Scope boundary

Owns isolation of AI models, agents, and tools inside bounded execution environments with constrained resources, permissions, filesystems, and network access. It confines a compromised runtime; it does not sanitize web content, isolate browser-managed task state, or confine an embedded client-side model inside the user's application runtime.

AID-I-007: AID-I-001 isolates server-side or managed AI execution environments; AID-I-007 confines a client-side model or model runtime inside a browser, Electron shell, hybrid app, or mobile application. Use AID-I-007 for component-level Web Worker, iframe, WASM, CSP, and native-bridge boundaries inside the client application, not as a substitute for the enclosing managed sandbox family.

AID-I-008: AID-I-001 isolates execution processes and tool runtimes; AID-I-008 isolates browser-managed and desktop-workspace state per task or trust zone. A process sandbox does not by itself rotate cookies, browser storage, downloads, clipboard, history, desktop profiles, or authenticated computer-use state.

AID-H-018.009: AID-I-001 contains a process, container, microVM, WASM, or other workload boundary; AID-H-018.009 confines the particular filesystem object that a model-influenced path may open or affect, including in-process tools. Isolation and opened-object confinement remain independently applicable and neither PASS substitutes for the other.

AID-H-021.005: AID-I-001 contains execution after an AI development client starts a task, tool, extension, server, or other workload; AID-H-021.005 decides whether the exact repository-controlled activation manifest may leave restricted mode in the first place. A sandbox does not approve workspace activation, and a trusted activation manifest does not prove runtime containment.

Sub-techniques

• AID-I-001.001: Container-Based Isolation
• AID-I-001.002: MicroVM & Low-Level Sandboxing
• AID-I-001.003: Ephemeral Single-Use Sandboxes for Tools
• AID-I-001.004: Sandbox Network Egress Restrictions
• AID-I-001.005: Safe Ephemeral Detonation & Attested Raw Observation Reporting

Threat mappings

MITRE ATLAS

• AML.T0011 User Execution
• AML.T0011.000 User Execution: Unsafe AI Artifacts
• AML.T0011.002 User Execution: Poisoned AI Agent Tool
• AML.T0018 Manipulate AI Model
• AML.T0018.002 Manipulate AI Model: Embed Malware
• AML.T0025 Exfiltration via Cyber Means
• AML.T0029 Denial of AI Service
• AML.T0034 Cost Harvesting
• AML.T0050 Command and Scripting Interpreter
• AML.T0053 AI Agent Tool Invocation
• AML.T0072 Cyber Communication Channel
• AML.T0089 Enterprise Environment Discovery
• AML.T0097 Virtualization/Sandbox Evasion
• AML.T0105 Escape to Host
• AML.T0106 Exploitation for Credential Access
• AML.T0108 AI Agent
• AML.T0110 AI Agent Tool Poisoning
• AML.T0110.001 AI Agent Tool Poisoning: Implementation
• AML.T0114 AI Service Web Interface
• AML.T0115 Publish Poisoned AI Artifacts
• AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
• AML.T0119 Exploit Automated Artifact Processing Pipeline
• AML.T0120 AI Artifact Repository
• AML.T0122 Exploitation of Remote Services

MAESTRO

• Compromised Container Images (L4)
• Resource Hijacking (L4)
• Lateral Movement (L4)
• Agent Tool Misuse (L7)
• Lateral Movement (Cross-Layer)
• Privilege Escalation (Cross-Layer)
• Data Leakage (Cross-Layer)

OWASP LLM Top 10 2026

• LLM01:2026 Prompt Injection
• LLM02:2026 Sensitive Information Disclosure
• LLM03:2026 Excessive Agency
• LLM04:2026 Supply Chain
• LLM05:2026 Data and Model Poisoning
• LLM06:2026 Unbounded Consumption
• LLM10:2026 Improper Output Handling

OWASP ML Top 10 2023

• ML05:2023 Model Theft
• ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

• ASI02:2026 Tool Misuse and Exploitation
• ASI04:2026 Agentic Supply Chain Vulnerabilities
• ASI05:2026 Unexpected Code Execution (RCE)
• ASI10:2026 Rogue Agents

NIST Adversarial Machine Learning 2025

• NISTAML.039 Compromising connected resources

Cisco Integrated AI Security and Safety Framework

• AITech-8.2 Data Exfiltration / Exposure
• AITech-9.1 Model or Agentic System Manipulation
• AITech-9.2 Detection Evasion
• AITech-9.3 Dependency / Plugin Compromise
• AITech-12.1 Tool Exploitation
• AITech-12.2 Insecure Output Handling
• AITech-13.1 Disruption of Availability
• AITech-13.2 Cost Harvesting / Repurposing
• AITech-14.1 Unauthorized Access
• AISubtech-8.2.3 Data Exfiltration via Agent Tooling
• AISubtech-9.1.1 Code Execution
• AISubtech-9.1.2 Unauthorized or Unsolicited System Access
• AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
• AISubtech-9.3.1 Malicious Package / Tool Injection
• AISubtech-12.1.3 Unsafe System / Browser / File Execution
• AISubtech-12.2.1 Code Detection / Malicious Code Output
• AISubtech-13.1.1 Compute Exhaustion
• AISubtech-13.1.2 Memory Flooding
• AISubtech-13.1.3 Model Denial of Service
• AISubtech-13.1.4 Application Denial of Service
• AISubtech-13.2.1 Service Misuse for Cost Inflation
• AISubtech-14.1.2 Insufficient Access Controls

Google Secure AI Framework 2.0 - Risks

• MXF: Model Exfiltration
• DMS: Denial of ML Service
• IIC: Insecure Integrated Component
• RA: Rogue Actions

Databricks AI Security Framework 3.0

• Algorithms 5.4: Malicious libraries
• Model 7.2: Model assets leak
• Model Serving - Inference requests 9.3: Model breakout
• Model Serving - Inference requests 9.7: Denial of Service (DoS)
• Platform 12.4: Unauthorized privileged access
• Agents - Core 13.2: Tool Misuse
• Agents - Core 13.4: Resource Overload
• Agents - Core 13.11: Unexpected RCE and Code Attacks
• Agents - Tools MCP Server 13.23: Data Exfiltration