Each class collects related techniques that share a root cause or exploitation pattern. Classes are organized into six categories spanning agent governance, the software supply chain, runtime infrastructure, identity, sandboxing, and NemoClaw-specific exposure.
11 attack classes in this category.
Attacks targeting the system prompt assembly process where components combine into exploitable injections
Agent deployed with zero behavioral constraints — no SOUL.md, no system prompt, no governance
Exploiting ambiguous or incomplete constraint definitions to find unguarded actions
Exploiting delegation and capability transfer mechanisms to exceed authorized scope
Gradually displacing safety instructions from the active context through conversation manipulation
Different behavior under evaluation vs production — agent passes safety tests but behaves differently in deployment
External content achieving full override of agent behavioral constitution
Techniques to bypass agent harm avoidance constraints (4 sub-types)
False capability claims exceeding actual authorization level
Directly manipulating or overriding the agent's system-level instructions and behavioral boundaries
Malicious instructions injected into governance files at write-time
11 attack classes in this category.
MCP tool impersonation, squatting, and schema poisoning attacks
Exploiting scheduled task or heartbeat mechanisms to achieve persistent code execution
Injecting malicious entries into agent persistent memory to maintain control across sessions
Propagating malicious capabilities across an organization's agent fleet through shared skills and registries
Cross-session persistence via memory poisoning, state tampering, and cached context injection
Injecting malicious content into retrieval-augmented generation data sources
Using legitimate tool capabilities for unauthorized data transfer
Embedding malicious instructions in skill or plugin metadata and description fields
Skill plants payload in agent memory that survives skill uninstall — cross-session persistence
Unsigned installation scripts executed without integrity verification — curl|sh without checksum
Using invisible Unicode characters, homoglyphs, and encoding tricks to bypass filters
10 attack classes in this category.
Agent-to-Agent protocol endpoints publicly discoverable without access control
AI development tools (Jupyter, MLflow, Gradio, Streamlit) exposed without authentication
Injecting and executing arbitrary code through SQL injection, command injection, or code generation
Modifying gateway or proxy configurations to intercept, redirect, or manipulate agent traffic
Digest or hash verification bypass on empty or missing values — tampered artifacts pass silently
LLM inference endpoints exposed without authentication — allows arbitrary prompt execution
Attacking Model Context Protocol server configurations, tool registrations, and inter-server trust
Exploits differences between parser implementations to bypass security controls
Exploiting previously granted access or cached credentials to gain unauthorized capabilities
Time-of-check-time-of-use race between verification and execution — swap window for attackers
5 attack classes in this category.
Unintended exposure of credentials through environment variables, logs, or error messages
NemoClaw network services bound to public interfaces — gateway, k3s API, mDNS beacons
Inherited OpenClaw flaws that survive NemoClaw sandboxing — heartbeat persistence, pre-allowed APIs
Breaking out of agent sandbox restrictions to access the underlying file system or OS
Compromising upstream dependencies or infrastructure to affect downstream agent deployments
2 attack classes in this category.
Impersonating trusted agents or administrative roles to gain unauthorized access
Using stolen credentials detected via behavioral baseline mismatch — agent DNA forgery
1 attack class in this category.
General sandbox escape via privileged containers, LSM degradation, or process environment leakage
Looking for how these classes chain into full attacks? See the attack paths or the kill-chain grid.