Security
Execution (AML.TA0005)
Threats in the execution tactic (AML.TA0005) of the MITRE ATLAS framework. Each entry lists the ATLAS technique, attack vector, affected components, current mitigations, residual risk, and recommendations.
The trust boundaries and data flows these threats cross are defined in the threat model index, which also holds the risk matrix, the recommendations summary, and the ATLAS technique mapping.
T-EXEC-001: Direct prompt injection
| Attribute | Value |
|---|---|
| ATLAS ID | AML.T0051.000 - LLM Prompt Injection: Direct |
| Description | Attacker sends crafted prompts to manipulate agent behavior |
| Attack vector | Channel messages containing adversarial instructions |
| Affected components | Agent LLM, all input surfaces |
| Current mitigations | Pattern detection, external content wrapping, and frontier-model robustness (2026 crowdsourced arena: 0.5% ASR on Claude Opus 4.5, 8.5% on Gemini 2.5 Pro, scored on execution plus concealment); treated as out-of-scope for vulnerability reports absent a boundary bypass (see SECURITY.md) |
| Residual risk | Model-tier dependent - low single-digit ASR against organic attacks on recommended frontier models, but adaptive attackers still exceed 80% against state-of-the-art defenses, and smaller/older models remain markedly easier to steer |
| Recommendations | Output validation and user confirmation for sensitive actions, layered on top of existing detection |
T-EXEC-002: Indirect prompt injection
| Attribute | Value |
|---|---|
| ATLAS ID | AML.T0051.001 - LLM Prompt Injection: Indirect |
| Description | Attacker embeds malicious instructions in fetched content |
| Attack vector | Malicious URLs, poisoned emails, compromised webhooks |
| Affected components | web_fetch, email ingestion, external data sources |
| Current mitigations | Content wrapping with random-boundary XML-style markers, homoglyph/special-token normalization, a security notice, and frontier-model robustness (see T-EXEC-001) |
| Residual risk | Model-tier dependent - recommended frontier models largely hold the wrapper boundary, but it remains soft guidance an adaptive attacker can erode; scope tool policy and sandboxing to the blast radius you accept |
| Recommendations | Separate execution contexts for wrapped content |
T-EXEC-003: Tool argument injection
| Attribute | Value |
|---|---|
| ATLAS ID | AML.T0051.000 - LLM Prompt Injection: Direct |
| Description | Attacker manipulates tool arguments through prompt injection |
| Attack vector | Crafted prompts that influence tool parameter values |
| Affected components | All tool invocations |
| Current mitigations | Exec approvals for dangerous commands |
| Residual risk | High - relies on user judgment |
| Recommendations | Argument validation, parameterized tool calls |
T-EXEC-004: Exec approval bypass
| Attribute | Value |
|---|---|
| ATLAS ID | AML.T0043 - Craft Adversarial Data |
| Description | Attacker crafts commands that bypass the approval allowlist |
| Attack vector | Command obfuscation, alias exploitation, path manipulation |
| Affected components | src/infra/exec-approvals*.ts, command allowlist |
| Current mitigations | Allowlist + ask mode, plus command normalization (dispatch-wrapper unwrapping, inline-eval detection, shell-chain analysis) |
| Residual risk | High - normalization narrows but does not eliminate obfuscation bypass; parity-only findings between exec paths are treated as hardening, not vulnerabilities (see SECURITY.md) |
| Recommendations | Continue expanding command-normalization coverage against new obfuscation techniques |
Was this useful?
