Scope boundary

Owns reversible response-time containment after a detection, policy, health, trust-state, or budget signal crosses a containment threshold. It translates existing findings into bounded quarantine, degradation, rate limiting, budget throttling, or per-action enforcement; it does not compute the signal or perform durable eviction.

AID-E-002: AID-I-003 applies reversible quarantine, safe mode, throttling, or action containment; AID-E-002 revokes execution leases and terminates confirmed-compromised runtime processes, jobs, pods, and containers. Use this family for bounded containment while investigation or recovery proceeds, and E-002 when the incident decision requires authoritative live-execution eviction.

AID-I-005: AID-I-003 contains a scoped identity, session, tenant, agent, budget, or action; AID-I-005 applies a last-resort system-wide or tenant-wide halt or severe restriction. A local quarantine or throttle is not proof that the emergency halt propagated across every required execution boundary.

AID-E-001: AID-I-003 applies reversible quarantine, safe-mode downgrade, or throttling while investigation and recovery proceed; AID-E-001 authoritatively revokes compromised credentials, sessions, principals, issuance paths, and delegated grants after an incident decision. A quarantine receipt cannot prove durable identity-plane eviction, and revocation does not replace bounded containment of the affected workload or action.

Sub-techniques

• AID-I-003.001: Detection-Driven Quarantine & Safe-Mode Downgrade
• AID-I-003.002: Identity, Session & API Rate-Limit Throttling
• AID-I-003.003: Resource, Token & Spend Budget Throttling
• AID-I-003.004: High-Risk Agent Action Containment

Threat mappings

MITRE ATLAS

• AML.T0024.002 Exfiltration via AI Inference API: Extract AI Model
• AML.T0029 Denial of AI Service
• AML.T0034 Cost Harvesting
• AML.T0034.000 Cost Harvesting: Excessive Queries
• AML.T0034.001 Cost Harvesting: Resource-Intensive Queries
• AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
• AML.T0040 AI Model Inference API Access
• AML.T0046 Spamming AI System with Chaff Data
• AML.T0053 AI Agent Tool Invocation
• AML.T0086 Exfiltration via AI Agent Tool Invocation
• AML.T0096 AI Service API
• AML.T0101 Data Destruction via AI Agent Tool Invocation
• AML.T0126 Automated Collection

MAESTRO

• Model Stealing (L1)
• Denial of Service on Data Infrastructure (L2)
• Denial of Service on Framework APIs (L3)
• Denial of Service (DoS) Attacks (L4)
• Resource Hijacking (L4)
• Model Extraction of AI Security Agents (L6)
• Compromised Agents (L7)
• Agent Tool Misuse (L7)
• Agent Pricing Model Manipulation (L7)

OWASP LLM Top 10 2026

• LLM02:2026 Sensitive Information Disclosure
• LLM03:2026 Excessive Agency
• LLM06:2026 Unbounded Consumption
• LLM07:2026 Misinformation

OWASP ML Top 10 2023

• ML05:2023 Model Theft

OWASP Top 10 for Agentic Applications 2026

• ASI02:2026 Tool Misuse and Exploitation
• ASI03:2026 Identity and Privilege Abuse
• ASI08:2026 Cascading Failures
• ASI10:2026 Rogue Agents

NIST Adversarial Machine Learning 2025

• NISTAML.014 Energy-latency
• NISTAML.031 Model Extraction
• NISTAML.039 Compromising connected resources

Cisco Integrated AI Security and Safety Framework

• AITech-2.1 Excessive Agency
• AITech-9.1 Model or Agentic System Manipulation
• AITech-12.1 Tool Exploitation
• AITech-13.1 Disruption of Availability
• AITech-13.2 Cost Harvesting / Repurposing
• AISubtech-2.1.1 Execution Approval Bypass
• AISubtech-4.3.4 Replay Exploitation
• AISubtech-9.1.2 Unauthorized or Unsolicited System Access
• AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
• AISubtech-13.1.1 Compute Exhaustion
• AISubtech-13.1.2 Memory Flooding
• AISubtech-13.1.3 Model Denial of Service
• AISubtech-13.1.4 Application Denial of Service
• AISubtech-13.2.1 Service Misuse for Cost Inflation
• AISubtech-14.1.2 Insufficient Access Controls
• AISubtech-18.2.1 Abuse of APIs for Mass Automation

Google Secure AI Framework 2.0 - Risks

• MXF: Model Exfiltration
• DMS: Denial of ML Service
• MRE: Model Reverse Engineering
• RA: Rogue Actions

Databricks AI Security Framework 3.0

• Model Management 8.2: Model theft
• Model Serving - Inference requests 9.7: Denial of Service (DoS)
• Model Serving - Inference response 10.5: Black-box attacks
• Agents - Core 13.2: Tool Misuse
• Agents - Core 13.3: Privilege Compromise
• Agents - Core 13.4: Resource Overload
• Agents - Core 13.13: Rogue Agents in Multi-Agent Systems