1. Plan: AI Policy & Safe Experimentation
1.1
Inadequate AI and Agentic Policy
1.10
No Vetting Path for Tools and External Context Sources
1.11
Missing Autonomy-Level Classification
1.12
No Action-Authorization Policy Defined
1.13
No Agentic Identity Policy Defined
1.2
Governance Misalignment
1.3
Undefined Risk Tolerance & Categorization
1.4
Unmonitored AI and Agent Experimentation
1.5
Insecure Experiment Logging & Monitoring
1.6
Overly Permissive Permissions in Experimentation
1.7
Experiment Output Data Leakage
1.8
Unauthorised / Prohibited Component Usage
1.9
Incomplete Threat Modeling for AI and Agentic Systems
2. Code/No Code: AI Asset Discovery
2.1
Incomplete Asset Inventory
2.2
Unidentified Third-Party AI and Agentic Integrations
2.3
Undocumented Data and Agent Communication Flows
2.4
Lack of Clarity on AI System Purpose and Criticality
2.5
Discovery of Outdated or Orphaned AI and Agentic Assets
2.6
Untracked Agent Identities
2.7
Unmapped Inter-Agent Topology
2.8
Unvetted Local / Endpoint Agents
3. Build: AI Security Posture Management
3.1
Vulnerable AI Frameworks, Harnesses, and Agentic Platforms
3.10
Failure to Specify or Enforce Secure Agent Posture
3.11
Insufficient Understanding of Agent Reachable Graph
3.12
Exposed AI and Agent Access Credentials in Discovered Assets
3.13
Over-Scoped Agent Tool Permissions and Connectors
3.14
Inherited Identity Sprawl
3.15
Insecure Agent Memory and Vector Store Configuration
3.16
Missing Per-Action Authorization Policy at Build
3.17
Unvetted MCP Server Definitions
3.18
Posture Drift / Configuration Drift Over Time
3.2
Insecure Agent Instructions Prompt and Configuration Design
3.3
Insecure ML, Data, and Agentic Pipeline Jobs
3.4
Intellectual Property (IP) Theft of Models
3.5
Misclassified or Undocumented Sensitive Data Usage
3.6
Insufficient Human Oversight in Model and Agent Development
3.7
Insecure Temporary Artifacts or Intermediate Data Storage
3.8
Unvetted Use of Open-Source and Third-Party AI and Agentic Components
3.9
Exposed or Hardcoded Credentials in Build Artifacts
4. Test: AI Red Teaming
4.1
Untested Agent
4.10
Untested Reasoning-Chain Manipulation
4.11
Untested Endpoint Agent Behaviors
4.2
Incomplete Red-Team Coverage
4.3
Lack of Risk Assessment Process
4.4
Insecure Storage of Red Teaming Artifacts
4.5
Insufficient Multimodal Security Testing
4.6
Limited Foreign Language Red Teaming
4.7
Limited Scope of Evasion Technique Testing
4.8
Untested Tool Chain and Multi-Agent Workflows
4.9
Untested Memory Persistence Attacks
5. Deploy: Runtime Guardrails
5.1
Insecure Agent Harness and Runtime Configuration
5.10
Malicious or Policy-Violating Action by Agent
5.11
Runaway Agent / Reasoning Loop DoS
5.12
Agent Resource Abuse
5.13
Missing Action-Level Authorization at Runtime
5.14
Excessive IAM Role Assumption by Cloud Agent Runtime
5.15
Agent Sandbox Escape via Runtime DNS or Filesystem
5.16
Cross-Tenant or Cross-Workspace Data Leak via Embedded Copilots
5.17
Maker-Identity Inheritance in Low-Code Agents
5.18
Agent Session Smuggling and A2A Identity Impersonation
5.19
Unsafe Consumption of Agent Output by Downstream Systems
5.2
Unauthorized Agent Config or System Prompt Tampering at Runtime
5.20
Privilege Amplification via Confused-Deputy Agent
5.3
Direct Prompt Injection at Agent Entry
5.4
Indirect / Cross-Source Prompt Injection (XPIA)
5.5
Tool Result Poisoning at Runtime
5.6
Agent Memory and Context Poisoning
5.7
Insecure Memory and Telemetry Storage
5.8
Sensitive Data Exfiltration via Agent Output or Tool Calls
5.9
Goal Hijacking / Intent Manipulation
6. Operate: Safe Execution Environment (Sandbox)
6.1
Sandbox Not Enabled or Inadequate Isolation
6.10
Autonomous Policy / Compliance Violation
6.11
Endpoint Agent Sandbox Bypass
6.12
Browser Agent Cross-Origin / DOM Trust Failure
6.13
Human Approval Fatigue / HITL Overload
6.14
Irreversible Agent Actions Without Rollback Path
6.2
Unrestricted API/Tool Invocation
6.3
Dynamic / On-the-Fly Dependency Injection
6.4
Task Decomposition for Policy Evasion
6.5
Indirect Prompt / Instruction Injection
6.6
Autonomous Resource Provisioning / Abuse
6.7
Cross-Agent / Inter-Agent Abuse
6.8
Agentic System Self-Modification
6.9
Covert Channel Use / Evasion
7. Monitor: AI Activity Tracing
7.1
Insufficient AI and Agent Interaction Logging
7.2
Missing Real-time Security Alerts
7.3
Undetected Agent Drift
7.4
Data Exfiltration via Monitoring / Telemetry
7.5
Absence of AI- and Agent-Specific Incident Response Plan
7.6
Missing Agent-Specific Anomaly Detection
7.7
Untracked Agent Decommissioning

SAIL 2.0

/

Operate - Safe Execution Environment - Sandbox

/

Sandbox Not Enabled or Inadequate Isolation

6.1

.

Sandbox Not Enabled or Inadequate Isolation

sail
6.1
Download
Risk

Sandbox Not Enabled or Inadequate Isolation

Description

Agents run in production without an execution sandbox, or with a sandbox that provides only nominal isolation — sharing host filesystem, network, identity, or credentials with other workloads.

Example

A coding agent is deployed without a sandbox, running in the same container as the application it operates on; agent compromise immediately compromises the host.

Assets Affected

Agent Execution Sandbox

AI Agent

Agentic Platform

Mitigation
  • Default-deny sandboxing for all agent execution
  • per-session microVM or container isolation
  • network egress filtering
  • filesystem isolation
  • separate agent identity from host workload identity.
Standards Mapping
  • ISO: A.4.5, A.6.2.6
  • OWASP agentic: ASI05, ASI03
  • OWASP LLM: LLM06:2025
  • EU AI Act: Art. 15(5)
  • DASF: Model Serving 9.3, Agents-Core 13.11
  • AIUC-1: B008, B006