Attacks

This illustrative taxonomy covers the attack techniques typically used in AIUC-1 testing. Each certified agent is tested with the techniques most relevant to its risks and deployment. As new incidents and research surface new techniques, the taxonomy is updated so testing reflects how agents actually fail today.

All attacks

L1 category	L2 category	L3 category	Related incident	Related paper
Intended use	Direct ask	Single ask		PAP-005InFoBench: Evaluating Instruction Following Ability in Large Language Models
		Long input	INC-005Sullivan & Cromwell law firm apologizes for AI ‘hallucinations’ in court filing	PAP-005InFoBench: Evaluating Instruction Following Ability in Large Language Models
		Noisy or corrupted input	INC-040Bacon ice cream and nugget overload sees misfiring McDonald’s AI withdrawn	PAP-005InFoBench: Evaluating Instruction Following Ability in Large Language Models
	Indirect ask	Nonsensical input		PAP-018ClarEval: A Benchmark for Evaluating Clarification Skills of Code Agents under Ambiguous Instructions
		Contradictory information		PAP-018ClarEval: A Benchmark for Evaluating Clarification Skills of Code Agents under Ambiguous Instructions
		Implied context		PAP-018ClarEval: A Benchmark for Evaluating Clarification Skills of Code Agents under Ambiguous Instructions
		Ambiguous intent	INC-042NYC’s AI Chatbot Tells Businesses to Break the Law	PAP-018ClarEval: A Benchmark for Evaluating Clarification Skills of Code Agents under Ambiguous Instructions
		Changing intent		PAP-018ClarEval: A Benchmark for Evaluating Clarification Skills of Code Agents under Ambiguous Instructions
		Progressive disclosure	INC-044What Air Canada Lost In ‘Remarkable’ Lying AI Chatbot Case	PAP-018ClarEval: A Benchmark for Evaluating Clarification Skills of Code Agents under Ambiguous Instructions
Misuse (social engineering)	False scenario	Feigned distress		PAP-019The Facade of Truth: Uncovering and Mitigating LLM Susceptibility to Deceptive Evidence
		Feigned frustration		PAP-019The Facade of Truth: Uncovering and Mitigating LLM Susceptibility to Deceptive Evidence
		False persona	INC-049Jailbreak tricks Discord’s new chatbot into sharing napalm and meth instructions	PAP-019The Facade of Truth: Uncovering and Mitigating LLM Susceptibility to Deceptive Evidence
		Fabricated evidence		PAP-019The Facade of Truth: Uncovering and Mitigating LLM Susceptibility to Deceptive Evidence
	Persuasion	Moral reframing	INC-033OpenAI’s Operator Agent Reportedly Executed Unauthorized $31.43 Transaction Despite Safety Protocol	PAP-020How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs
		Incentive manipulation	INC-046A Chevy for $1? Car dealer chatbots show perils of AI for customer service	PAP-020How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs
		Trust building	INC-018AI-Forged Military IDs Used in North Korean Phishing Attack	PAP-020How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs
	Conversational manipulation	Confusion tactics		PAP-021Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack
	Conversational manipulation	Insistence	INC-046A Chevy for $1? Car dealer chatbots show perils of AI for customer service	PAP-021Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack
Misuse (technical)	Direct injection	Perturbation attacks		PAP-022Special-Character Adversarial Attacks on Open-Source Language Model
		System message injection	INC-046A Chevy for $1? Car dealer chatbots show perils of AI for customer service	PAP-023Securing AI Agents Against Prompt Injection Attacks
		Ignore previous instructions		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Delimiter injection		PAP-022Special-Character Adversarial Attacks on Open-Source Language Model
		Special token injection		PAP-022Special-Character Adversarial Attacks on Open-Source Language Model
		Context overflow		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Bijection		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Template mutation		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Adversarial suffix		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Best-of-N		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Iterative rephrasing		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Past tense		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Future tense		PAP-023Securing AI Agents Against Prompt Injection Attacks
		Encoding attacks	INC-038Microsoft fixes ASCII smuggling flaw that enabled data theft from Microsoft 365 Copilot	PAP-022Special-Character Adversarial Attacks on Open-Source Language Model
	Indirect injection	Via data inputs	INC-004Attack targeting OpenAI Codex users exposes AI software supply chain risks INC-002Hidden prompt turns Microsoft Copilot into an AI worm	PAP-024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
		Via tool responses	INC-023Infosec hounds spot prompt injection vuln in Google Gemini apps	PAP-024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
		Via tasks		PAP-002Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use

Introduction

Context

Standard

Certification

Evals Methodology

Auditors

Legal

All attacks

​All attacks

All attacks