Overview
The essential difference between AI Agents and ordinary LLM applications lies inautonomous action capability—Agents possess tool calling, code execution, persistent memory, and multi-step planning capabilities, which means a successful injection is no longer just generating erroneous text, but can trigger real system operations. The attack surface has expanded from "model output" to the full stack of "tool execution chain, inter-Agent communication, persistent state".
In-depth reference
- Detailed attack scenarios, Payloads, and testing methods for each ASI number → references/agent-attack-scenarios.md
OWASP ASI01-ASI10 risk quick reference
| Number | Risk name | Core testing points |
|---|---|---|
| ASI01 | Goal hijacking | Whether direct/indirect injection can change the Agent's execution goal |
| ASI02 | Tool misuse | Unauthorized tool calls, parameter injection, description poisoning |
| ASI03 | Identity and privileges | Whether Agent privileges follow least privilege and credential isolation |
| ASI04 | Supply chain | Whether third-party Skill/Plugin/MCP Server is trustworthy |
| ASI05 | Code execution | Sandbox escape, arbitrary command injection |
| ASI06 | Memory poisoning | Whether persistent context/historical conversations can be contaminated |
| ASI07 | Multi-Agent communication | Inter-Agent message forgery, trust transfer chain vulnerabilities |
| ASI08 | Cascading failures | Whether a single Agent failure triggers a chain collapse |
| ASI09 | Human-machine trust | Whether users unconditionally trust and execute Agent output |
| ASI10 | Runaway Agent | Whether effective termination/rollback mechanisms exist |
Methodology overview
Phase 0: Agent architecture reconnaissance
- Identify the Agent type (monolithic ReAct / multi-Agent orchestration / code-execution type) and underlying framework (LangChain/AutoGen/CrewAI, etc.)
- Enumerate the Agent's available toolset, privilege boundaries, and communication topology (Hub-Spoke / Mesh / hierarchical)
- Confirm the location and coverage of human oversight nodes (Human-in-the-loop)
Phase 1: Goal hijacking testing (ASI01)
- Inject deviating instructions through direct dialogue and indirect data sources (files, web pages, API returns) to verify whether the Agent performs unintended operations
- Key judgment: whether the Agent's goal-locking mechanism can resist adversarial instructions in the context window
Phase 2: Tool misuse testing (ASI02)
- Construct malicious tool parameters (path traversal, command concatenation) to test whether the Agent blindly passes user-controllable input to tool calls
- Test tool description poisoning—whether malicious descriptions can change how the Agent uses the tool (see
mcp-security）
Phase 3: Supply chain and code execution (ASI04/ASI05)
- Review whether third-party Skill/Plugin/Rules files contain hidden instructions or backdoors
- Code-execution-type Agent: test sandbox isolation strength, attempt file system access, network egress, process escape
Phase 4: Memory poisoning and persistence (ASI06)
- Inject malicious context into the Agent's conversation history or long-term memory, and verify whether it is activated in subsequent sessions
- Test the memory write/read permission control—whether non-privileged interactions can modify system-level memory
Phase 5: Multi-Agent Communication Security (ASI07)
- Forge messages from other Agents in a multi-Agent system, and test whether the recipient verifies the message source
- Check the trust propagation chain: if Agent A trusts Agent B, can an attacker control A indirectly by attacking B
Phase 6: Monitoring and Kill Switch (ASI08/ASI10)
- Verify cascading failures: whether a single Agent's anomalous output is unconditionally trusted and amplified by downstream Agents
- Test the effectiveness of the termination mechanism (Kill Switch)—whether an Agent can be reliably interrupted when out of control
Practical Testing Checklist
1. [ ] Agent 类型与架构已识别？工具集、权限模型、通信拓扑已枚举？
2. [ ] 目标劫持：间接数据源注入能否改变 Agent 执行流？
3. [ ] 工具滥用：用户输入是否直接拼接到工具参数？
4. [ ] 权限边界：Agent 是否运行在最小权限下？凭据是否隔离？
5. [ ] 供应链：第三方组件是否经过安全审计？
6. [ ] 代码执行：沙箱是否能阻止文件/网络/进程访问？
7. [ ] 记忆系统：是否有写入权限控制？历史是否可被投毒？
8. [ ] 多 Agent：消息来源是否验证？信任传递链是否可被利用？
9. [ ] 级联故障：异常是否被隔离？是否存在全局 Kill Switch？