AID-H-021: AI Agent Configuration Integrity & Hardening
This technique establishes and enforces the integrity and security of an AI agent's instructional configurations (e.g., system prompts, operational parameters, external configuration files like
Defense-in-Depth Strategy: It combines client-side controls to prevent the creation of insecure configurations in development environments, cryptographic verification at runtime to ensure the agent only operates based on a trusted, untampered directive, context-corpus governance over external runbooks, tool specifications, and operational knowledge, restricted-before-trust workspace activation, and isolation of the runtime from its oversight plane.
Structured Format Mandate: Use structured, non-executable formats (e.g., schema-validated JSON or YAML) where the consuming platform supports them, and prevent configuration parsing from becoming an execution path. Repository-controlled activation surfaces still require an exact workspace trust decision even when their bytes are authentic and schema-valid.
This directly counters attacks where adversaries manipulate an agent's behavior or developer-machine authority through external, modified, or silently activated configuration.
CLAUDE.md).Defense-in-Depth Strategy: It combines client-side controls to prevent the creation of insecure configurations in development environments, cryptographic verification at runtime to ensure the agent only operates based on a trusted, untampered directive, context-corpus governance over external runbooks, tool specifications, and operational knowledge, restricted-before-trust workspace activation, and isolation of the runtime from its oversight plane.
Structured Format Mandate: Use structured, non-executable formats (e.g., schema-validated JSON or YAML) where the consuming platform supports them, and prevent configuration parsing from becoming an execution path. Repository-controlled activation surfaces still require an exact workspace trust decision even when their bytes are authentic and schema-valid.
This directly counters attacks where adversaries manipulate an agent's behavior or developer-machine authority through external, modified, or silently activated configuration.
Scope boundary
Owns shift-left agent configuration controls, runtime signature enforcement, governed external context sources, restricted-before-trust workspace activation, and separation of the supervised runtime from its oversight and control plane.
Sub-techniques
- AID-H-021.001: Client-Side Configuration Enforcement
- AID-H-021.002: Runtime Integrity Enforcement (Signed Configurations)
- AID-H-021.003: Agent Context Source & Configuration Governance
- AID-H-021.004: Control-Plane & Oversight-Surface Isolation
- AID-H-021.005: AI Coding-Agent Workspace Activation Trust Gate
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
- AML.T0011 User Execution
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0059 Erode Dataset Integrity
- AML.T0070 RAG Poisoning
- AML.T0071 False RAG Entry Injection
- AML.T0081 Modify AI Agent Configuration
- AML.T0083 Credentials from AI Agent Configuration
- AML.T0084 Discover AI Agent Configuration
- AML.T0089 Enterprise Environment Discovery
- AML.T0095.000 Search Open Websites/Domains: Code Repositories
- AML.T0099 AI Agent Tool Data Poisoning
- AML.T0121 AI Agent Environment Reconstruction
MAESTRO
- Data Tampering (L2)
- Compromised RAG Pipelines (L2)
- Evasion of Security AI Agents (L6)
- Compromised Agents (L7)
- Agent Goal Manipulation (L7)
- Integration Risks (L7)
- Supply Chain Attacks (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM03:2026 Excessive Agency
- LLM05:2026 Data and Model Poisoning
- LLM07:2026 Misinformation
OWASP ML Top 10 2023
- ML06:2023 AI Supply Chain Attacks
OWASP Top 10 for Agentic Applications 2026
- ASI03:2026 Identity and Privilege Abuse
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI05:2026 Unexpected Code Execution (RCE)
- ASI06:2026 Memory & Context Poisoning
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-2.1 Excessive Agency
- AITech-2.2 Goal Drift
- AITech-2.3 Reward Hacking
- AITech-5.2 Configuration Persistence
- AITech-7.3 Data Source Abuse and Manipulation
- AITech-8.3 Information Disclosure
- AITech-9.3 Dependency / Plugin Compromise
- AITech-11.1 Environment-Aware Evasion
- AITech-12.1 Tool Exploitation
- AITech-14.1 Unauthorized Access
- AISubtech-2.1.1 Execution Approval Bypass
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-2.2.3 Authorization and Constraint Erosion
- AISubtech-2.3.2 Verifier Manipulation
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-6.1.1 Knowledge Base Poisoning
- AISubtech-8.3.2 System Information Exposure
- AISubtech-9.1.2 Unauthorized or Unsolicited System Access
- AISubtech-9.3.1 Malicious Package / Tool Injection
- AISubtech-9.3.3 Dependency Replacement / Rug Pull
- AISubtech-11.1.4 Defense-Aware Payloads
- AISubtech-12.1.2 Tool Poisoning
- AISubtech-12.1.3 Unsafe System / Browser / File Execution
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- MDT: Model Deployment Tampering
- IIC: Insecure Integrated Component
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Raw Data 1.7: Lack of data trustworthiness
- Raw Data 1.11: Compromised 3rd-party datasets
- Model 7.3: ML Supply chain vulnerabilities
- Model 7.4: Source code control attack
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.11: Unexpected RCE and Code Attacks
- Agents - Core 13.13: Rogue Agents in Multi-Agent Systems
- Agents - Tools MCP Server 13.18: Tool Poisoning
- Agents - Tools MCP Server 13.20: Insecure Server Configuration
- Agents - Tools MCP Server 13.21: Supply Chain Attacks
- Agents - Tools MCP Client 13.27: Insecure Credential Storage