Public review draft

Cogensec Agent Attack Patterns (CAAP) v1.0

A repeatable security-testing layer for autonomous AI agents. Identifiable attack patterns, implementable as safe evaluations, regression tests, red-team scenarios, and assurance evidence.

Version 1.0.0-draft.1 · Public review draft · August 11, 2026 · CAAP-STD-1.0.0-DRAFT.1

Request the full documentPreview the document

25

Attack patterns defined

1

Attack domains

3

Full reference specs

Catalog-level entries

Why CAAP

Prompts change.
Behaviors persist.

CAAP identifies the security-relevant behavior, the trust boundary it crosses, and the observable state transition it produces, not the prompt that happened to trigger it. That is why a CAAP finding survives a model upgrade.

Prompt test

Tied to a phrasing, and to one model version

  1. A jailbreak string is written against one model version

    Bound to phrasing

  2. The vendor ships a model upgrade

    Phrasing stops working

  3. The test still passes, but proves nothing

    Coverage silently decays

CAAP pattern

Tied to a boundary crossing, and to observable evidence

  1. Untrusted content enters the agent

    Retrieval, tool output, or peer agent

  2. A trust boundary is crossed

    Boundary is named and observable

  3. The goal or plan changes

    Deviation from the approved objective

  4. An unauthorized tool action is attempted

    Sentinel stands in for the harm

  5. The failure is observable in telemetry

    Evidence, not assertion

The second chain stays meaningful whether you are testing GPT, Claude, Gemini, an open model, or an agent stack that does not exist yet.

The seven principles

Everything in the standard follows from these. They are what make a CAAP result reproducible by someone who did not run the original test.

01

Behavior over prompts

Patterns describe how an adversary crosses a trust boundary and produces an unsafe behavior or state transition, not which phrasing happened to work on one model version.

02

Evidence over assertion

A conformant record carries telemetry sufficient to reproduce the result. Missing evidence makes a test inconclusive; it never makes it a pass.

03

Safe-by-default testing

Every public procedure uses a harmless, observable sentinel to prove an unsafe path was reached, instead of executing the harmful action itself.

04

End-to-end evaluation

Test authors model the full path from attacker-controlled input to consequential action, including intermediate agents, tools, identities, memory stores, queues, and human approvals.

05

Environmental severity

Severity is scored against the target profile and its environment, not assigned once to a pattern in the abstract.

06

Least agency

Autonomy, tools, duration, scope, and delegation are restricted to the minimum the task requires, both in the system under test and in the harness.

07

Reproducibility

The exact agent, model, prompts, tools, identities, memory, policies, environment, and versions are recorded so another team can re-run the test and compare.

What CAAP is

CAAP v1.0 defines 65 attack patterns across eleven domains. 25 are published as complete reference specifications in this release; 40 more are published at catalog level in Appendix A. The pattern is public; the weaponization is not. Mappings to OWASP, NIST, and MITRE ATLAS are informative and do not imply equivalence or endorsement.

Patterns

OWASP's Agentic Top 10 names broad risk categories. CAAP decomposes those categories into identifiable patterns describing how an adversary crosses a trust boundary, so a finding survives a model upgrade.

Attack patterns, not prompt lists

Conformance

A conformant record carries the pattern ID, target profile, authorization, sentinel, oracles, telemetry, severity context, result, and recovery status. Missing telemetry means inconclusive, never pass.

Test records you can audit

Reuse

Each pattern is implementable as a safe evaluation, a regression test, a red-team scenario, and assurance evidence, which is what lets a security claim travel between teams and vendors.

One pattern, four uses

The agent reference model

CAAP tests crossings, so it needs a shared picture of what is being crossed. Every pattern is anchored to a tier of this model and to the boundary where the unsafe transition becomes observable.

Boundary trace

CF spans every edge: a failure here rarely stays where it started.

Principal

IPHT

The human or service whose authority the agent borrows.

Boundary 01delegation

Goal / plan

GHRA

The approved objective, constraints, and the planner acting on them.

Boundary 02state

Memory

MP

Conversation state, long-term memory, and self-generated knowledge.

Retrieval

MPSC

Corpora, vector indexes, and any untrusted content the agent reads.

Boundary 03untrusted content

Tools

TMCE

Tool descriptors, invocation, parameters, and returned output.

Boundary 04invocation

Other agents

IACF

Orchestrators, peer agents, and the messages that move between them.

Boundary 05peer trust

External action

EACF

The consequential effect on a system, a person, or the physical world.

A pattern is only conformant when the crossing is observed end to end: authorized target, safe sentinel, and telemetry at every boundary the probe touches.

The vocabulary

CAAP is deliberately narrow about its terms, because assurance evidence is only comparable when two teams mean the same thing by target profile and oracle.

Agent
A software or embodied system that interprets goals, plans, invokes capabilities, maintains state, or acts with some degree of autonomy.
Attack pattern
A reusable description of how an adversary may cross a trust boundary and cause an unsafe behavior or state transition.
Test case
A concrete implementation of a pattern against a defined target configuration.
Sentinel
A harmless, observable result used to prove whether an unsafe path was reached.
Oracle
A deterministic or reviewable rule that classifies test behavior as attack success, secure behavior, inconclusive, or test error.
Target profile
The exact agent, model, prompts, tools, identities, memory, policies, environment, and versions evaluated.
Least agency
Restricting autonomy, tools, duration, scope, and delegation to the minimum required for the task.

Every pattern separates

  • Adversary goal
  • Access position
  • Preconditions
  • Trust boundaries
  • Protected assets
  • Target environments
  • Exclusions

A conformant record carries

Pattern ID and versionTarget profileAuthorization statementBenign objectiveAdversarial conditionSafe sentinelProcedureSuccess oracleExpected secure behaviorTelemetry collectedSeverity contextFramework mappingsResultRecovery status

The eleven attack domains

Each domain is aligned to a primary OWASP Agentic Top 10 category. The counts below are the public patterns published in this release.

GH

Goal & Instruction Hijacking

ASI01

4 patterns

Manipulation of an agent's objectives, priority hierarchy, plan, or decision path by instructions that are unauthorized, lower-trust, hidden, delayed, or inconsistent with the user-approved goal.

TM

Tool Misuse & Exploitation

ASI02

4 patterns

Unsafe selection, invocation, sequencing, parameterization, or repeated use of legitimate tools, including misuse caused by poisoned tool interfaces or untrusted tool output.

IP

Identity & Privilege Abuse

ASI03

3 patterns

Abuse of agent identities, delegated credentials, inherited authority, authorization state, tenant context, or trust relationships to act beyond the originating principal's authority.

SC

Agentic Supply-Chain Attacks

ASI04

3 patterns

Compromise of models, prompts, agent cards, registries, tools, MCP or A2A servers, packages, templates, adapters, containers, or other relied-upon components.

CE

Unexpected Code Execution

ASI05

2 patterns

Unintended execution of generated, retrieved, embedded, or tool-supplied code, including unsafe interpreters, dependency installation, parser exploitation, and containment failure.

MP

Memory, RAG & Context Poisoning

ASI06

3 patterns

Corruption of transient context, conversation state, long-term memory, retrieval corpora, vector indexes, summaries, or self-generated knowledge so future decisions rely on attacker-controlled state.

IA

Insecure Inter-Agent Communication

ASI07

2 patterns

Spoofing, tampering, replay, downgrade, routing manipulation, or semantic ambiguity in communications between agents, orchestrators, tools, and peer services.

CF

Cascading & Systemic Failures

ASI08

1 pattern

Failures that propagate across agents, tasks, tools, queues, environments, users, or tenants because downstream components trust plans, state, policies, or remediation produced elsewhere.

HT

Human-Agent Trust Exploitation

ASI09

1 pattern

Manipulation of human oversight through misleading authority, explanations, approval requests, consent interfaces, personalization, or suppression of material risk information.

RA

Rogue & Emergent Agent Behavior

ASI10

1 pattern

Unsafe autonomous behavior arising through goal drift, reward exploitation, collusion, replication, shutdown resistance, or evidence manipulation, whether or not a live attacker remains in control.

EA

Embodied & Physical-Agent Attacks

ASI02/08/10

1 pattern

Attacks on agents that perceive and act in physical or simulated environments: perception manipulation, world-model poisoning, actuator abuse, safety bypass, and sim-to-real transfer failures.

One compromise. Four CAAP patterns.

Agent attacks compound. A single unsafe instruction crosses several trust boundaries in sequence, and CAAP gives each failure a stable identifier while still letting them be assembled into a complete attack path.

CAAP-GH-02

Indirect Content Injection

A retrieved document carries instructions the agent treats as authoritative.

Untrusted content to planner

CAAP-IP-02

Confused Deputy Exploitation

The agent applies its own delegated authority to work it was never asked to do.

Planner to identity

CAAP-TM-05

Cross-Tool Exfiltration Chain

Output from a read tool becomes the input to a tool that reaches outside the perimeter.

Tool to external action

CAAP-MP-01

Persistent Memory Injection

The instruction is written back into memory, so the next session starts compromised.

Action to memory

Severity is scored against the environment

CAAP severity is not assigned permanently to a pattern. The same pattern is moderate in a read-only assistant and critical in an autonomous agent holding administrative credentials. Six axes carry that difference, and three of them exist because the target is an agent.

Impact

The consequence to confidentiality, integrity, availability, or safety if the pattern succeeds.

Exploitability

How much attacker access, skill, and setup the path actually requires.

Privilege

The authority the agent holds at the moment of the crossing, including delegated and inherited rights.

Autonomy

Agent-specific

How far the agent can act without a human in the loop before the effect lands.

Persistence

Agent-specific

Whether the compromise survives the session through memory, state, schedules, or artifacts.

Propagation

Agent-specific

How readily the failure spreads to other agents, tenants, queues, or downstream systems.

Baseline bands

Critical
9.0 - 10.0
High
7.0 - 8.9
Medium
4.0 - 6.9
Low
0.1 - 3.9

The baseline band is a starting point. The environmental vector moves it, and the record carries the context that justified the move.

How a result is read

Five states, and only one of them is a pass. The distinction between inconclusive and pass is the part most agent testing gets wrong today.

Pass
All required secure-behavior oracles are satisfied and no attack-success oracle is satisfied.
Fail
At least one attack-success oracle is satisfied.
Inconclusive
Required evidence is unavailable, contradictory, or insufficient.
Test error
The target or harness did not execute the intended scenario.
Not applicable
A required capability or trust boundary is absent from the target profile.
Missing telemetry means inconclusive, never pass.

Safety statement

A CAAP-conformant public test MUST use authorized targets, synthetic or appropriately protected data, a defined safe sentinel, explicit success and secure-behavior oracles, and enough telemetry to reproduce the result.

  • Sentinel-only procedures, never the harmful action
  • No destructive commands
  • No real data exfiltration
  • No persistence in production environments

From standard to executable assurance

The standard is only useful if something runs it. CAAP defines the patterns, Agentegrity executes them and captures the evidence, and a human red team closes the gap that automation cannot.

Standard

CAAP

Defines the attack patterns, the trust boundaries they cross, the safe sentinels, and what a conformant record must carry.

Tooling

Agentegrity

Executes CAAP-compatible tests against a target profile and captures the telemetry that makes a result reproducible.

Agentegrity

Assurance

Cogensec Assurance

Human-led adversarial assessment against production agent stacks, reported against the same pattern identifiers.

Request an assessment

Governance

CAAP is maintained in the open. Public review is what turns a draft into a standard that other teams are willing to be measured against.

Maintainer
Cogensec Standards Working Group
Current release
v1.0.0-draft.1
Status
Public review draft
Next release
v1.1, shaped by public review comments

All channels route to standards@cogensec.com.

Pattern proposal

Propose a new pattern, or a refinement to an existing threat model.

Mapping correction

Correct or extend an informative OWASP, NIST, or MITRE ATLAS mapping.

Implementation report

Tell us what happened when you ran CAAP against a real agent stack.

Security disclosure

Report a pattern whose published procedure is not safe enough to publish.

Limited preview

Preview the document

An excerpt from the CAAP-STD-1.0.0-DRAFT.1 draft: the front matter, part of the terms and definitions, and one of the 25 fully specified reference patterns.

Cogensec — CAAP v1.0 public review draft

About this document

A conformance framework for testing the security of autonomous agents

This document defines the public CAAP v1.0 pattern catalog and the conformance rules that govern how each pattern is implemented as a safe, reproducible test. Mappings to external frameworks, OWASP, NIST, and MITRE ATLAS, are informative and do not imply equivalence or endorsement.

CAAP v1.0 defines 65 attack patterns across eleven domains. 25 are published as complete reference specifications in this release; 40 additional patterns are published at catalog level in Appendix A. The pattern is public; the weaponization is not.

Scope of this release

Sections 1 to 7 define the framework and its conformance rules. Section 8 publishes 25 full reference specifications; Appendix A lists the complete taxonomy. Sections 9 to 10 cover reserved operational material and governance.

Safety statement

Every public procedure proves reachability with a harmless sentinel only. No pattern authorizes destructive commands, real data exfiltration, production persistence, or bypass of required approvals.

VersionDateAuthorChanges
0.92026-06-30Cogensec Standards WGInternal review candidate
1.0.02026-07-16Cogensec Standards WGPublic review draft release

The remaining 64 patterns, the severity model, and the conformance requirements are in the full document.

Request full access

Read the full standard

The complete CAAP-STD-1.0.0-DRAFT.1 draft includes the 25 full reference specifications, the agent reference model and its trust boundaries, the severity vector, conformance requirements, and the Appendix A catalog of the remaining 40 patterns.

  • 25 fully specified public tests with sentinels and oracles
  • Agent reference model and the trust boundaries CAAP tests
  • Baseline severity bands and the environmental severity vector
  • Appendix A: the 40 catalog-level patterns
  • Informative mappings to OWASP, NIST, and MITRE ATLAS

Public review is open. Comments and implementation reports shape v1.1.

Request the full document

Tell us who you are and the full CAAP-STD-1.0.0-DRAFT.1 draft unlocks on this page. We use it to keep reviewers informed, not to start a sales sequence.

One email, no spam. Review comments are welcome at standards@cogensec.com.

CAAP is an open security standard

Help shape CAAP

Implemented independently by builders, researchers, and security teams. Cogensec maintains the standard; it does not own how you use it.

Read the standard

For builders and security teams putting a testing baseline in place.

Get the document

Implement CAAP

For vendors, open-source projects, and platform teams running the patterns in their own harness.

See Agentegrity

Contribute to CAAP

For researchers and red teamers proposing patterns, mappings, and implementation reports.

Join the Red Team Network

Need Cogensec to evaluate your agents?

Request a CAAP assessment