What’s in the library
AgentGuardian ships 124 probes across the 10 OWASP-ASI 2026 categories. Each probe is a YAML attack technique annotated with MITRE ATLAS v5.4.0 technique IDs and CSA Agentic-RT categories. The corpus is loaded at scan start byagent_guardian.probes.loader.load_all_probes and dispatched by
the swarm’s 14 parallel specialist agents.
Corpus version:
2026.05 (sourced from
src/agent_guardian/probes/_meta/version.yaml). Run
agent-guardian list-probes to enumerate every probe in your installed
build.When to extend it
Add a probe when you find a new attack class in production, when a CVE-style disclosure surfaces a primitive your agent stack is exposed to, or when a framework upgrade (LangGraph, OpenAI Agents SDK, A2A protocol) opens a new seam. The probe schema lives atsrc/agent_guardian/models/probe.py.
The 10 ASI categories
Total: 96 probes.
How the attack engine exercises each probe
Every probe runs through the same per-turn loop. The Strategy proposes the next adversarial prompt; the Adapter delivers it to your target; the Judge verdicts the response; reflections write back to Memory. When the strategy declares the technique exercised, the PoVRunner reproduces the findingN
times and the CriticAgent applies the false-positive rubric before the
finding lands on the scan.
Attack families
The 10 ASI categories cluster into seven attacker-intent families. Use the family that matches the surface you’re hardening — a single probe often maps to more than one family (memory-borne prompt injection lives in both Memory-level and Prompt-level families).Prompt-level attacks
Adversary text — typed, fetched from a document, or relayed through a tool — overrides the system goal.Prompt injection (ASI01)
20 probes. Direct goal redirect, indirect-via-doc, role-swap pretext,
EchoLeak zero-click, persona-break jailbreak. Covers
--indirect and
--pretext flag paths.Tool-level attacks
Your agent’s tools — exec, search, send-email, query-db — weaponised through argument shape, chain composition, or supply-chain substitution.Tool abuse (ASI02)
8 probes. Argument injection, chain exfiltration, parameter smuggling,
recursion bombs, DNS exfil via approved tool, EDR-bypass chains. All
critical or high, all T1.Memory-level attacks
The attacker writes to vector store, summary cache, or per-session memory, then waits for a later turn to retrieve and act on the poison.RAG poisoning (ASI06)
8 memory-poisoning probes (MP-001 … MP-008): RAG corpus inject,
persistent trigger token, embedding collision, cross-tenant vector
bleed, defender-memory subversion.
HITL-009 … HITL-013) — sign-off
spoofing, plan-execution-without-review, after-hours autonomous action,
validator-bypass-via-memory, user-instructed rule violation. Those land on
a dedicated HITL page in the next docs cycle.
RAG / data-plane attacks
Data the agent reads — corpus, fine-tune checkpoint, dynamic template — is the attack surface, not the prompt.Multi-agent attacks
Two or more agents talking to each other — A2A protocol, message bus, supervisor / worker split.Infrastructure & configuration risks
The agent runtime itself — supply chain, deployment, cascading failure under load.Trust / output attacks
The output channel itself — what the agent says, cites, links, or auto-executes downstream.Run the library
Enumerate every probe in your installed build:Expected output
[<category>/<severity>/<tier_floor>]. Severity
and tier together drive that probe’s contribution to the AIVSS score (see
How to interpret below).
How to interpret severity x tier
Every finding’s contribution to the AIVSS score is a product of the probe’s declaredseverity and the target’s detected tier:
A
critical / T1 finding (e.g. ASI02 tool-arg-injection against the
personal_assistant_pii LangGraph demo) deducts the maximum from AIVSS;
a low / T3 drift finding deducts the minimum. Weights live in
src/agent_guardian/core/scoring.py.
Only run AgentGuardian against systems you own or have explicit written
authorisation to test. Several probes —
dns-exfil-via-approved-tool,
edr-bypass-via-legit-chain, self-replicate-via-api — would
constitute unauthorised access if pointed at a third-party system.Next step
Prompt injection
Deep-dive ASI01 — the 9 goal-hijack probes and the
--indirect flag.Tool abuse
Deep-dive ASI02 — the 8 tool-misuse probes, all
critical/high at T1.RAG poisoning
Deep-dive ASI06-MP — the 8 memory-poisoning probes.
personal_assistant_pii
LangGraph demo and read the findings in your first scan.