AID-H-017: Secure Agent Architecture
This technique covers the secure-by-design architectural principles for building autonomous AI agents. It focuses on proactively designing the agent's core components-such as its structured control loop, tool-use mechanism, state management, and action dispatchers-to be inherently more robust, auditable, and resistant to manipulation. This is distinct from monitoring agent behavior; it is about building the agent securely from the ground up.
Scope boundary
Owns secure-by-design agent architecture for interruptible control loops, least-privilege tool surfaces, decoupled planning and execution, task-scoped state, signed behavior contracts, delegation bounds, and raw-content isolation. Auditability means structured state and outcomes, not raw hidden reasoning.
AID-H-018: AID-H-017 designs the agent architecture and its control points; AID-H-018 independently enforces authorization and capability limits at each runtime action boundary. A secure architecture must still route every effect through canonical authorization.
AID-H-037: AID-H-017 owns structured control-loop and state auditability without requiring chain-of-thought; AID-H-037 owns reasoning-trace confidentiality, reasoning compute bounds, and provider reasoning-block integrity. Agent audit records and hidden reasoning state have different disclosure and integrity requirements.
Sub-techniques
- AID-H-017.001: Interruptible Agent Control Loops & Structured State Auditability
- AID-H-017.002: Least-Privilege Tool Architecture
- AID-H-017.003: Decoupled Plan-Then-Execute Architecture
- AID-H-017.004: Transient & Isolated State Management
- AID-H-017.005: Agent Behavior Contract Definition & Signing
- AID-H-017.006: Agent Delegation-Graph Bounds & Capability Attenuation
- AID-H-017.007: Dual-LLM Isolation Pattern
Threat mappings
MITRE ATLAS
- AML.T0011 User Execution
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0029 Denial of AI Service
- AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
- AML.T0050 Command and Scripting Interpreter
- AML.T0051 LLM Prompt Injection
- AML.T0051.000 LLM Prompt Injection: Direct
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0051.002 LLM Prompt Injection: Triggered
- AML.T0053 AI Agent Tool Invocation
- AML.T0054 LLM Jailbreak
- AML.T0067 LLM Trusted Output Components Manipulation
- AML.T0072 Cyber Communication Channel
- AML.T0075 Enterprise Resource Discovery
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.000 AI Agent Context Poisoning: Memory
- AML.T0081 Modify AI Agent Configuration
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0089 Enterprise Environment Discovery
- AML.T0092 Manipulate User LLM Chat History
- AML.T0098 AI Agent Tool Credential Harvesting
- AML.T0099 AI Agent Tool Data Poisoning
- AML.T0100 AI Agent Clickbait
- AML.T0101 Data Destruction via AI Agent Tool Invocation
- AML.T0102 Generate Malicious Commands
- AML.T0108 AI Agent
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.002 AI Agent Tool Poisoning: Runtime Response
- AML.T0117 Autonomous Attack-Path Adaptation
- AML.T0118 Autonomous AI Agent Communication
- AML.T0118.000 Autonomous AI Agent Communication: Communication via Shared Artifacts
- AML.T0118.001 Autonomous AI Agent Communication: Direct Agent Communication
- AML.T0121 AI Agent Environment Reconstruction
- AML.T0124 Autonomous Attack Orchestration
- AML.T0130 AI Agent Response Biasing
- AML.T0133 Discover AI Agent Runtime Capabilities
MAESTRO
- Compromised RAG Pipelines (L2)
- Input Validation Attacks (L3)
- Denial of Service on Framework APIs (L3)
- Compromised Agents (L7)
- Agent Tool Misuse (L7)
- Agent Goal Manipulation (L7)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM03:2026 Excessive Agency
- LLM05:2026 Data and Model Poisoning
- LLM06:2026 Unbounded Consumption
- LLM08:2026 Hidden Context Exposure
- LLM10:2026 Improper Output Handling
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI05:2026 Unexpected Code Execution (RCE)
- ASI06:2026 Memory & Context Poisoning
- ASI08:2026 Cascading Failures
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-1.2 Indirect Prompt Injection
- AITech-2.1 Excessive Agency
- AITech-2.2 Goal Drift
- AITech-4.2 Context Boundary Attacks
- AITech-4.3 Protocol Manipulation
- AITech-5.1 Memory System Persistence
- AITech-8.2 Data Exfiltration / Exposure
- AITech-9.1 Model or Agentic System Manipulation
- AITech-12.1 Tool Exploitation
- AITech-12.2 Insecure Output Handling
- AITech-13.1 Disruption of Availability
- AITech-13.2 Cost Harvesting / Repurposing
- AITech-14.2 Abuse of Delegated Authority
- AISubtech-2.1.1 Execution Approval Bypass
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-2.2.1 Unauthorized Scope Expansion
- AISubtech-2.2.3 Authorization and Constraint Erosion
- AISubtech-4.2.2 Session Boundary Violation
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-4.3.5 Capability Inflation
- AISubtech-5.1.1 Long-term / Short-term Memory Injection
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-9.1.1 Code Execution
- AISubtech-9.1.2 Unauthorized or Unsolicited System Access
- AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
- AISubtech-12.1.1 Parameter Manipulation
- AISubtech-12.1.2 Tool Poisoning
- AISubtech-12.1.3 Unsafe System / Browser / File Execution
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.2 Memory Flooding
- AISubtech-13.1.3 Model Denial of Service
- AISubtech-13.1.4 Application Denial of Service
- AISubtech-13.1.5 Decision Paralysis Attacks
- AISubtech-13.2.1 Service Misuse for Cost Inflation
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-14.2.1 Permission Escalation via Delegation
Google Secure AI Framework 2.0 - Risks
- DMS: Denial of ML Service
- IIC: Insecure Integrated Component
- PIJ: Prompt Injection
- IMO: Insecure Model Output
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model Serving - Inference requests 9.1: Prompt inject
- Model Serving - Inference requests 9.12: LLM Jailbreak
- Model Serving - Inference requests 9.13: Excessive agency
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.4: Resource Overload
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.11: Unexpected RCE and Code Attacks
- Agents - Core 13.14: Human Attacks on Multi-Agent Systems