Executive Summary

The rapid adoption of Agentic Artificial Intelligence is fundamentally changing the cybersecurity landscape. Unlike traditional AI systems that primarily generate content or answer questions, Agentic AI systems can retrieve information, make decisions, interact with external tools, execute workflows, access enterprise data sources, and perform actions on behalf of users.

This evolution creates a new attack surface that extends beyond traditional endpoints, applications, cloud services, and identities.

While existing frameworks such as MITRE ATT&CK, MITRE ATLAS, and OWASP Agentic AI provide valuable guidance, many emerging attack techniques associated with autonomous and semi-autonomous AI systems do not fit neatly within current classifications.

To address this challenge, the Agentic AI Attack Matrix (A3M) introduces a structured framework for understanding, classifying, and defending against attacks targeting Agentic AI ecosystems. The full Whitepaper you can find here

Introduction

Cybersecurity frameworks have historically evolved in response to technological shifts.

The emergence of personal computing led to endpoint-focused security models. The rise of cloud computing introduced new identity, infrastructure, and access management challenges. Mobile devices created additional attack surfaces. More recently, SaaS platforms and API-driven architectures transformed how organizations approach security monitoring and governance.

Agentic AI represents the next major shift.

Unlike conventional software systems, Agentic AI solutions possess characteristics traditionally associated with human operators. They can interpret objectives, access multiple data sources, select tools, perform actions, communicate with other systems, and increasingly operate with limited human supervision.

As organizations integrate AI agents into business processes, cybersecurity leaders face an important challenge: how should attacks against autonomous systems be modeled, measured, and defended?

The answer is not straightforward because many agent-specific attack techniques have no direct equivalent within existing frameworks.

The Security Challenge of Agentic AI

Traditional cyberattacks focus on compromising technology.

Attackers exploit vulnerabilities, steal credentials, deploy malware, establish persistence, move laterally, collect information, and ultimately achieve their objectives.

Agentic AI introduces an additional attack dimension.

Instead of targeting infrastructure directly, attackers increasingly target the agent’s decision-making process.

The objective may be to manipulate:

• Context
• Memory
• Tool selection
• Workflow execution
• Authorization decisions
• Data retrieval
• Human approval processes

This distinction is significant.

A manipulated AI agent can perform unauthorized actions while operating entirely within legitimate permissions.

The result is a new category of attacks where compromise is replaced by influence and manipulation.

Why Existing Frameworks Are Not Sufficient

MITRE ATT&CK remains the industry standard for describing adversary behavior.

MITRE ATLAS extends this approach into machine learning environments.

OWASP Agentic AI provides guidance for securing emerging AI systems.

All three frameworks remain highly relevant.

However, during the analysis of modern Agentic AI attack scenarios, a recurring observation emerged: numerous techniques could only be partially mapped or could not be mapped at all.

Examples include:

• Agent surface mapping
• Tool selection steering
• Cross-context instruction smuggling
• Memory poisoning
• Prompt-template backdoors
• Rogue autonomous workflows
• Inter-agent message forgery
• Browser automation abuse
• Vector database persistence
• Agent-to-agent command and control

These attack paths are increasingly relevant in real-world Agentic AI deployments.

Yet many are not comprehensively represented within existing frameworks.

This observation served as the primary motivation for the development of A3M.

The Concept Behind A3M

The Agentic AI Attack Matrix (A3M) was designed specifically for environments where AI systems can plan, retrieve information, interact with tools, execute actions, and influence business processes.

Rather than focusing exclusively on infrastructure compromise, A3M models attacks against the complete lifecycle of an Agentic AI ecosystem.

The framework introduces attack phases specifically adapted to modern AI architectures.

These phases include:

• Reconnaissance
• Resource Development
• Initial Access
• AI Model Access
• Execution
• Persistence
• Privilege Escalation
• Stealth
• Defense Impairment
• Credential Access
• Discovery
• Lateral Movement
• Collection
• AI Attack Staging
• Command and Control
• Exfiltration
• Impact

Together, these categories provide a comprehensive view of how adversaries may target Agentic AI environments.

Key Innovations of the A3M Framework

Agent-Native Security Perspective

Traditional frameworks focus primarily on systems and infrastructure.

A3M treats the AI agent itself as a primary attack target.

This includes:

• Reasoning processes
• Context handling
• Tool selection
• Decision logic
• Memory management
• Workflow orchestration

These elements become first-class attack surfaces.

Action-Centric Attack Modeling

Many Agentic AI attacks do not involve malware.

Instead, attackers abuse legitimate capabilities.

Examples include:

• Triggering unauthorized workflows
• Manipulating tool execution
• Influencing browser automation
• Abusing delegated permissions
• Redirecting workflow outputs

The attack occurs through actions rather than exploits.

Identity-Centric Threat Modeling

Identity already plays a central role in modern cybersecurity.

Agentic AI amplifies this importance.

Many agents operate through:

• OAuth permissions
• Service principals
• API tokens
• Delegated authorizations
• Non-human identities

A3M therefore places strong emphasis on identity abuse, permission escalation, and delegated access manipulation.

Memory and Context Security

One of the most distinctive aspects of Agentic AI is persistent context.

Knowledge repositories, vector databases, embeddings, prompt templates, and long-term memory stores create entirely new opportunities for attackers.

A3M explicitly addresses threats such as:

• Memory poisoning
• RAG poisoning
• Retrieval manipulation
• Context corruption
• Prompt-template persistence

These attack vectors have become increasingly relevant as enterprises adopt Retrieval-Augmented Generation architectures.

Understanding the New Attack Surface

One of the most important contributions of A3M is the recognition that Agentic AI creates attack surfaces that extend beyond traditional infrastructure.

The framework identifies several major categories:

Instruction Layer

Attacks targeting prompts, retrieved content, context windows, and decision-making logic.

Tool Layer

Attacks targeting APIs, plugins, browser automation, workflow engines, and connected applications.

Identity Layer

Attacks targeting delegated permissions, OAuth grants, service principals, and non-human identities.

Memory Layer

Attacks targeting vector databases, knowledge repositories, embeddings, and persistent memory stores.

Human-Agent Trust Layer

Attacks exploiting the relationship between humans and autonomous systems, including deepfakes, approval manipulation, and social engineering.

Together, these layers represent a fundamentally new security model.

Practical Applications for CISOs

The primary value of A3M is operational.

Security leaders can use the framework to assess whether their existing controls adequately address Agentic AI threats.

Key questions include:

Can we detect prompt injection attempts?

Can we identify poisoned knowledge repositories?

Can we monitor tool execution by AI agents?

Can we detect rogue automations?

Can we identify suspicious inter-agent communications?

Can we detect unauthorized OAuth grants?

Can we identify manipulation of long-term memory stores?

Can we monitor agent-initiated data transfers?

For many organizations, the answer to several of these questions remains uncertain.

A3M helps identify these gaps.

Strategic Implications

The emergence of Agentic AI represents more than another technology trend.

It introduces a new operational environment where autonomous systems participate directly in business processes.

As adoption accelerates, organizations will require security frameworks capable of describing attacks against reasoning systems, memory systems, workflow systems, and autonomous decision-making processes.

Traditional security models remain necessary.

However, they are no longer sufficient on their own.

The cybersecurity community must evolve its frameworks to reflect the realities of autonomous systems.