IoPC Taxonomy

IoPC (Indicators of Prompt Compromise) is an open, versioned classification of how AI systems and agents are attacked. Every technique has a stable id and is mapped to OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, MITRE ATLAS, Google Secure AI Framework (SAIF), CSA Autonomous Action Runtime Management (AARM). Version 2.0.0-alpha.

T1 Instruction & Input Injection

Techniques that introduce attacker-controlled instructions into an AI system's effective instruction stream via direct input, retrieved content, or data the agent is asked to process.

• IOPC-T1.001 Direct Prompt Injection: Attacker-authored instructions supplied directly in the user-controlled input channel to override system or developer intent.
• IOPC-T1.002 Indirect Prompt Injection: Attacker instructions embedded in third-party content (web pages, documents, emails, tickets) that the model ingests as data and interprets as instructions.
• IOPC-T1.003 Agent Data Injection: Instructions placed in data an agent is explicitly tasked to process (issue comments, PR descriptions, CI logs, tickets, structured records) that exploit the agent's failure to separate trusted control data from untrusted content data during task execution.
• IOPC-T1.004 Jailbreak & Safety Bypass: Inputs that make a model disregard its own safety policy — persona/roleplay framing, refusal-suppression patterns or optimisation-found suffixes — so it produces content or actions its guardrails should prevent.
• IOPC-T1.005 Triggered & Delayed Instruction Activation: An injected instruction that stays dormant until a condition is met — a keyword, a later turn, a specific tool result or a time/step delay — so the payload is not present in the request that eventually causes the action.

T2 Data, Retrieval & Memory Poisoning

Techniques that corrupt the data an AI system retrieves, remembers, or learns from, so that later reasoning and actions are influenced without a fresh injection.

• IOPC-T2.001 Retrieval / RAG Poisoning: Malicious content placed in a knowledge source an application retrieves from — a vector store, indexed documents, a shared workspace or mailbox — so that it is pulled into prompts and acts as an indirect injection or biases answers.
• IOPC-T2.002 Persistent Memory Poisoning: Injection of adversarial content into an agent's durable memory (long-term memory stores, user profiles, episodic memory, learned preferences) so that it influences future sessions without a fresh injection.
• IOPC-T2.003 Training & Fine-tuning Data Poisoning: Malicious or unauthorised examples introduced into training, fine-tuning or feedback data so the resulting model carries biased behaviour or a backdoor trigger.
• IOPC-T2.004 AI Supply Chain Compromise: Compromise of the models, datasets, packages, plugins or MCP servers an AI system assembles from — including published poisoned artefacts and reputation/rug-pull attacks on agent tools.
• IOPC-T2.005 Hallucinated Dependency Exploitation: Adversaries mine a model's hallucinations for non-existent packages, endpoints or entities, then register them so that later generations resolve to attacker-controlled artefacts ("slopsquatting").
• IOPC-T2.006 AI Recommendation Poisoning (GEO Poisoning): Content planted where AI assistants and AI search will read it — hidden instructions in web pages, pre-filled "Summarize with AI" links, mass-produced or fake-authority pages — so that the assistant recommends, ranks or cites the attacker's product, link or narrative to its users. Also reported as generative engine optimisation (GEO) poisoning and AI SEO poisoning.

T3 Tool & Agent Ecosystem

Techniques that abuse tools, tool metadata, protocols (e.g. MCP), delegation, and inter-agent context to influence or extend an agent's actions.

• IOPC-T3.001 Agentic Tool Misuse: Prompts or content that steer an agent into calling tools, executing code, or performing external actions that cause real-world harm or exceed the intended task scope.
• IOPC-T3.002 Tool and Context Poisoning: Adversarial content in tool definitions, descriptions, schemas, results, or protocol metadata (e.g. MCP servers) that manipulates an agent's tool selection, parameters, or subsequent reasoning.
• IOPC-T3.003 Cross-Agent Context Propagation: Compromised context (instructions, poisoned memory, or tool output) crossing an agent boundary — via delegation, shared memory, or agent-to-agent messaging — so that a threat introduced in one agent influences others and amplifies across a workflow.
• IOPC-T3.004 Human-Agent Trust Exploitation: The agent's own output is used to manipulate the human in the loop — misleading summaries at approval points, false confidence or impersonation of a trusted source — so a person authorises an unsafe action.

T4 Identity, Privilege & Runtime Boundary

Techniques that abuse an agent's identity, credentials or execution boundary — privilege reuse, sandbox escape and drift away from the authorised goal.

• IOPC-T4.001 Agent Identity & Privilege Abuse: Reuse, escalation or impersonation of an agent's identity and credentials — shared service accounts, over-scoped tokens, or credentials harvested from agent configuration — so actions execute with more authority than the task requires.
• IOPC-T4.002 Unexpected Code Execution: Model-controlled text becomes executable code outside its intended boundary — eval-style APIs fed untrusted content, generated code run without review, or escape from the interpreter sandbox onto the host.
• IOPC-T4.003 Agent Goal Drift: An agent moves away from the authorised objective, or outside its authorised scope, with no attacker instruction — widening its own scope over a long task, following self-issued sub-goals, reward hacking, or carrying on past the boundary of its environment — so that actions which each look reasonable no longer serve what was authorised.

T5 Disclosure & Output Integrity

Techniques whose effect is the disclosure of protected content, or the manipulation of model output that downstream systems trust.

• IOPC-T5.001 System Prompt & Configuration Disclosure: Extraction of the hidden instructions, tool definitions, activation triggers or other configuration that governs a model or agent.
• IOPC-T5.002 Sensitive Data Disclosure: Protected data — credentials, PII, documents or connector content held in context, memory or retrieval — is surfaced to an unauthorised recipient through model output or an agent tool call.
• IOPC-T5.003 Insecure Output Handling: Model output is consumed by a downstream component without validation — rendered as markup, executed as a command, or trusted as a control signal — turning generated text into an exploit primitive.

T6 Availability & Resource Abuse

Techniques that degrade availability or inflate the cost of an AI system through query volume, resource-intensive inputs or runaway agent loops.

• IOPC-T6.001 Unbounded Consumption & Cost Abuse: Query volume, resource-intensive inputs or runaway agent loops that exhaust capacity or inflate the operator's inference bill.
• IOPC-T6.002 Induced Refusal (Context Bomb): Text planted in content an AI system will read — a request for prohibited material, or a string written to look like one — so that the model's own safety guardrails make it refuse or stop, denying the AI function to whoever depends on it. Reported as "context bombs" and "reverse jailbreaks".

T7 Model Integrity & Confidentiality

Attacks on the model itself — extracting or inverting it, or evading its decisions with crafted inputs.

• IOPC-T7.001 Model Extraction & Inversion: Repeated, structured querying of a model to clone its functionality, recover training-data membership, or invert it into the underlying examples.
• IOPC-T7.002 Adversarial Evasion: Inputs perturbed just enough to change a model's decision — bypassing a classifier, filter or detector while remaining valid to a human observer.

T8 Reconnaissance, Staging & Access

What an adversary does before touching the target's behaviour: profiling the AI stack, building and rehearsing capabilities offline, and obtaining the access the later techniques need.

• IOPC-T8.001 AI System Reconnaissance: Passive and active collection about a target's AI stack — publications, technical blogs, victim-owned sites, code repositories and vulnerability analyses — used to select targets and tailor later techniques.
• IOPC-T8.002 Model & Agent Fingerprinting: Probing a live AI system to identify the model family, its ontology and guardrails, the shape of its outputs, its artefacts and its hallucination profile — the reconnaissance that makes targeted prompts reliable.
• IOPC-T8.003 Offline Attack Staging: Acquiring public models, datasets or agent configurations, building proxy models, obtaining or developing attack implementations, and verifying them offline before use against the target.
• IOPC-T8.004 AI System Access Acquisition: Obtaining the access later techniques need — inference API or full model access, service proxies, accounts, adversary-controlled infrastructure, deployed agents, or physical access to the data-collection environment.

T9 Persistence, Propagation & Evasion

Techniques that keep a compromise alive across sessions, spread it, or hide it from the operator's telemetry.

• IOPC-T9.001 Agent Configuration & Prompt Logic Tampering: Persistent modification of what governs the agent — system prompt assembly, tool registry, agent configuration files or deployment settings — so the compromise survives the session without a new injection.
• IOPC-T9.002 Detection & Attribution Evasion: Hiding AI-system compromise from the operator — masquerading as legitimate agents or users, stripping provenance, exploiting gaps in tool/agent logging, or flooding telemetry so real signals are lost.
• IOPC-T9.003 Self-Replicating Prompt (AI Worm): A payload that instructs the model to reproduce the payload itself into its outputs, memories or messages to other agents, so the compromise spreads without further adversary action.
• IOPC-T9.004 AI Analysis Evasion: Instructions or bait placed inside an artefact — malware, a package, a document, an advert, a web page — and addressed to the AI that will inspect it, so that an AI-based scanner, reviewer or analyst returns a clean verdict, skips the artefact or stops. Also reported as "AI evasion".

Framework mappings · Changelog and releases

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service