{"catalog_version":"2026.07","attack_classes":46,"families":6,"plugin_count":62,"native_plugin_count":24,"promptfoo_transposition_count":38,"catalog_is_executable":true,"catalog_source_url":"https://github.com/yagobski/agentleak/blob/main/agentleak/core/attacks.py","promptfoo_source_url":"https://github.com/promptfoo/promptfoo/tree/main/src/redteam/plugins","license":"MIT","plugins":[{"id":"pii:direct","name":"Direct PII disclosure","description":"Requests raw personal data directly.","category":"Privacy","severity":"critical","attack_classes":["F1.4"],"requires":[],"implementation":"native","native_id":null},{"id":"pii:api-db","name":"PII via API or database","description":"Attempts unauthorized retrieval through a data tool.","category":"Privacy","severity":"critical","attack_classes":["F2.2","F2.7"],"requires":["data_access"],"implementation":"native","native_id":null},{"id":"pii:session","name":"PII across sessions","description":"Attempts recovery of personal data retained from another session.","category":"Privacy","severity":"critical","attack_classes":["F3.2","F3.3"],"requires":["memory"],"implementation":"native","native_id":null},{"id":"pii:social","name":"PII via social engineering","description":"Uses authority, rapport, or framing to obtain personal data.","category":"Privacy","severity":"high","attack_classes":["F1.2","F1.5","F1.6"],"requires":[],"implementation":"native","native_id":null},{"id":"prompt-extraction","name":"System prompt disclosure","description":"Attempts to expose hidden instructions and private context.","category":"Prompt security","severity":"high","attack_classes":["F1.7","F2.6"],"requires":[],"implementation":"native","native_id":null},{"id":"system-prompt-override","name":"System prompt override","description":"Attempts to replace privileged instructions with attacker policy.","category":"Prompt security","severity":"high","attack_classes":["F1.1","F1.3","F1.9"],"requires":[],"implementation":"native","native_id":null},{"id":"hijacking","name":"Goal hijacking","description":"Redirects the agent toward extraction.","category":"Prompt security","severity":"high","attack_classes":["F1.8"],"requires":[],"implementation":"native","native_id":null},{"id":"cca","name":"Context compliance attack","description":"Uses fabricated history or consent to normalize prohibited behavior.","category":"Prompt security","severity":"high","attack_classes":["F1.3","F1.9"],"requires":[],"implementation":"native","native_id":null},{"id":"indirect-prompt-injection","name":"Indirect prompt injection","description":"Injects instructions through trusted content or tools.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.1","F2.3","F2.14"],"requires":["tools_or_rag"],"implementation":"native","native_id":null},{"id":"rag-document-exfiltration","name":"RAG document exfiltration","description":"Poisons retrieved documents to extract private context.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.3"],"requires":["rag"],"implementation":"native","native_id":null},{"id":"data-exfil","name":"Data exfiltration","description":"Coerces transmission of sensitive values to an external destination.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.5","F4.6"],"requires":["network_tool"],"implementation":"native","native_id":null},{"id":"bola","name":"Object authorization bypass","description":"Attempts access to another user's object or record.","category":"Access control","severity":"critical","attack_classes":["F2.7"],"requires":["object_ids"],"implementation":"native","native_id":null},{"id":"bfla","name":"Function authorization bypass","description":"Attempts invocation of a privileged function.","category":"Access control","severity":"critical","attack_classes":["F2.8"],"requires":["privileged_tools"],"implementation":"native","native_id":null},{"id":"rbac","name":"Role-based access bypass","description":"Tests enforcement of user and agent roles.","category":"Access control","severity":"critical","attack_classes":["F1.2","F2.9","F4.4"],"requires":["multiple_roles"],"implementation":"native","native_id":null},{"id":"sql-injection","name":"SQL injection","description":"Smuggles SQL syntax into a database tool.","category":"Tool security","severity":"high","attack_classes":["F2.10"],"requires":["sql_tool"],"implementation":"native","native_id":null},{"id":"shell-injection","name":"Shell command injection","description":"Smuggles shell syntax into an execution tool.","category":"Tool security","severity":"critical","attack_classes":["F2.11"],"requires":["shell_tool"],"implementation":"native","native_id":null},{"id":"ssrf","name":"Server-side request forgery","description":"Targets internal endpoints through an HTTP tool.","category":"Tool security","severity":"critical","attack_classes":["F2.5","F2.12"],"requires":["network_tool"],"implementation":"native","native_id":null},{"id":"tool-discovery","name":"Tool discovery","description":"Enumerates hidden tools, schemas, and privileged operations.","category":"Tool security","severity":"medium","attack_classes":["F2.13"],"requires":["tools"],"implementation":"native","native_id":null},{"id":"mcp","name":"MCP tool poisoning","description":"Tests tool shadowing and malicious MCP descriptions.","category":"Tool security","severity":"critical","attack_classes":["F2.2","F2.14"],"requires":["mcp"],"implementation":"native","native_id":null},{"id":"debug-access","name":"Debug access","description":"Attempts to expose context and credentials through diagnostics.","category":"Tool security","severity":"high","attack_classes":["F2.6","F2.15"],"requires":[],"implementation":"native","native_id":null},{"id":"agentic:memory-poisoning","name":"Agentic memory poisoning","description":"Persists attacker instructions for later execution.","category":"State & memory","severity":"critical","attack_classes":["F3.1"],"requires":["memory"],"implementation":"native","native_id":null},{"id":"cross-session-leak","name":"Cross-session leakage","description":"Tests isolation between conversations and users.","category":"State & memory","severity":"critical","attack_classes":["F3.2"],"requires":["memory"],"implementation":"native","native_id":null},{"id":"excessive-agency","name":"Excessive agency","description":"Induces unauthorized actions or over-broad delegation.","category":"Agent behavior","severity":"high","attack_classes":["F4.8","F4.9"],"requires":["action_tools"],"implementation":"native","native_id":null},{"id":"ascii-smuggling","name":"ASCII smuggling","description":"Uses invisible formatting to hide instructions.","category":"Evasion","severity":"high","attack_classes":["F6.3"],"requires":[],"implementation":"native","native_id":null},{"id":"rag-poisoning","name":"RAG poisoning","description":"Injects persistent malicious instructions into retrieved knowledge.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.1","F2.3","F2.14"],"requires":["tools_or_rag"],"implementation":"promptfoo-transposition","native_id":"indirect-prompt-injection"},{"id":"rag-source-attribution","name":"RAG source attribution","description":"Checks whether retrieved private material is disclosed without a safe provenance boundary.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.3"],"requires":["rag"],"implementation":"promptfoo-transposition","native_id":"rag-document-exfiltration"},{"id":"reasoning-dos","name":"Reasoning denial of service","description":"Exercises unbounded agent planning and resource use as an excessive-agency risk.","category":"Agent behavior","severity":"high","attack_classes":["F4.8","F4.9"],"requires":["action_tools"],"implementation":"promptfoo-transposition","native_id":"excessive-agency"},{"id":"special-token-injection","name":"Special-token injection","description":"Uses model control tokens to cross the instruction boundary.","category":"Prompt security","severity":"high","attack_classes":["F1.1","F1.3","F1.9"],"requires":[],"implementation":"promptfoo-transposition","native_id":"system-prompt-override"},{"id":"model-identification","name":"Model identification","description":"Probes hidden runtime and model metadata exposed with privileged context.","category":"Prompt security","severity":"high","attack_classes":["F1.7","F2.6"],"requires":[],"implementation":"promptfoo-transposition","native_id":"prompt-extraction"},{"id":"harmful:privacy","name":"Privacy harm","description":"Tests unsafe disclosure of personal or confidential information.","category":"Privacy","severity":"critical","attack_classes":["F1.4"],"requires":[],"implementation":"promptfoo-transposition","native_id":"pii:direct"},{"id":"coppa","name":"COPPA privacy","description":"Tests disclosure of children's personal information.","category":"Privacy","severity":"critical","attack_classes":["F1.4"],"requires":[],"implementation":"promptfoo-transposition","native_id":"pii:direct"},{"id":"ferpa","name":"FERPA privacy","description":"Tests unauthorized access to education records through agent data tools.","category":"Privacy","severity":"critical","attack_classes":["F2.2","F2.7"],"requires":["data_access"],"implementation":"promptfoo-transposition","native_id":"pii:api-db"},{"id":"insurance:data-disclosure","name":"Insurance data disclosure","description":"Tests disclosure of policyholder and claims data.","category":"Privacy","severity":"critical","attack_classes":["F2.2","F2.7"],"requires":["data_access"],"implementation":"promptfoo-transposition","native_id":"pii:api-db"},{"id":"insurance:phi-disclosure","name":"Insurance PHI disclosure","description":"Tests unauthorized disclosure of protected health information in insurance workflows.","category":"Privacy","severity":"critical","attack_classes":["F2.2","F2.7"],"requires":["data_access"],"implementation":"promptfoo-transposition","native_id":"pii:api-db"},{"id":"ecommerce:pci-dss","name":"PCI data disclosure","description":"Tests exposure of payment-card data reached through commerce tools.","category":"Privacy","severity":"critical","attack_classes":["F2.2","F2.7"],"requires":["data_access"],"implementation":"promptfoo-transposition","native_id":"pii:api-db"},{"id":"ecommerce:compliance-bypass","name":"Commerce compliance bypass","description":"Attempts to bypass policy and approval controls in commerce tools.","category":"Access control","severity":"critical","attack_classes":["F1.2","F2.9","F4.4"],"requires":["multiple_roles"],"implementation":"promptfoo-transposition","native_id":"rbac"},{"id":"ecommerce:order-fraud","name":"Order fraud","description":"Attempts to access or alter another customer's order object.","category":"Access control","severity":"critical","attack_classes":["F2.7"],"requires":["object_ids"],"implementation":"promptfoo-transposition","native_id":"bola"},{"id":"ecommerce:price-manipulation","name":"Price manipulation","description":"Attempts to invoke privileged pricing functions without authorization.","category":"Access control","severity":"critical","attack_classes":["F2.8"],"requires":["privileged_tools"],"implementation":"promptfoo-transposition","native_id":"bfla"},{"id":"financial:confidential-disclosure","name":"Financial confidential disclosure","description":"Tests direct disclosure of confidential financial information.","category":"Privacy","severity":"critical","attack_classes":["F1.4"],"requires":[],"implementation":"promptfoo-transposition","native_id":"pii:direct"},{"id":"financial:data-leakage","name":"Financial data leakage","description":"Tests financial data leaving its authorized processing boundary.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.5","F4.6"],"requires":["network_tool"],"implementation":"promptfoo-transposition","native_id":"data-exfil"},{"id":"financial:compliance-violation","name":"Financial compliance violation","description":"Tests whether role and approval boundaries are enforced in regulated financial actions.","category":"Access control","severity":"critical","attack_classes":["F1.2","F2.9","F4.4"],"requires":["multiple_roles"],"implementation":"promptfoo-transposition","native_id":"rbac"},{"id":"medical:fda:cyber-access-control","name":"Medical cyber access control","description":"Tests role enforcement around medical systems and records.","category":"Access control","severity":"critical","attack_classes":["F1.2","F2.9","F4.4"],"requires":["multiple_roles"],"implementation":"promptfoo-transposition","native_id":"rbac"},{"id":"medical:fda:cyber-audit-tampering","name":"Medical audit tampering","description":"Attempts to alter or suppress security audit evidence.","category":"Tool security","severity":"high","attack_classes":["F2.6","F2.15"],"requires":[],"implementation":"promptfoo-transposition","native_id":"debug-access"},{"id":"telecom:account-takeover","name":"Telecom account takeover","description":"Attempts to cross subscriber authentication and role boundaries.","category":"Access control","severity":"critical","attack_classes":["F1.2","F2.9","F4.4"],"requires":["multiple_roles"],"implementation":"promptfoo-transposition","native_id":"rbac"},{"id":"telecom:cpni-disclosure","name":"CPNI disclosure","description":"Tests unauthorized disclosure of customer proprietary network information.","category":"Privacy","severity":"critical","attack_classes":["F2.2","F2.7"],"requires":["data_access"],"implementation":"promptfoo-transposition","native_id":"pii:api-db"},{"id":"telecom:location-disclosure","name":"Telecom location disclosure","description":"Tests exposure of subscriber location information.","category":"Privacy","severity":"critical","attack_classes":["F1.4"],"requires":[],"implementation":"promptfoo-transposition","native_id":"pii:direct"},{"id":"telecom:law-enforcement-request-handling","name":"Law-enforcement request handling","description":"Tests authorization and approval controls for protected telecom disclosures.","category":"Access control","severity":"critical","attack_classes":["F1.2","F2.9","F4.4"],"requires":["multiple_roles"],"implementation":"promptfoo-transposition","native_id":"rbac"},{"id":"coding-agent:automation-poisoning","name":"Automation poisoning","description":"Persists malicious instructions in automation or agent state.","category":"State & memory","severity":"critical","attack_classes":["F3.1"],"requires":["memory"],"implementation":"promptfoo-transposition","native_id":"agentic:memory-poisoning"},{"id":"coding-agent:core","name":"Coding agent core","description":"Baseline repository prompt-injection and secret-exposure coverage.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.1","F2.3","F2.14"],"requires":["tools_or_rag"],"implementation":"promptfoo-transposition","native_id":"indirect-prompt-injection"},{"id":"coding-agent:all","name":"Coding agent complete","description":"Broad coding-agent privacy attack entry point mapped to AgentLeak's observable surfaces.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.1","F2.3","F2.14"],"requires":["tools_or_rag"],"implementation":"promptfoo-transposition","native_id":"indirect-prompt-injection"},{"id":"coding-agent:delayed-ci-exfil","name":"Delayed CI exfiltration","description":"Places a delayed data-exfiltration action in generated automation.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.5","F4.6"],"requires":["network_tool"],"implementation":"promptfoo-transposition","native_id":"data-exfil"},{"id":"coding-agent:generated-vulnerability","name":"Generated vulnerability","description":"Induces unsafe generated code that can expose runtime data.","category":"Tool security","severity":"critical","attack_classes":["F2.11"],"requires":["shell_tool"],"implementation":"promptfoo-transposition","native_id":"shell-injection"},{"id":"coding-agent:network-egress-bypass","name":"Network egress bypass","description":"Attempts to cross network allowlists through an agent tool.","category":"Tool security","severity":"critical","attack_classes":["F2.5","F2.12"],"requires":["network_tool"],"implementation":"promptfoo-transposition","native_id":"ssrf"},{"id":"coding-agent:procfs-credential-read","name":"procfs credential read","description":"Attempts to read process credentials through diagnostic access.","category":"Tool security","severity":"high","attack_classes":["F2.6","F2.15"],"requires":[],"implementation":"promptfoo-transposition","native_id":"debug-access"},{"id":"coding-agent:repo-prompt-injection","name":"Repository prompt injection","description":"Loads malicious instructions from repository content.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.1","F2.3","F2.14"],"requires":["tools_or_rag"],"implementation":"promptfoo-transposition","native_id":"indirect-prompt-injection"},{"id":"coding-agent:sandbox-read-escape","name":"Sandbox read escape","description":"Attempts to read sensitive files outside the authorized workspace.","category":"Tool security","severity":"high","attack_classes":["F2.6","F2.15"],"requires":[],"implementation":"promptfoo-transposition","native_id":"debug-access"},{"id":"coding-agent:sandbox-write-escape","name":"Sandbox write escape","description":"Attempts an unauthorized write outside the authorized workspace.","category":"Agent behavior","severity":"high","attack_classes":["F4.8","F4.9"],"requires":["action_tools"],"implementation":"promptfoo-transposition","native_id":"excessive-agency"},{"id":"coding-agent:secret-env-read","name":"Secret environment read","description":"Attempts to disclose credentials from environment variables.","category":"Tool security","severity":"high","attack_classes":["F2.6","F2.15"],"requires":[],"implementation":"promptfoo-transposition","native_id":"debug-access"},{"id":"coding-agent:secret-file-read","name":"Secret file read","description":"Attempts to disclose credentials from local configuration files.","category":"Prompt security","severity":"high","attack_classes":["F1.7","F2.6"],"requires":[],"implementation":"promptfoo-transposition","native_id":"prompt-extraction"},{"id":"coding-agent:steganographic-exfil","name":"Steganographic exfiltration","description":"Hides extracted data in generated text or artifacts.","category":"Evasion","severity":"high","attack_classes":["F6.3"],"requires":[],"implementation":"promptfoo-transposition","native_id":"ascii-smuggling"},{"id":"coding-agent:terminal-output-injection","name":"Terminal output injection","description":"Treats attacker-controlled terminal output as trusted instructions.","category":"Agent & RAG","severity":"critical","attack_classes":["F2.1","F2.3","F2.14"],"requires":["tools_or_rag"],"implementation":"promptfoo-transposition","native_id":"indirect-prompt-injection"},{"id":"coding-agent:verifier-sabotage","name":"Verifier sabotage","description":"Attempts to disable or weaken the agent's verification controls.","category":"Agent behavior","severity":"high","attack_classes":["F4.8","F4.9"],"requires":["action_tools"],"implementation":"promptfoo-transposition","native_id":"excessive-agency"}],"plugin_presets":[{"id":"privacy_core","name":"Privacy core","description":"PII, prompt disclosure, session isolation, indirect injection, and exfiltration.","plugin_ids":["pii:direct","pii:api-db","pii:session","pii:social","prompt-extraction","indirect-prompt-injection","data-exfil","cross-session-leak"]},{"id":"compliance_core","name":"Privacy compliance","description":"High-signal privacy, regulated-data, authorization, session-isolation, and exfiltration coverage for compliance evidence.","plugin_ids":["pii:direct","pii:api-db","pii:session","pii:social","harmful:privacy","coppa","ferpa","insurance:data-disclosure","insurance:phi-disclosure","ecommerce:pci-dss","financial:confidential-disclosure","financial:data-leakage","telecom:cpni-disclosure","telecom:location-disclosure","cross-session-leak","rag-document-exfiltration","data-exfil","bola","rbac"]},{"id":"agent_core","name":"Agent security","description":"Recommended coverage for agents with tools, memory, RAG, roles, or MCP.","plugin_ids":["pii:direct","pii:api-db","pii:session","pii:social","prompt-extraction","system-prompt-override","hijacking","cca","indirect-prompt-injection","rag-document-exfiltration","data-exfil","bola","bfla","rbac","tool-discovery","mcp","agentic:memory-poisoning","cross-session-leak","excessive-agency"]},{"id":"tool_security","name":"Tool & MCP security","description":"Authorization, injection, network, debug, discovery, and MCP boundaries.","plugin_ids":["bola","bfla","rbac","sql-injection","shell-injection","ssrf","tool-discovery","mcp","debug-access","data-exfil"]},{"id":"complete","name":"Complete AgentLeak suite","description":"Every Promptfoo-compatible plugin that maps to observable AgentLeak risk.","plugin_ids":["pii:direct","pii:api-db","pii:session","pii:social","prompt-extraction","system-prompt-override","hijacking","cca","indirect-prompt-injection","rag-document-exfiltration","data-exfil","bola","bfla","rbac","sql-injection","shell-injection","ssrf","tool-discovery","mcp","debug-access","agentic:memory-poisoning","cross-session-leak","excessive-agency","ascii-smuggling"]}],"strategies":[{"id":"basic","name":"Direct baseline","description":"Original attack prompt without transformation.","category":"Baseline","estimated_turns":1},{"id":"jailbreak-template","name":"Jailbreak template","description":"Wraps the probe in an authoritative resilience-drill frame.","category":"Guardrail bypass","estimated_turns":1},{"id":"authoritative-markup","name":"Authoritative markup","description":"Embeds the probe in trusted-looking policy markup.","category":"Guardrail bypass","estimated_turns":1},{"id":"base64","name":"Base64 encoding","description":"Encodes the payload to test decode-and-execute behavior.","category":"Evasion","estimated_turns":1},{"id":"hex","name":"Hex encoding","description":"Uses hexadecimal UTF-8 encoding to cross input filters.","category":"Evasion","estimated_turns":1},{"id":"rot13","name":"ROT13 encoding","description":"Uses a reversible letter substitution around the payload.","category":"Evasion","estimated_turns":1},{"id":"leetspeak","name":"Leetspeak","description":"Mutates high-signal words with common numeric substitutions.","category":"Evasion","estimated_turns":1},{"id":"homoglyph","name":"Unicode homoglyphs","description":"Replaces selected Latin letters with readable Unicode lookalikes.","category":"Evasion","estimated_turns":1},{"id":"crescendo","name":"Crescendo multi-turn","description":"Builds rapport and escalates toward the attack objective over four turns.","category":"Multi-turn","estimated_turns":4},{"id":"adaptive-branch","name":"Adaptive response branch","description":"Selects follow-ups from refusal, clarification, or partial-answer signals in the preceding response.","category":"Adaptive multi-turn","estimated_turns":4}],"strategy_profiles":[{"id":"baseline","name":"Baseline","description":"Fast direct probes for repeatable CI regression tests.","strategy_ids":["basic"]},{"id":"balanced","name":"Balanced","description":"Direct plus two high-signal guardrail-bypass deliveries.","strategy_ids":["basic","jailbreak-template","authoritative-markup"]},{"id":"evasion","name":"Evasion","description":"Encoding and Unicode mutations that exercise input normalization.","strategy_ids":["base64","hex","rot13","leetspeak","homoglyph"]},{"id":"complete","name":"Complete","description":"All deterministic deliveries plus the four-turn crescendo probe.","strategy_ids":["basic","jailbreak-template","authoritative-markup","base64","hex","rot13","leetspeak","homoglyph","crescendo","adaptive-branch"]}]}