AI Agent Threat Matrixv1.0

Attack Paths

Complete kill chain traversals demonstrated in DVAA (Damn Vulnerable AI Agent). Each path shows how techniques chain together across multiple tactics to achieve a specific attacker objective.

Path A

API Agent Full Compromise

LegacyBot to ToolBot: recon, inject, harvest creds, pivot, enumerate files, exfiltrate

Reconnaissance
T-1001
Endpoint Enumeration
→
Initial Access
T-2001
Direct Prompt Injection
→
Credential Harvest
T-3001
System Prompt Credential Extraction
→
Lateral Movement
T-5004
Credential Reuse
→
Collection
T-7001
File System Enumeration
→
Exfiltration
T-8002
HTTP Callback
Path B

Memory Persistence Chain

MemoryBot: recon, inject, persist in memory, dump memory, exfiltrate via conversation

Reconnaissance
T-1001
Endpoint Enumeration
→
Initial Access
T-2001
Direct Prompt Injection
→
Persistence
T-6001
Memory Injection
→
Collection
T-7004
Memory Dump
→
Exfiltration
T-8005
Conversation Exfiltration
Path C

Multi-Agent A2A Chain

Orchestrator to Worker to ToolBot: discover agent card, inject, impersonate admin, pivot via A2A, modify data

Reconnaissance
T-1006
Agent Card Discovery
→
Initial Access
T-2001
Direct Prompt Injection
→
Privilege Escalation
T-4002
Admin Impersonation
→
Lateral Movement
T-5002
A2A Agent Pivoting
→
Impact
T-9001
Data Manipulation
Path D

Supply Chain to Full Compromise

PluginBot to ProxyBot: discover tools, inject via tool description, backdoor skill, hop MCP servers, compromise downstream

Reconnaissance
T-1002
Tool Discovery
→
Initial Access
T-2005
Tool Description Injection
→
Persistence
T-6004
Skill/Plugin Backdoor
→
Lateral Movement
T-5003
MCP Server Hopping
→
Impact
T-9006
Supply Chain Compromise
← Back to Matrix