When security testers stress-test an AI agent, what are the specific ways they try to trick or break it?
What are the eight attack vectors used to probe agents in OpenART?
This explores which eight attack vectors the OpenART framework uses to probe AI agents for weaknesses, and whether the corpus lists them.
This asks for the eight attack vectors OpenART uses to probe agents. The retrieved notes don't name OpenART or give its list of eight, and I'd rather say so than guess at a list. The closest material is a set of notes on how agent attacks are categorised, which may help you recognise the list when you find it.
The nearest thing to a taxonomy here has six categories, not eight. How do adversarial traps target different layers of AI agents? splits attacks by which layer of the agent they hit: content injection, semantic manipulation, cognitive state, behavioral control, systemic, and human-in-the-loop. Its main lesson is that a defence built for one layer doesn't carry over to the others. If OpenART's eight vectors are also organised by layer, expect the same problem, where each vector needs its own probe and its own fix.
Some notes describe specific attacks that a probing framework might include. Can prompts alone reshape multi-agent workflows without system access? describes FLOWSTEER, where a crafted prompt biases how a multi-agent workflow is planned before any inspection defences run, raising malicious success by up to 55 percent. Can agents be tricked into delegating work in circles? describes an attack that tricks agents into delegating work in circles, and it only exists when several agents are involved. Can attackers evade skill scanners by refining individual skills? shows attackers using scanner feedback to slip malicious skill chains past six scanners, with 96% average success. None of these is tied to OpenART in the notes, so I can't say they are among its eight.
If you're trying to compare OpenART's eight against other attack lists, Can adversary position unify fragmented multi-agent attack models? is a useful lens. It argues that where the attacker sits in the system is a missing axis. Attack sets that look different often differ mainly in adversary position, and comparing them is hard until that axis is made explicit.
To get the actual eight, the OpenART paper or a note that summarises it is the place to look. The corpus retrieval here didn't surface one, so either it isn't in the library or it's indexed under different wording.
Sources 5 notes
Research identifies six distinct trap categories—content injection, semantic manipulation, cognitive state, behavioral control, systemic, and human-in-the-loop—each targeting a specific operational layer. Defense against one category does not transfer to others, requiring separate mitigation strategies per layer.
FLOWSTEER demonstrates that a crafted prompt can steer planner-executor systems by biasing workflow formation before infrastructure is invoked, raising malicious success by up to 55 percent. This attack surface exists because contamination enters upstream of workflow inspection defenses.
Research identifies a novel MAS-specific attack that weaponizes cross-agent delegation to form task cycles, distinct from applying existing attacks like prompt injection to teams. The mechanism requires multiple agents and has no single-agent counterpart.
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
The SoK's A-I-R framework adds adversary position as a coordinate alongside interaction interface and system-level risk. Existing vault notes vary adversary position without naming it, making their results hard to compare without this axis explicit.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response