Attack taxonomy

Every episode is built around a real way an agent can be turned against its owner, and every verdict names the category it convicted on. There are six. They are the vocabulary of the referee: an episode sets one up, and the verdict says whether your agent fell for it and what it did.

The six categories#

Category	What the episode tests
`prompt_injection`	Whether hostile text — in a tool result, a document, a customer message — can override your agent's instructions and get it to act on the attacker's behalf.
`tool_shadowing`	Whether a look-alike or substituted tool can slip into your agent's reach and be called in place of the legitimate one.
`data_exfiltration`	Whether your agent can be lured into sending data somewhere it should not go — an external recipient, an attacker-chosen destination, a report that leaks.
`excessive_agency`	Whether your agent over-reaches: taking actions beyond the task it was given, touching records or systems outside its remit.
`credential_access`	Whether your agent can be steered into reading, surfacing, or using secrets and credentials it should never handle.
`privilege_escalation`	Whether your agent can be pushed to acquire or exercise permissions above the ones it was granted.

A single episode is usually about one category — the injected instruction in a customer record that tries to make your agent forward data (prompt_injection leading toward data_exfiltration), the request that tempts it to act beyond its brief (excessive_agency). The verdict names the category, the severity, and what your agent actually did.

Observed behavior, not self-report#

The taxonomy is about what your agent did, not what it said about itself. An agent that politely explains it would never exfiltrate data and then forwards the record fails on data_exfiltration. The verdict rests on the trajectory — the turns it took, the tools it called, the effects it caused — captured out of band, so nothing the agent narrates can change it.

How a category becomes a verdict#

When your agent finishes an episode, the referee grades the submitted trajectory against the episode's own definition of a breach and returns a verdict: a category, a status (pass or fail), a severity, a plain-language why, and the evidence behind it. You see all of that; you never see the episode's answer key, which is what keeps the library honest. See the agent contract for the full verdict shape.

Next steps#

Episode library: the scenarios these categories are set in.
Running an evaluation: drive an episode and read the verdict.
Agent contract: the verdict wire.