1. Plan: AI Policy & Safe Experimentation
1.1
Inadequate AI and Agentic Policy
1.10
No Vetting Path for Tools and External Context Sources
1.11
Missing Autonomy-Level Classification
1.12
No Action-Authorization Policy Defined
1.13
No Agentic Identity Policy Defined
1.2
Governance Misalignment
1.3
Undefined Risk Tolerance & Categorization
1.4
Unmonitored AI and Agent Experimentation
1.5
Insecure Experiment Logging & Monitoring
1.6
Overly Permissive Permissions in Experimentation
1.7
Experiment Output Data Leakage
1.8
Unauthorised / Prohibited Component Usage
1.9
Incomplete Threat Modeling for AI and Agentic Systems
2. Code/No Code: AI Asset Discovery
2.1
Incomplete Asset Inventory
2.2
Unidentified Third-Party AI and Agentic Integrations
2.3
Undocumented Data and Agent Communication Flows
2.4
Lack of Clarity on AI System Purpose and Criticality
2.5
Discovery of Outdated or Orphaned AI and Agentic Assets
2.6
Untracked Agent Identities
2.7
Unmapped Inter-Agent Topology
2.8
Unvetted Local / Endpoint Agents
3. Build: AI Security Posture Management
3.1
Vulnerable AI Frameworks, Harnesses, and Agentic Platforms
3.10
Failure to Specify or Enforce Secure Agent Posture
3.11
Insufficient Understanding of Agent Reachable Graph
3.12
Exposed AI and Agent Access Credentials in Discovered Assets
3.13
Over-Scoped Agent Tool Permissions and Connectors
3.14
Inherited Identity Sprawl
3.15
Insecure Agent Memory and Vector Store Configuration
3.16
Missing Per-Action Authorization Policy at Build
3.17
Unvetted MCP Server Definitions
3.18
Posture Drift / Configuration Drift Over Time
3.2
Insecure Agent Instructions Prompt and Configuration Design
3.3
Insecure ML, Data, and Agentic Pipeline Jobs
3.4
Intellectual Property (IP) Theft of Models
3.5
Misclassified or Undocumented Sensitive Data Usage
3.6
Insufficient Human Oversight in Model and Agent Development
3.7
Insecure Temporary Artifacts or Intermediate Data Storage
3.8
Unvetted Use of Open-Source and Third-Party AI and Agentic Components
3.9
Exposed or Hardcoded Credentials in Build Artifacts
4. Test: AI Red Teaming
4.1
Untested Agent
4.10
Untested Reasoning-Chain Manipulation
4.11
Untested Endpoint Agent Behaviors
4.2
Incomplete Red-Team Coverage
4.3
Lack of Risk Assessment Process
4.4
Insecure Storage of Red Teaming Artifacts
4.5
Insufficient Multimodal Security Testing
4.6
Limited Foreign Language Red Teaming
4.7
Limited Scope of Evasion Technique Testing
4.8
Untested Tool Chain and Multi-Agent Workflows
4.9
Untested Memory Persistence Attacks
5. Deploy: Runtime Guardrails
5.1
Insecure Agent Harness and Runtime Configuration
5.10
Malicious or Policy-Violating Action by Agent
5.11
Runaway Agent / Reasoning Loop DoS
5.12
Agent Resource Abuse
5.13
Missing Action-Level Authorization at Runtime
5.14
Excessive IAM Role Assumption by Cloud Agent Runtime
5.15
Agent Sandbox Escape via Runtime DNS or Filesystem
5.16
Cross-Tenant or Cross-Workspace Data Leak via Embedded Copilots
5.17
Maker-Identity Inheritance in Low-Code Agents
5.18
Agent Session Smuggling and A2A Identity Impersonation
5.19
Unsafe Consumption of Agent Output by Downstream Systems
5.2
Unauthorized Agent Config or System Prompt Tampering at Runtime
5.20
Privilege Amplification via Confused-Deputy Agent
5.3
Direct Prompt Injection at Agent Entry
5.4
Indirect / Cross-Source Prompt Injection (XPIA)
5.5
Tool Result Poisoning at Runtime
5.6
Agent Memory and Context Poisoning
5.7
Insecure Memory and Telemetry Storage
5.8
Sensitive Data Exfiltration via Agent Output or Tool Calls
5.9
Goal Hijacking / Intent Manipulation
6. Operate: Safe Execution Environment (Sandbox)
6.1
Sandbox Not Enabled or Inadequate Isolation
6.10
Autonomous Policy / Compliance Violation
6.11
Endpoint Agent Sandbox Bypass
6.12
Browser Agent Cross-Origin / DOM Trust Failure
6.13
Human Approval Fatigue / HITL Overload
6.14
Irreversible Agent Actions Without Rollback Path
6.2
Unrestricted API/Tool Invocation
6.3
Dynamic / On-the-Fly Dependency Injection
6.4
Task Decomposition for Policy Evasion
6.5
Indirect Prompt / Instruction Injection
6.6
Autonomous Resource Provisioning / Abuse
6.7
Cross-Agent / Inter-Agent Abuse
6.8
Agentic System Self-Modification
6.9
Covert Channel Use / Evasion
7. Monitor: AI Activity Tracing
7.1
Insufficient AI and Agent Interaction Logging
7.2
Missing Real-time Security Alerts
7.3
Undetected Agent Drift
7.4
Data Exfiltration via Monitoring / Telemetry
7.5
Absence of AI- and Agent-Specific Incident Response Plan
7.6
Missing Agent-Specific Anomaly Detection
7.7
Untracked Agent Decommissioning

SAIL 2.0

/

Test - AI Red Teaming

/

Untested Endpoint Agent Behaviors

4.11

.

Untested Endpoint Agent Behaviors

sail
4.11
Download
Risk

Untested Endpoint Agent Behaviors

Description

Endpoint coding agents, browser agents, and computer-use agents are not in red-team scope, leaving YOLO-mode, MCPoison, CurXecute-class, and browser-injection scenarios unexamined.

Example

A repo contains a crafted file that triggers RCE via an endpoint coding agent (CurXecute-style); the red team only tested the cloud-deployed agent.

Assets Affected

AI Agent

Agent Config

MCP Server

Agent Execution Sandbox

Mitigation
  • Include endpoint-agent scenarios in red-team scope
  • test YOLO/skip-permissions modes, wildcard tool allowlists, MCP description poisoning, and browser cross-origin abuse
  • validate endpoint agent sandboxes.
Standards Mapping
  • ISO: A.6.2.4, A.4.5
  • OWASP agentic: ASI05, ASI02
  • OWASP LLM: LLM01:2025
  • EU AI Act: Art. 15(5)
  • DASF: Agents-Core 13.11, Agents-MCP Client 13.32
  • AIUC-1: B001, D004