Attack-Class Matrix

injection

Backend handlers processing external input — SQLi, command, SSTI, prompt injection

broken-access-control

Authorization failures, IDOR, privilege escalation (absorbs SSRF)

cryptographic-failures

Weak crypto, plaintext secrets, bad key management

security-misconfiguration

Insecure defaults, verbose errors, exposed admin surfaces

supply-chain-failures

Vulnerable / malicious dependencies, build integrity (expanded A06:2021)

auth-failures

Broken session mgmt, credential stuffing, weak MFA

ssrf

Explicit hunt target — internal service reachability via request forgery

secrets-in-code

Hardcoded credentials, API keys, tokens in source / history

iac-privilege-escalation

Over-permissioned IAM, escalation paths in Terraform/CloudFormation

header-csp-hygiene

Missing security headers, weak CSP, CORS misconfiguration

exceptional-conditions

Improper error handling, fail-open logic, logical errors

mcp-tool-poisoning

Malicious instructions embedded in tool description metadata

mcp-rug-pull

Server behavior changes post-approval after trust is established

mcp-tool-shadowing

Malicious server overrides legitimate tool name / execution flow

mcp-indirect-injection

Agent reads attacker-controlled content (issues, tickets, logs)

mcp-session-hijacking

Bearer token / session ID theft; MCP auth optional per spec

mcp-dns-rebinding

Loopback MCP server attacked via DNS rebind

mcp-oauth-rce

Crafted OAuth redirect URL executes shell commands at handshake

mcp-resource-exhaustion

Prompt storms / recursive tasks → DoS; lethargy technique

rag-retrieval-poisoning

5 malicious docs in millions → 90-97% ASR

rag-embedding-inversion

92% exact token recovery from ada-002 vectors

rag-tenant-boundary-violation

Multi-tenant RAG: cross-tenant doc retrieval via missing metadata filter

rag-indirect-injection

Retrieved doc contains embedded instructions model treats as authoritative

agent-goal-hijacking

Agent objective overridden mid-flight by injected instructions

insecure-tool-execution

Insufficient sandbox / authz on tool invocations

memory-poisoning

Durable hostile instructions written to persistent agent memory

excessive-agency

Overly broad permissions + tool access + no human oversight (lethal trifecta)

agent-identity-abuse

Impersonation across multi-agent pipelines; no cryptographic attestation per hop

insecure-inter-agent-comms

Cascading failures across chained agents; unverified task propagation

unbounded-autonomy

No kill switch, autonomy ladder, or escalation path

mcp-escape-to-host

Agent breaks tool sandbox to host OS; SANDWORM_MODE exploited Claude Code/Cursor in the wild

emergent-offensive-reasoning

Frontier model autonomously generates offensive capabilities without attacker prompting

api-bola

Attacker swaps object ID in API path to access another user's data (BOLA/IDOR)

api-bfla

Low-privilege caller invokes admin API functions with no role check

api-mass-assignment

Framework auto-maps all request body fields to internal object (isAdmin:true)

api-zombie-shadow-endpoint

Undocumented, deprecated, or unregistered API routes still live in production

websocket-abuse

WS endpoints bypass standard HTTP auth/rate-limit controls

business-logic-abuse

Race conditions (TOCTOU), workflow order bypass, token/coupon replay, shadow function abuse

non-human-identity-abuse

Long-lived API keys, static OAuth secrets, over-permissioned service accounts

container-runtime-escape

Privileged containers, CAP_SYS_ADMIN, hostPath mounts, seccomp bypass

k8s-rbac-lateral-movement

K8s RBAC misconfig; cross-namespace secret reads, cluster-admin escalation

cicd-pipeline-poisoning

Overly broad GHA permissions, pinned Action SHA bypass, poisoned CI tooling

llm-model-weight-backdoor

Trojanized open-source weights (BadSeek); 2% poisoned traces = 80%+ ASR

llm-inference-data-exfil

Sensitive data leaking through model outputs, tool invocations, context windows