Pieces by control point

Failure to comply with industry standards/best practices may lead to insufficient, inefficient or ineffective mitigations against adversarial threats. Tainted components in an agentic AI system can have downstream impact along the workflow.

As part of a risk assessment and threat modelling, perform taint tracing across workflows throughout the agentic AI system. Taint tracing is especially important for agentic AI systems of higher autonomy levels (i.e. levels 2 and 3). Users are not limited to only one method of threat modelling and may adopt other relevant methods that address their needs.

• Trusted Architecture for the Future

Introduction of bugs, vulnerabilities, unwanted or malicious content, poisoned models or rogue agents from third-party systems can lead to downstream impact.

If procuring any AI System or component from a vendor, check/ensure suppliers adhere to the supply chain policies and security standards of your organisation. This could be done by establishing a Service Level Agreement (SLA) with the vendor. Incorporate continuous supply chain monitoring practices.

• Trusted Architecture for the Future

Vulnerabilities in third-party libraries and dependencies used by the agent can cause the system to be exploited.

Integrate software composition analysis (SCA) tools or use package managers. Regularly scan dependencies and update libraries with known vulnerabilities. Validate package hashes if available.

No piece yet.

Collaborative model poisoning corrupting models across multiple agents. Specific to multi-agent training.

Source data from trusted repositories. Apply data sanitisation and filtering, such as through deduplication and classifier-based quality checks.

No piece yet.

Poorly aligned LLMs may pursue objectives which violate security principles.

Review the LLM's model card for potential alignment issues before using the LLM for more complex tasks.

No piece yet.

Poisoned models may introduce hidden model backdoors in the system which may be used by an adversary to perform unwanted actions.

Do not use LLMs from unknown or untrusted sources, even if it is available on public platforms. Scan models to detect for potential backdoors or RCE scripts.

• Our AI Apps Do More Than We Asked

Poorly implemented tools may not correctly verify user identity or permissions when executing privileged actions, allowing unauthorised actions.

Do not use tools which do not implement robust authentication protocols.

No piece yet.

Rogue tools that mimic legitimate ones can contain hidden malicious code that executes when loaded.

Do not use tools from unknown or untrusted sources, even if it is available on public platforms.

No piece yet.

Direct prompt injection from untrusted MCP servers, causing unwanted instructions to be carried out.

Exercise caution when using community-run MCP servers. When possible, use official repositories or well-known sources for MCP servers.

No piece yet.

Indirect prompt injection attacks via malicious website content cause unwanted actions to be executed.

Use structured retrieval APIs for searching the web rather than through web scraping.

No piece yet.

Returning unreliable information from websites, causing downstream integrity impact on workflows.

Prioritise results from verified, high-quality domains (e.g. .gov, .edu, well-known publishers). Ensure adequate cross-source validation for some of the claims made.

No piece yet.

Supply chain attacks which impact downstream workflows.

Where possible, enforce zero-trust input handling and validate all data flows. This may also include scanning firmware and verifying hardware components used.

No piece yet.

Indirect prompt injection attacks via malicious data or files cause unwanted actions to be executed.

Validate new data used to supplement RAG databases or training data.

No piece yet.

LLMs with weak performance in instruction following might produce unexpected output, leading to unwanted behaviour.

Prioritise LLMs with stronger performance in instruction following or related capabilities to the task. Benchmarks performance may be used to gauge suitability.

No piece yet.

AI agents execute disallowed tasks for malicious purposes.

Train models to recognise and refuse disallowed tasks.

• Model Selection Consideration for Autonomous Penetration Testing
• One Hour in English, One Second in Khmer: How Language Became an AI Jailbreak
• From Bare Loops to Export Controls: Where AI Pentesting Currently Is

Introduction of bugs, vulnerabilities through insecure coding practices or design.

Adopt Security by Design. Apply software development lifecycle (SDLC) process. Use software development tools to check for insecure coding practices. Implement zero trust principles in system design.

No piece yet.

Lack of a robust system prompt design can lead to an increased susceptibility to prompt injection attacks and risk of executing unwanted tasks.

Implement robust system prompt design.

• Our AI Apps Do More Than We Asked
• One Hour in English, One Second in Khmer: How Language Became an AI Jailbreak

Insecure coding practices leading to vulnerabilities in the system.

Adopt secure coding practices. E.g. secure key management via using dependency injection, or secrets management service. Do not hardcode secrets.

No piece yet.

Loss of data integrity such as through unauthorised changes to data, model, agents or system. Lack of proper documentation of resources may result in the wrong or outdated tool being used by model, causing unwanted behaviour or output.

Establishing a data lineage and software license management process. This includes documenting the data, codes, test cases, models and agents, including any changes made and by whom. Model cards, Agent cards, Data cards, and Software Bill of Materials (SBOMs) may be used. e.g. provide comprehensive descriptions of each tool, including its intended use, required inputs, and potential outputs.

• Trusted Architecture for the Future

Agents may inadvertently store sensitive user or organisational data from prior interactions, resulting in data privacy risks.

Encrypt data at rest and restrict access via fine-grained access controls and audit logs.

No piece yet.

Manipulation of memory systems and context, causing flawed decision making and unauthorised operations.

Ensure adequate AI-generated memory snapshots for forensic analysis and rollback if anomalies are detected.

No piece yet.

Execution of insecure code by the model or agents may cause unwanted actions to be performed.

Ensure proper versioning control of code to allow rollbacks to a more secure and stable version.

No piece yet.

Loss of data through overwritten or deleted files.

Keep a separate backup of original files. Ensure backup copy of database is protected from changes until a specified duration has elapsed, based on organisation's backup policy. Ensure proper versioning of files or database.

No piece yet.

Unauthorised changes in a model's context.

Have robust authentication mechanisms for memory access.

No piece yet.

Unauthorised tool usage.

Enforce strict tool access verification where possible.

No piece yet.

Agents may gain unauthorised access to restricted resources by exploiting misconfigured or overly permissive roles.

Treat agents as non-human identities. Maintain trusted registry of agent identities and authenticate agents using strong, verifiable credentials. Require unique identifiers for agents using Decentralised Identifiers (DIDs). Apply strict access controls and validate agent roles for requests. Ensure fine-grained, scoped tokens or credentials where possible. Use time-bound (just-in-time) or one-time-use credentials where possible.

No piece yet.

Exploitation of vulnerabilities in permission management.

Implement granular permission controls, and dynamic access validation. Separate policies for agents and human users.

No piece yet.

Exploitation of the orchestration layer to perform malicious activities using existing agents.

Implement robust authentication mechanisms for orchestration layer access.

No piece yet.

Chained authorisation in multi-agent systems can cause downstream agents to execute malicious tasks without checking for permissions.

Validate permissions on every request to each agent in the workflow.

No piece yet.

Leaking personally identifiable or sensitive data.

Agents accessing sensitive tools or data should operate under the principle of least privilege in time. Use short-lived, rotating credentials (ephemeral credentials) that expire immediately after agent use. Implement a whitelist approach for interfaces that agents are allowed to use.

No piece yet.

Man-in-the-middle attacks arising from insecure communications.

Ensure all cross-agent authentication and message validation and encryption where necessary.

No piece yet.

Discovery of, and connection to unvetted external domains, APIs, or peer agents. This may lead to exfiltration of sensitive data.

Implement a whitelist approach for outward network access, including API requests. Route agent-initiated network traffic through protective DNS services to monitor agent domain lookups and block malicious connections.

No piece yet.

Executing vulnerable or malicious code.

Implement a whitelist approach for inward network access.

No piece yet.

Abuse of agent-accessible tools to execute unintended actions.

Establish clear operational boundaries to prevent misuse of tools. Set limits on what agents can modify through appropriate guardrails.

• Our AI Apps Do More Than We Asked
• Model Selection Consideration for Autonomous Penetration Testing

Agents gain unauthorised and excessive privileges to perform unwanted actions outside the given scope.

Implement a policy-evaluation engine that assesses authorisation requests dynamically at runtime. Prevent cross-agent privilege delegation unless explicitly authorised through predefined workflows. Do not grant admin privileges to agents, unless strictly necessary for completion of tasks.

No piece yet.

Compromised agents act outside their operational boundaries and perform unintended actions.

Restrict AI agent autonomy using policy constraints. Scope agent privileges dynamically: strict access of tools and API only to what is necessary to run the tasks. Do not allow agents to modify privileges.

• Model Selection Consideration for Autonomous Penetration Testing
• From Bare Loops to Export Controls: Where AI Pentesting Currently Is

Assigning tasks incorrectly to other agents.

Apply guardrails to limit the scope of tasks that can be assigned to specialised agents.

• From Bare Loops to Export Controls: Where AI Pentesting Currently Is

Excessive agent privileges to access unintended resources on the computer, causing potential security impact.

Limit computer usage to accessing only required resources on the computer.

No piece yet.

Exfiltration of sensitive data through insecure communications between agents.

Ensure that sensitive data is not passed and leaked between agents by using appropriate guardrails.

No piece yet.

Misinterpreting inter-agent messages due to poor formatting or weak protocols.

Constrain agent communication with structured outputs and interactions.

No piece yet.

Impersonating or accessing peer agents or services via shared roles or credentials.

Isolate roles and credentials of each agent.

No piece yet.

Lack of proper whitelist controls may lead to the execution of vulnerable or malicious code.

Create a whitelist of commands that agents are allowed to run autonomously. Deny execution of all other commands that are not whitelisted.

• Model Selection Consideration for Autonomous Penetration Testing

Misconfiguring system resources, compromising system integrity and availability.

Only grant agents privileges to modify system resources if strictly necessary for completion of tasks. Set minimum and maximum limits to what can be modified.

No piece yet.

Exposure of personally identifiable information in files.

Whitelist only files which are required for the task. Do not grant access to files known to host private or sensitive information without careful consideration of the risks. Consider using data anonymisation techniques instead.

No piece yet.

Agents having unauthorised access to restricted resources by exploiting misconfigured or overly permissive roles.

Apply principle of least privilege when configuring all agent and delegation roles.

No piece yet.

Agents having privileges/rights to execute untrusted or malicious code.

Scope execution privileges strictly only to what is necessary, ensuring that privileges are customised to each agent within a system. Do not grand admin or sudo privilege by default. Block all inward and outward network access by default.

No piece yet.

Agents having privileges/rights to overwrite or delete database tables or files.

No write access to tables in the database unless strictly required, with consideration of risks of data loss.

No piece yet.

Exposure of personally identifiable or sensitive data from databases or files to users.

Restrict access to personally identifiable data or sensitive data unless strictly required, with consideration of risks of data exposure. Consider data anonymisation techniques instead.

No piece yet.

Escalation of the agent's own privileges may allow it to be used to access restricted resources.

Scope system privileges strictly only to what is necessary. Do not grant admin privileges to agents. Do not allow agents to modify privileges.

No piece yet.

Rogue tools that mimic legitimate ones can contain hidden malicious code that executes when loaded and gain access to other assets within the environment or network.

Test third-party tools in hardened sandboxes with syscall/network egress restrictions before using them in production environments.

No piece yet.

Prompt injection attacks and indirect data manipulation through access to other assets within the environment or network.

Decouple data processing flow from control flow through runtime security architecture. Update segmentation policies regularly as agent roles, system architecture and organisational risk posture evolves.

• Our AI Apps Do More Than We Asked

Prompt injection attacks to perform credential and/or data exfiltration through access to other assets within the environment or network.

Ensure virtual isolation for agents carrying out transactions. Do not share credentials with the agent directly, require the agent to use a separate service for authentication and transactions.

No piece yet.

Execution of insecure or malicious scripts that affects the other components of the environment or network.

Run code in virtually isolated compute environments (e.g. Docker, Podman containers). Sandbox the execution of AI generated scripts. Monitor the execution.

• Model Selection Consideration for Autonomous Penetration Testing

Incomplete or unclear instructions may compel models to attempt to fill in missing constraints, resulting in incorrect or unwanted actions being executed.

Ask the agent to summarise its understanding and request clarification before proceeding.

No piece yet.

Purpose drift, or unintended deviation from the user's instructions to perform other tasks or pursuit other priorities, resulting in malicious or deceptive behaviour.

Prompt the agent to self-reflect on the adherence of the plan to the user's instructions.

No piece yet.

Incorrect assignment of tasks to other agents.

Prompt the agent to self-reflect and assess the suitability of tasks delegated to agents.

No piece yet.

Unintended pursuit or prioritisation of other goals, resulting in malicious or deceptive behaviour.

Understand the reasoning and self-reflection done by the agent through visualisation of its thought process. Log the output in the console for the user to evaluate and verify.

No piece yet.

Agents may mistakenly store glitches and hallucinations into memory, resulting in compounding errors when incorrect information is retrieved for decisions or actions.

Schedule periodic memory reconciliation, where human reviewers or external tools can flag anomalies.

• From Bare Loops to Export Controls: Where AI Pentesting Currently Is

Generating non-factual or hallucinated content which can propagate downstream and cause compounding errors that can affect the integrity of the output.

Implement features to verify the generated answer against the original content. Conduct testing to measure hallucination and factuality rates for outputs. Implement UI/UX cues to highlight the risk of hallucination to the user. Implement Retrieval Augmented Generation (RAG) to keep the model grounded and contextualised.

No piece yet.

(Distributed) denial of service on agents.

Apply rate limits on the number of concurrent queries to agents.

No piece yet.

Degradation of computational or service capability of the system.

Deploy resource management controls, implement adaptive scaling mechanisms and monitor system load to detect and mitigate overload attempts in real-time. Implement rate limits on high-frequency task requests per agent session.

• Our AI Apps Do More Than We Asked

Slow or inefficient responses from being stuck in a reasoning loop.

Enforce time or token limits for reasoning. Adjust short-term and long-term memory options.

• From Bare Loops to Export Controls: Where AI Pentesting Currently Is

Exploitation of interactions between agents to cause resource exhaustion across the system.

Enforce time or token limits for agent reasoning. Set a limit on the number of agent interactions per task, based on the requirements of the workflow.

No piece yet.

Compromising database availability through excessive queries.

Limit the number of concurrent queries to the database from agents. Analyse past database queries to identify repeated or inefficient queries.

No piece yet.

Overconsumption of compute resources.

Monitoring of code runtime and memory consumption.

No piece yet.

Agents may contain underlying problems which can cause unexpected behaviour or logical errors.

Behavioural testing of agents with benchmark datasets to determine performance metrics, and executing simulations in regulated environments to analyse agents' behaviour. Automated evaluators can be used, but human evaluators should verify the results of testing.

• From Bare Loops to Export Controls: Where AI Pentesting Currently Is
• Model Selection Consideration for Autonomous Penetration Testing

AI may engage in specification gaming, where it maximises the goal by exploiting loopholes, without achieving the intended task.

Conduct adversarial evaluation to discover specification gaming behaviour. Iterate on system prompt design, have more robust reward design, and add constraints.

No piece yet.

Incomplete or unclear instructions may compel models to attempt to fill in missing constraints, resulting in incorrect or unwanted actions being executed.

Test the efficacy of system prompts with scenario-based evaluations for task performing and problem solving. Benchmarks may be used.

• One Hour in English, One Second in Khmer: How Language Became an AI Jailbreak

Inconsistencies between AI outputs and expected reasoning pathways.

Utilise deception detection strategies such as behavioural consistency analysis, truthfulness verification models, and adversarial red teaming.

No piece yet.

Compromised agents may impact downstream decision making.

Have regular AI red teaming of agents to check for potential vulnerabilities or compromise. Integrate AI red teaming with existing security testing processes (e.g. penetration testing, vulnerability disclosure process) and include clear scoping, reporting and remediation workflows.

• One Hour in English, One Second in Khmer: How Language Became an AI Jailbreak
• Our AI Apps Do More Than We Asked

Adversarial threats attempting to compromise orchestration or planning agents to use other agents maliciously.

Conduct rigorous adversarial testing on centralised orchestration and planning agents.

No piece yet.

Insecure configurations allowing unauthorised access to tools, models and data.

Implement robust security measures to protect MCP servers, such as context-level access controls. Have formal interface versioning, and track where context is coming from. Stay informed about emerging MCP vulnerabilities and security best practices.

No piece yet.

Execution of malicious scripts through the MCP server, leading to system compromise.

Ensure code verification before MCP functions are executed on servers. Sandbox the execution.

No piece yet.

Introduction of malicious agent(s) into the ecosystem, which rapidly corrupts other agents in the system.

Verify that MCP agents are from trusted sources before introducing them into the system. Sanitise tool inputs. Check that an MCP server has not silently redefined their tools (MCP rug pull). To secure interactions between MCP Clients and Servers, use strong validation techniques such as allowlists, hardcoded connections, or mutual TLS (mTLS) for known static relationships. In dynamic environments where clients change, use strong authentication protocols (such as OAuth 2.1 or OIDC) to dynamically verify client identity and allow connections rather than depending exclusively on static network trust.

No piece yet.

Manipulation of communication channels between agents to disrupt workflows or influence decisions.

Monitor and log inter-agent interactions to identify anomalies. Enforce inter-agent authentication; deploy cryptographic message authentication if needed. Enforce multi-agent task segmentation to prevent attackers from escalating privileges across interconnected agents. Ensure multi-agent consensus verification for critical decision-making processes.

No piece yet.

Sensitive data disclosure via eavesdropping between agent communications.

Ensure that sensitive data is not passed on and leaked among agents through appropriate guardrails. (e.g., deploying DNSSEC or protective DNS) For highly sensitive data, consider applying end-to-end encryption.

No piece yet.

Direct prompt injection attacks to the prompt interface from adversarial inputs to the model.

Implement input guardrails to detect direct prompt injection or adversarial attacks. Implement input sanitisation measures or limit inputs to conventional ASCII characters only.

• One Hour in English, One Second in Khmer: How Language Became an AI Jailbreak

Tools that lack input validation can be exploited through prompt injection attacks.

Enforce strict schema validation (e.g. JSON Schema, protobuf, Pedantic, OpenAI Structured Outputs) and reject non-conforming inputs into the system. Escape or encode user inputs when embedding into tool prompts or commands.

No piece yet.

Incorrect or manipulated instructions may invoke the wrong tool/service and impact downstream workflows.

Validate agent instructions before passing on to the model, especially for critical decision workflows.

No piece yet.

Indirect prompt injection attacks via malicious website content or files.

Implement input guardrails to detect indirect prompt injection. Implement escape filtering before including web content or relevant files into prompts. Scan external files for undesired input or instruction before passing on to memory or models.

• Our AI Apps Do More Than We Asked

Generation of unrelated topic outputs, which may affect integrity of model performance or output.

Implement input multimodal (or text) guardrails to detect if the instruction is within the expected topic domain. Refuse to answer otherwise.

• Our AI Apps Do More Than We Asked
• One Hour in English, One Second in Khmer: How Language Became an AI Jailbreak

Passing on prompt injection attacks across agents throughout the system(s).

Sanitise messages before agents process them - strip or escape unexpected instruction-like content that may have been injected (e.g. remove "ignore", "system", or "from now on").

No piece yet.

Executing vulnerable or malicious code.

Sanitise all inputs for malicious code.

No piece yet.

Exposure of personally identifiable information from retrieved content.

Implement input guardrails to detect personally identifiable information in the content.

No piece yet.

Vulnerabilities in outputs across the agentic workflow may be exploited for malicious purposes downstream, potentially triggering cascading effects that compromise interconnected systems and dependencies.

Insert validation checkpoints between stages that verify expected output and reject invalid output.

No piece yet.

Disclosure of sensitive or personally identifiable information through unsanitised outputs.

Implement output guardrails to detect personally identifiable information in the LLM's outputs before it reaches the user, or contained within communications before it is sent out. Validate all links and attachments prior to sending them to users.

No piece yet.

Sending malicious or undesired content to recipients.

Implement output safety text guardrails to detect if malicious or undesirable content is being generated, or contained within communications before it is sent out. Validate all links and attachments prior to sending them to users.

No piece yet.

Allowing unauthorised actions (e.g. transactions).

Apply fraud detection models or heuristics to the agent's own decisions.

No piece yet.

Execution of insecure or malicious code that are generated by the LLM.

Use code linters to screen for bad practices, anti-patterns, unused variables, or poor syntax. Review all code and/or perform static code analysis to detect potential security vulnerabilities before execution. Conduct CVE scanning and block execution of any High or Critical CVEs.

No piece yet.

Output that will be rendered in a web UI may be vulnerable to XSS.

Sanitise output with libraries for rendering in a web UI. Test against bypass.

No piece yet.

Generation of non-factual content which can propagate downstream and may cause unintended output or behaviour that impacts integrity.

Have robust output validation mechanisms, or multi-source validation.

No piece yet.

Model drift over time might cause unexpected output or behaviour.

Continuously monitor and log outputs, triggering alerts when behaviour drifts from tested baselines.

No piece yet.

Adversarial prompt attacks against the system.

Log queries to detect for possible attacks or suspicious activity. Consider the current privacy regulations/guidelines when logging inputs.

No piece yet.

Unauthorised users may exploit tools that do not verify user identity or permissions when executing privileged actions.

Conduct periodic audits to validate that tool actions match the appropriate user permissions.

No piece yet.

Malicious actors exploit attack surfaces that arise from using tools that demand broader permissions than necessary.

Conduct periodic least-privilege reviews and automated permission drift detection.

No piece yet.

Unauthorised tool usage.

Monitor tool access and usage patterns. Implement execution logs that track AI tool calls for anomaly detection and post-incident review.

• Model Selection Consideration for Autonomous Penetration Testing

Exploitation of authentication mechanisms to impersonate agents or human users.

Deploy continuous monitoring to detect fraud or impersonation attempts. Use behavioural profiling, possibly involving a second model, to detect deviations in AI agent activity that may indicate identity spoofing. Automate alerts to developers when suspicious activities are detected.

No piece yet.

Unauthorised or malicious use of elevated privileged operations.

Monitor role changes, and audit elevated privilege operations.

No piece yet.

In agentic workflows, early mistakes or vulnerabilities can be propagated and magnified downstream.

Apply circuit-breakers that freeze propagation when anomalous behaviour is detected, and implement human authorisation for release. Taint tracing may be used to identify key locations in the workflow to apply circuit-breakers.

No piece yet.

More complex agentic architectures may make it difficult to fully reconstruct decision processes across multiple agents, for the purpose of incident response, or triage.

Implement end-to-end distributed tracing with unique request IDs or Decentralised IDs (DIDs) across all agents and tool calls. Implement immutable, tamper-evident audit logs that capture prompts, responses, and tool invocations.

No piece yet.

Lack of monitoring results in delayed detection of agent failures and downstream risks.

Implement real-time monitoring of agent status, actions, and performance metrics, paired with automated alerting mechanisms that notify operators of anomalies, errors, or inactivity.

No piece yet.

Lack of traceability inhibit proper audit of decision-making paths in the event of failures.

Record comprehensive logs of agent actions, inputs, outputs, and inter-agent communications, tagged with unique trace identifiers to reconstruct full decision-making paths. If greater integrity is needed, AI-generated logs can be cryptographically signed and immutable.

• Trusted Architecture for the Future

Agents execute malicious or unauthorised actions by exploiting reasoning.

Log all task assignments by the agent to other agents. Log all requests leading up to the execution of task.

No piece yet.

Allowing unauthorised transactions.

Log all requests leading up to the transaction.

No piece yet.

Exposure of personally identifiable or sensitive data from databases or files.

Log all database queries in production.

No piece yet.

Misconfiguring system resources, compromising system integrity and availability.

Ensure logging of system health metrics and automated alerts to the developer team if any metrics are abnormal.

No piece yet.

Overwhelming the system with inefficient or repeated requests.

Log all queries from the agent to external systems, and check for repeated requests.

No piece yet.

Deviation from the user's instructions when performing high-risk actions. Allowing of unauthorised actions.

Ensure human approval for any high-risk cases or irreversible actions. Define boundaries for agent behaviour and the roles of humans along the agentic workflow.

• Trusted Architecture for the Future
• From Bare Loops to Export Controls: Where AI Pentesting Currently Is

Generation of non-factual content or incorrect instructions, which can propagate downstream and have an impact on decision making.

Ensure secondary validation of AI-generated knowledge before it is used in critical decision-making processes. Raise awareness on the secure use of agentic AI through security training and awareness programmes.

No piece yet.

Allowing unauthorised actions (e.g., transactions).

Define boundaries for agent behaviour and the roles of humans along the agentic workflow. Ensure human validation for high-risk transactions. Raise awareness on the secure use of agentic AI through security training and awareness programmes.

No piece yet.

Loss of data integrity from overwriting or deleting database tables or files.

Define boundaries for agent behaviour and the roles of humans along the agentic workflow. Ensure user confirmation for any changes to the database, table, or files. Raise awareness on the secure use of agentic AI through security training and awareness programmes.

No piece yet.

Execution of insecure or malicious code may cause the system to become compromised.

Define boundaries for agent behaviour and the roles of humans along the agentic workflow. Implement execution control policies that flag AI-generated code with elevated privileges for manual review. Raise awareness on the secure use of agentic AI through security training and awareness programmes.

No piece yet.

Exploitation of human cognitive limits for systems that requires high human oversight.

Apply hierarchical AI-human collaboration where low-risk decisions are automated, and human intervention is required for high-risk decisions. Raise awareness on the secure use of agentic AI through security training and awareness programmes.

• Trusted Architecture for the Future

Malicious code execution and data disclosure by leveraging undiscovered vulnerabilities existing within system.

Provide channels for users to clarify communications or give feedback on security and usage.

No piece yet.