-1 testing. Each certified agent is tested with the techniques most relevant to its risks and deployment. As new incidents and research surface new techniques, the taxonomy is updated so testing reflects how agents actually fail today.

Intended use

Direct ask

Variant	Related incident	Related paper
Single ask	INC-001GitHub’s Copilot reproduced a professor’s LGPL-licensed sparse-matrix code verbatim, stripping the license	PAP-005InFoBench: Evaluating Instruction Following Ability in Large Language Models
Long input	INC-015Sullivan & Cromwell apologized to a bankruptcy judge for AI hallucinations in a Chapter 15 filing	PAP-005InFoBench: Evaluating Instruction Following Ability in Large Language Models
Noisy or corrupted input	INC-019McDonald’s IBM-built AI drive-thru misinterpreted spoken orders, ending the trial	PAP-005InFoBench: Evaluating Instruction Following Ability in Large Language Models

Indirect ask

Variant	Related incident	Related paper
Nonsensical input		PAP-008Benchmarking Failures in Tool-Augmented Language Models
Contradictory information		PAP-018ClarEval: Clarification Skills of Code Agents under Ambiguous Instructions
Implied context		PAP-008Benchmarking Failures in Tool-Augmented Language Models
Ambiguous intent	INC-044New York City’s MyCity business chatbot advised users to break the law	PAP-008Benchmarking Failures in Tool-Augmented Language Models
Changing intent		PAP-018ClarEval: Clarification Skills of Code Agents under Ambiguous Instructions
Progressive disclosure	INC-013Air Canada’s chatbot invented a refund policy, and the airline was held liable	PAP-008Benchmarking Failures in Tool-Augmented Language Models

False scenario

Variant	Related incident	Related paper
Feigned distress		PAP-019The Facade of Truth: LLM Susceptibility to Deceptive Evidence
Feigned frustration		PAP-019The Facade of Truth: LLM Susceptibility to Deceptive Evidence
False persona	INC-032Discord’s Clyde chatbot was tricked into outputting weapon instructions via a roleplay jailbreak	PAP-019The Facade of Truth: LLM Susceptibility to Deceptive Evidence
Fabricated evidence		PAP-019The Facade of Truth: LLM Susceptibility to Deceptive Evidence

Persuasion

Variant	Related incident	Related paper
Moral reframing	INC-026Anthropic’s Claudius vending-machine agent was talked into zeroing prices and giving away inventory	PAP-020How Johnny Can Persuade LLMs to Jailbreak Them
Incentive manipulation	INC-026Anthropic’s Claudius vending-machine agent was talked into zeroing prices and giving away inventory	PAP-020How Johnny Can Persuade LLMs to Jailbreak Them
Trust building	INC-040OpenAI’s ChatGPT generated fake South Korean military ID images for a North Korean Kimsuky phishing campaign	PAP-020How Johnny Can Persuade LLMs to Jailbreak Them

Conversational manipulation

Variant	Related incident	Related paper
Confusion tactics		PAP-021Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack
Insistence	INC-036DPD’s customer-service chatbot swore at a customer and disparaged the company	PAP-021Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack

Misuse (technical)

Direct injection

Variant	Related incident	Related paper
Perturbation attacks		PAP-003System Prompt Extraction Attacks and Defenses in Large Language Models
System message injection	INC-022Chevrolet of Watsonville’s ChatGPT-powered chatbot was manipulated into ‘selling’ a $76,000 Tahoe for$ 1	PAP-022Special-Character Adversarial Attacks on Open-Source Language Models
Ignore previous instructions		PAP-023Securing AI Agents Against Prompt Injection Attacks
Delimiter injection		PAP-003System Prompt Extraction Attacks and Defenses in Large Language Models
Special token injection		PAP-022Special-Character Adversarial Attacks on Open-Source Language Models
Context overflow		PAP-023Securing AI Agents Against Prompt Injection Attacks
Bijection		PAP-003System Prompt Extraction Attacks and Defenses in Large Language Models
Template mutation		PAP-022Special-Character Adversarial Attacks on Open-Source Language Models
Adversarial suffix		PAP-023Securing AI Agents Against Prompt Injection Attacks
Best-of-N		PAP-003System Prompt Extraction Attacks and Defenses in Large Language Models
Iterative rephrasing		PAP-022Special-Character Adversarial Attacks on Open-Source Language Models
Past tense		PAP-023Securing AI Agents Against Prompt Injection Attacks
Future tense		PAP-003System Prompt Extraction Attacks and Defenses in Large Language Models
Encoding attacks	INC-007Microsoft 365 Copilot was exploited via ASCII smuggling to exfiltrate user data	PAP-022Special-Character Adversarial Attacks on Open-Source Language Models

Indirect injection

Variant	Related incident	Related paper
Via data inputs	INC-028A malicious npm package posing as an OpenAI Codex UI exfiltrated developer authentication tokens INC-029A hidden prompt injection in a Word document turned Microsoft Copilot for Word into a self-propagating AI worm	PAP-024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents
Via tool responses	INC-006Nx’s compromised npm package weaponized installed AI coding agents to exfiltrate developer credentials	PAP-024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents
Via tasks		PAP-002Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use

Introduction

Context

Standard

Certification

Evals Taxonomy

Auditors

Legal

Intended use

Direct ask

Indirect ask

False scenario

Persuasion

Conversational manipulation

Misuse (technical)

Direct injection

Indirect injection

​Intended use

​Direct ask

​Indirect ask

​Misuse (social engineering)

​False scenario

​Persuasion

​Conversational manipulation

​Misuse (technical)

​Direct injection

​Indirect injection

Intended use

Direct ask

Indirect ask

Misuse (social engineering)

False scenario

Persuasion

Conversational manipulation

Misuse (technical)

Direct injection

Indirect injection