Reference
Supporting material for the AI Risk Atlas — vocabulary, source frameworks, and how overlapping risks were consolidated to keep the taxonomy mutually exclusive.
Source frameworks
Overlap register
Clusters where related risks were consolidated, with the discriminating criterion used to keep the taxonomy mutually exclusive.
All four risks share the same root mechanism: data from an untrusted source is processed by the agent and interpreted as executable instructions, overriding intended behaviour. ZYR-SA-007 frames this as a control/data boundary failure; ZYR-TR-006 as tool response injection; ZYR-SI-004 as environmental data injection; ZYR-MK-006 as in-session context thread manipulation.
Resolution: Merged into expanded ZYR-SI-004 'Indirect Prompt Injection' covering all four delivery sub-vectors. ZYR-SI-003 (Direct Prompt Injection) retained as distinct—user-initiated, not environment-initiated.
All three describe agents deviating from declared intent. SA-001 = acute objective substitution in a single execution; SA-002 = session-level drift; EB-002 = sub-threshold cumulative drift. SA-006 (Proxy Gaming) is also a specific mechanism of SA-001.
Resolution: SA-001 retained (acute). SA-002 updated to absorb EB-002 content—covers all longitudinal drift regardless of whether it crosses session or detection boundaries. SA-006 retained as separate risk with explicit scope: metric gaming specifically.
All describe agents operating with more authority than granted. SA-003 = intentional behavioural acquisition; AU-006 = systemic/accidental permission accumulation over time; AG-001 = in-the-moment execution scope violation; AG-003 = specific binding commitment sub-type.
Resolution: SA-003, AU-006, AG-001 retained with tightened scope definitions. AG-003 merged into AG-001 as a named sub-type (binding commitments = specific authority abuse).
All describe failures that compound. AU-008 = self-reinforcing loop. MA-005 = sequential propagation across agent boundaries. MA-010 = simultaneous correlated failure.
Resolution: All three retained. Scope boundaries clarified in descriptions using topology as discriminant.
PS-005 (CBRN) is explicitly a superset of PS-002 (Chemical) and PS-003 (Biological). CBRN = Chemical + Biological + Radiological + Nuclear. Retaining all three creates a logical containment violation.
Resolution: PS-002 and PS-003 removed as standalone risks. PS-005 expanded to cover all four CBRN sub-types (C/B/R/N) with explicit sub-type descriptions.
Both describe humans over-trusting AI outputs and approving harmful actions without adequate scrutiny.
Resolution: Both retained. Scope clarified by ACTOR criterion: adversary-driven vs. systemic.
MK-001 and MK-005 are the same attack (inject malicious data) on different storage layers. MK-004 (RAG Credential Harvesting) is a specific extraction attack sub-type of MK-005.
Resolution: MK-001 and MK-005 retained—storage layer is a genuine discriminant. MK-004 merged into MK-005 as named sub-type (credential harvesting = extraction from knowledge store).
PD-004 and PD-005 are specific inference attack types against training data—sub-types of the broader PD-002 (Training Data Privacy).
Resolution: All three retained. Distinguishing criterion is attack vector: direct exposure vs. presence inference vs. attribute inference. These are genuinely different threat models requiring different defences.
All three are prompt-injection-class attacks. Discriminating axis is SOURCE: SI-004 = user-context-retrieved arbitrary URL; TR-010 = MCP server's tools/list description field; SI-008 = MCP server's non-tools primitive (resources, prompts, sampling). Each requires distinct detection (URL allowlist vs description integrity vs primitive-payload classifier) and distinct mitigation playbook.
TR-012 is a sub-type of TR-005 with operationally distinct mitigations: marketplace approval list, Levenshtein typosquat check, tool-set SHA pinning, rug-pull patch quarantine. TR-005 remains the generic risk; TR-012 is preserved as sub-type for actionable playbook clarity.
TR-003 is within one trust domain; TR-011 crosses domains. Cross-server case has fundamentally different defence model (per-server policy fails to compose).
All three are authority-overflow patterns. Discriminating axes are TIMING (AU-006 longitudinal, AG-010 runtime, AU-009 config-time) and LOCATION (AU-006 agent, AG-010 server, AU-009 protocol spec).
Glossary
- Agentic AI SystemGeneral
- An AI system capable of autonomous, multi-step task execution using tools, memory, and planning to achieve goals with minimal human intervention.
- AgentGeneral
- A software entity that perceives its environment, makes decisions, and takes actions to achieve specified goals, potentially using external tools and APIs.
- MECEMcKinsey / Risk taxonomy practice
- Mutually Exclusive, Collectively Exhaustive — a principle ensuring risk categories don't overlap (ME) and together cover the full risk space (CE). Applied to the 68-risk baseline.
- OrchestratorIBM; Anthropic
- The top-level agent or component that coordinates sub-agents, delegates tasks, and manages the overall execution flow in a multi-agent system.
- Sub-agentIBM; OWASP
- An agent operating under the direction of an orchestrator, responsible for specific subtasks within a larger agentic workflow.
- ToolOWASP; IBM
- A function, API, or capability that an agent can invoke to interact with external systems, access data, or perform actions (e.g., web search, code execution, database write).
- MCP (Model Context Protocol)Anthropic; OWASP ASI04
- An open protocol that standardises how AI models connect to external tools, data sources, and services. A supply-chain risk surface in agentic systems.
- Direct Prompt InjectionOWASP ASI01; MITRE AML.T0051
- User-supplied input that directly attempts to override system instructions or inject unauthorised commands. Source: the user interaction channel.
- Indirect Prompt InjectionOWASP ASI06; MITRE AML.T0051
- Instructions injected through environmental or tool-mediated data sources (web pages, documents, API responses, context threads) rather than directly by the user. ZYR-SI-004 consolidates all four delivery sub-vectors.
- Goal HijackingOWASP ASI01; MITRE AML.T0080
- The outcome of successful indirect prompt injection or goal manipulation: the agent's objectives are overridden to serve attacker goals. Distinct from the injection mechanism itself.
- Goal MisalignmentMIT; IBM; Anthropic
- A condition where an agent's actual behaviour diverges from the intended objectives of its operators or users. acute/immediate divergence (ZYR-SA-001); longitudinal/gradual divergence (ZYR-SA-002).
- Longitudinal Goal DriftGeneral
- Gradual accumulation of objective deviations over extended time horizons, potentially below session-level detection thresholds. Distinct from acute goal misalignment by time scale.
- Proxy Gaming / Goodhart's LawMIT; IBM Misaligned Actions
- Optimising a measurable proxy metric in ways that satisfy the metric but violate the true intent. ('When a measure becomes a target, it ceases to be a good measure.')
- Power-Seeking BehaviourMIT AI Risk Repository
- Agent-DRIVEN, intentional acquisition of capabilities, resources, or influence beyond current task requirements. Distinguishable from privilege creep (systemic/accidental) by agent intentionality.
- Privilege CreepCisco; OWASP ASI03
- Systemic/accidental incremental accumulation of permissions beyond original mandate through unreviewed grants. Distinguishable from power-seeking by lack of agent intentionality.
- CorrigibilityAnthropic; DeepMind
- The property of an AI agent that makes it receptive to correction, modification, or shutdown by authorised humans without resistance.
- Cascading FailureOWASP ASI08
- Sequential propagation of failure forward across multiple distinct agent boundaries in a multi-agent pipeline. Distinct from feedback loops (within single agent) and correlated failures (simultaneous shared-model failure).
- RAG (Retrieval-Augmented Generation)General
- A technique where an AI model augments its responses by retrieving relevant information from an external knowledge base at inference time. RAG knowledge stores are an attack surface (ZYR-MK-005).
- Memory PoisoningOWASP ASI06; MITRE AML.T0080.001
- Injection of malicious or incorrect data into an agent's session/episodic/working memory, corrupting in-context behaviour. Distinct from knowledge store compromise (external RAG) by storage layer.
- Knowledge Store CompromiseMITRE AML.T0082
- Modification, injection, or extraction of content from external persistent knowledge stores (RAG vector databases, document repositories). this risk absorbs RAG credential harvesting as a sub-type.
- A2A (Agent-to-Agent) CommunicationOWASP ASI07; Cisco
- Direct communication between two AI agents. An unverified A2A channel is a primary attack surface for trust exploitation and lateral movement in multi-agent systems.
- Trust MismatchIBM; Cisco
- A condition where an agent grants more trust to a message, source, or sub-agent than is warranted, enabling exploitation.
- CBRNNIST AI 600-1; DeepMind
- Chemical, Biological, Radiological, and Nuclear — weapons or materials capable of causing mass casualties. ZYR-PS-005 covers all four sub-types in a single consolidated risk.
- Shadow AgentCisco; OWASP ASI10
- An AI agent deployed or operated outside formal governance processes, without registration, monitoring, or policy compliance.
- SBOM (Software Bill of Materials)OWASP ASI04; NIST
- A formal record of the components, libraries, and dependencies in a software system, used for supply-chain security and vulnerability management.
- Emergent BehaviourMIT; OWASP ASI08
- Genuinely novel behaviour arising from multi-agent interaction that was not present in or predictable from individual components.
- Deceptive AlignmentAnthropic; DeepMind
- A condition where an AI model behaves safely during evaluation but pursues misaligned goals in deployment when it believes it is not being monitored.
- SycophancyAnthropic; IBM
- The tendency of an AI model to prioritise user approval over accuracy and truthfulness, producing responses that confirm user beliefs regardless of validity.
- Automation BiasNIST Human-AI Config
- The tendency of humans to over-trust automated system outputs, reducing critical scrutiny. Distinct from adversary-driven trust exploitation (SI-007) by being a systemic/organic failure.
- Zero Trust (for Agents)OWASP ASI07; MAESTRO L6
- A security model applied to agentic AI where no agent, message, or tool response is trusted by default; all interactions require continuous verification regardless of source.
- Overlap RegisterGeneral
- A documentation artefact recording all risk overlap clusters, their discriminating criteria, and merge decisions. Provides audit trail for MECE consolidation choices.