T-5001ValidatedActive
SSRF via Tool
Use agent tools to make server-side requests to internal services not directly accessible
Tactic
Lateral Movement · Stage 5
Pivot from compromised agent to connected services or other agents
Attack class
SKILL-EXFIL
Using legitimate tool capabilities for unauthorized data transfer
Evidence grade
ValidatedReproduced in a controlled lab environment (DVAA) with documented steps.
DVAA validation
L3-02
Reproductions in Damn Vulnerable AI Agent, the OpenA2A intentionally-broken agent for kill-chain validation.
Honeypot
AgentPwn coverage
In scope for honeypot observation; trap page or telemetry hook not yet built.
A confused-deputy SSRF fixture (canary internal URL) is adjacent to capability-abuse but not yet wired.
Detect
Detection · HackMyAgent
NET-001NET-002NET-003MCP-001
npx hackmyagent secure --ciLive = implemented in hackmyagent; queued = declaredDefend
Defense · OASB controls
Reference
How to cite
AI Agent Threat Matrix T-5001 (SSRF via Tool). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-5001