AI Agent Threat Matrixv1.0

Gap Analysis

How the AI Agent Threat Matrix relates to existing frameworks. This analysis shows which techniques are covered, partially covered, or not addressed by OWASP Top 10 for LLM and MITRE ATLAS.

57
Total Techniques
30
In OWASP LLM
19
In MITRE ATLAS
19
Not in Either

19 of 57 techniques (33%) in the AI Agent Threat Matrix are not covered by either OWASP Top 10 for LLM or MITRE ATLAS. These are agent-layer threats that existing frameworks were not designed to address.

Techniques Not Covered by OWASP or ATLAS (19)

IDTechniqueTacticClass
T-4006Safety Instruction Displacementprivilege-escalationSOUL-DRIFT
T-5001SSRF via Toollateral-movementSKILL-EXFIL
T-5002A2A Agent Pivotinglateral-movementAGENT-IMPERSONATE
T-5004Credential Reuselateral-movementRETROACTIVE-PRIV
T-5005Database Pivotinglateral-movementMCP-EXPLOIT
T-5006Internal API Discoverylateral-movementMCP-EXPLOIT
T-6003Configuration ModificationpersistenceGATEWAY-EXPLOIT
T-6005Scheduled Task InjectionpersistenceHEARTBEAT-RCE
T-6006Tool Registration PersistencepersistenceSKILL-FRONTMATTER
T-7002Database ExtractioncollectionCODE-INJECTION
T-7003API Data HarvestingcollectionSKILL-EXFIL
T-8001Email ExfiltrationexfiltrationSKILL-EXFIL
T-8002HTTP CallbackexfiltrationSKILL-EXFIL
T-8003DNS ExfiltrationexfiltrationSKILL-EXFIL
T-8004Tool Chain ExfiltrationexfiltrationSKILL-EXFIL
T-8006Webhook ExfiltrationexfiltrationSKILL-EXFIL
T-9002Service DisruptionimpactNEMO-SUPPLY-CHAIN
T-9004Multi-Agent Consensus ManipulationimpactORG-SKILL-SPREAD
T-9005Reputation PoisoningimpactORG-SKILL-SPREAD

Framework Scope

OWASP Top 10 for LLM

Covers: prompt injection, output handling, supply chain, info disclosure, excessive agency, overreliance

Does not cover: agent protocols (MCP, A2A), governance file manipulation, memory persistence, cross-agent lateral movement, sandbox escape, heartbeat attacks, identity attacks

MITRE ATLAS

Covers: reconnaissance, initial access (adversarial ML), credential access, model extraction, data poisoning

Does not cover: agent infrastructure, skill supply chain, MCP/A2A exploitation, governance files, memory poisoning, heartbeat persistence, webhook exfiltration

Agent Threat Matrix

Covers: the agent layer between the model and the user: governance, protocols, memory, identity, skills, and infrastructure

Does not cover: model-level attacks (adversarial examples, training poisoning), enterprise network attacks

← Back to Matrix