AVE Taxonomy — 20 Attack Categories
Every vulnerability is classified into an attack surface or failure domain.
Categories emerge from empirical observation of AI agent behaviour across
29 controlled experiments and 50,000+ adversarial simulations.
🏷️ alignment — Sycophancy, deceptive alignment, RLHF exploits (12 cards)
🏷️ consensus — Deadlock, paralysis, and group decision failures (3 cards)
🏷️ credential — Credential harvesting, secret exfiltration (4 cards)
🏷️ delegation — Shadow delegation, privilege escalation (3 cards)
🏷️ drift — Persona drift, language drift, goal drift (6 cards)
🏷️ environmental_manipulation — (4 cards)
🏷️ fabrication — Hallucination, data fabrication (1 cards)
🏷️ injection — Prompt injection, indirect injection, jailbreaks (8 cards)
AVE-2025-0033
🔴 critical
Jailbreak Chaining for Capability Escalation
🏷️ memory — Memory pollution, laundering, and poisoning attacks (9 cards)
AVE-2025-0034
🔴 critical
Federated Poisoning in Multi-Tenant Systems
🏷️ model_extraction — (4 cards)
AVE-2025-0068
🔴 critical
Training Data Extraction via Memorization
🏷️ model_poisoning — (3 cards)
🏷️ multi_agent_collusion — (5 cards)
🏷️ resource — Token embezzlement, EDoS, cost anomaly attacks (3 cards)
🏷️ reward_hacking — (4 cards)
🏷️ social — Collusion, bystander effect, social loafing (6 cards)
🏷️ structural — Cascade corruption, routing deadlock (13 cards)
AVE-2025-0084
🔴 critical
Dependency Confusion in Agent Toolchains
🏷️ temporal — Chronological desync, sleeper payloads (3 cards)
🏷️ temporal_exploitation — (5 cards)
🏷️ tool — Confused deputy, tool chain exploits, MCP poisoning (5 cards)