Skip to main content

Red Team Attack Library

The 64 built-in objectives used by Agentic Red Teaming and Model Red Teaming. The library is the same for both.

At a glance​

Count
Objectives64
In a Quick scan8 (marked ✓ below)
Critical / High / Medium / Low12 / 30 / 19 / 3

Each objective has an OWASP category, a MITRE ATLAS technique, and a default severity. On top of the library, every run adds:

  • Tool-targeted objectives synthesized live for the target after recon (6 in the example runs in Reading Red Team Results).
  • Any custom objectives you add, reported under a Custom category.

Quick scan objectives​

ObjectiveCategoryATLAS techniqueSeverity
System Prompt ExtractionLLM07AML.T0056High
Multilingual Guardrail BypassLLM01AML.T0054High
Tool / Capability EnumerationASI02AML.T0084.001Medium
Scope Hijack / Off-Topic MisuseASI01AML.T0051Low
Authentication / Login BypassASI03AML.T0053Critical
SQL Injection via Tool ArgumentsLLM05AML.T0053Critical
OS / Command Execution AttemptASI05AML.T0102Critical
PII / Cross-User Data ExfiltrationLLM02AML.T0057High

Full library​

LLM07: System Prompt Leakage​

ObjectiveATLAS techniqueSeverityQuick scan
System Prompt ExtractionAML.T0056 Extract LLM System PromptHigh✓
Model / Provenance DisclosureAML.T0056 Extract LLM System PromptMedium

LLM01: Prompt Injection​

ObjectiveATLAS techniqueSeverityQuick scan
Multilingual Guardrail BypassAML.T0054 LLM JailbreakHigh✓
Direct Prompt Injection / Instruction OverrideAML.T0051.000 LLM Prompt Injection: DirectHigh
Persona Jailbreak (DAN-style)AML.T0054 LLM JailbreakHigh
Multi-Turn Gradual Escalation (Crescendo)AML.T0054 LLM JailbreakHigh
Encoding / Obfuscation BypassAML.T0068 LLM Prompt ObfuscationMedium
Refusal Consistency Under PressureAML.T0054 LLM JailbreakMedium
Image-Embedded Prompt Injection (Multimodal)AML.T0051.001 LLM Prompt Injection: IndirectMedium
Image Metadata Prompt Injection (Multimodal)AML.T0051.001 LLM Prompt Injection: IndirectMedium
Audio-Embedded Prompt Injection (Multimodal)AML.T0051.000 LLM Prompt Injection: DirectMedium
Indirect Prompt Injection (poisoned content)AML.T0051.001 LLM Prompt Injection: IndirectHigh
Many-shot JailbreakAML.T0054 LLM JailbreakHigh
Crescendo Multi-turn JailbreakAML.T0054 LLM JailbreakHigh
Policy Puppetry / Fake System DirectiveAML.T0051.000 LLM Prompt Injection: DirectHigh
Encoded / Ciphered Payload SmugglingAML.T0054 LLM JailbreakMedium
Low-resource Language JailbreakAML.T0054 LLM JailbreakMedium
Hypothetical / Fiction FramingAML.T0054 LLM JailbreakMedium
Reverse Psychology / Refusal ReframeAML.T0054 LLM JailbreakLow
Context Overflow to Evict GuardrailsAML.T0051.000 LLM Prompt Injection: DirectMedium
Spoken Instruction OverrideAML.T0051.000 LLM Prompt Injection: DirectHigh

ASI02: Tool Misuse & Exploitation​

ObjectiveATLAS techniqueSeverityQuick scan
Tool / Capability EnumerationAML.T0084.001 Discover AI Agent Configuration: Tool DefinitionsMedium✓
Privilege-Flag Tampering (Confused Deputy)AML.T0053 AI Agent Tool InvocationHigh
Tool Argument AbuseAML.T0053 AI Agent Tool InvocationHigh
SSRF / Tool RepurposingAML.T0053 AI Agent Tool InvocationHigh
Tool-Chaining ExfiltrationAML.T0086 Exfiltration via AI Agent Tool InvocationHigh
Business-Logic Abuse (Price / Discount)AML.T0053 AI Agent Tool InvocationHigh
RAG Document ExfiltrationAML.T0085.000 Data from AI Services: RAG DatabasesHigh
Multi-agent / Delegation ManipulationAML.T0053 AI Agent Tool InvocationHigh
Path Traversal via Tool ArgumentsAML.T0053 AI Agent Tool InvocationHigh
Tool Parameter Pollution / OverrideAML.T0053 AI Agent Tool InvocationMedium
Callback / Contact Detail TakeoverAML.T0053 LLM Plugin CompromiseCritical

ASI01: Agent Goal Hijack​

ObjectiveATLAS techniqueSeverityQuick scan
Scope Hijack / Off-Topic MisuseAML.T0051 LLM Prompt InjectionLow✓
Indirect / Tool-Result InjectionAML.T0051.001 LLM Prompt Injection: IndirectHigh
Malicious Document Injection (Multimodal)AML.T0066 Retrieval Content CraftingHigh
Agent Goal HijackAML.T0051.000 LLM Prompt Injection: DirectHigh
Transfer / Escalation AbuseAML.T0051 LLM Prompt InjectionMedium

The library labels the last two "ASI01: Agent Goal Manipulation" and "ASI01: Agent Goal & Instruction Manipulation"; they map to the same OWASP Agentic ASI01 risk.

ASI03: Identity & Privilege Abuse​

ObjectiveATLAS techniqueSeverityQuick scan
Authentication / Login BypassAML.T0053 AI Agent Tool InvocationCritical✓
OTP Guess / Validation BypassAML.T0053 AI Agent Tool InvocationCritical
Privilege EscalationAML.T0053 AI Agent Tool InvocationCritical
Cross-User Data Access (BOLA)AML.T0085.001 Data from AI Services: AI Agent ToolsCritical
Privileged Function Access (BFLA)AML.T0053 AI Agent Tool InvocationCritical

LLM05: Improper Output Handling​

ObjectiveATLAS techniqueSeverityQuick scan
SQL Injection via Tool ArgumentsAML.T0053 AI Agent Tool InvocationCritical✓
Harmful Content Generation (refusal test)AML.T0054 LLM JailbreakHigh
Dangerous Capability Uplift (CBRN/weapons refusal)AML.T0054 LLM JailbreakCritical
Insecure / Backdoored Code GenerationAML.T0048 External HarmsHigh
Output Injection (XSS / Markdown / HTML)AML.T0048 External HarmsMedium

ASI05: Unexpected Code Execution​

ObjectiveATLAS techniqueSeverityQuick scan
OS / Command Execution AttemptAML.T0102 Generate Malicious CommandsCritical✓

LLM02: Sensitive Information Disclosure​

ObjectiveATLAS techniqueSeverityQuick scan
PII / Cross-User Data ExfiltrationAML.T0057 LLM Data LeakageHigh✓
Internal Config / Secret LeakageAML.T0083 Credentials from AI Agent ConfigurationHigh
Salary / Compensation ExtractionAML.T0057 LLM Data LeakageHigh
Sensitive Data Read AloudAML.T0057 LLM Data LeakageHigh

ASI06: Memory & Context Poisoning​

ObjectiveATLAS techniqueSeverityQuick scan
Memory / Context PoisoningAML.T0080.000 AI Agent Context Poisoning: MemoryHigh

LLM06: Excessive Agency​

ObjectiveATLAS techniqueSeverityQuick scan
Excessive Agency (Destructive Action)AML.T0101 Data Destruction via AI Agent Tool InvocationCritical
Unauthorized Financial ActionAML.T0053 AI Agent Tool InvocationCritical
Caller Verification BypassAML.T0051 LLM Prompt InjectionCritical

LLM10: Unbounded Consumption​

ObjectiveATLAS techniqueSeverityQuick scan
Rate-Limit / Denial-of-Wallet ProbeAML.T0034.002 Cost Harvesting: Agentic Resource ConsumptionMedium
Denial of Wallet / Unbounded ConsumptionAML.T0034 Cost HarvestingMedium

LLM08: Vector and Embedding Weaknesses​

ObjectiveATLAS techniqueSeverityQuick scan
RAG Knowledge-Base PoisoningAML.T0070 RAG PoisoningHigh
Embedding / Vector Store InversionAML.T0057 LLM Data LeakageHigh

LLM09: Misinformation​

ObjectiveATLAS techniqueSeverityQuick scan
Misinformation / Persuasive FalsehoodAML.T0048 External HarmsMedium
Fabricated Facts & Citations (overreliance)AML.T0048 External HarmsLow
AI Disclosure EvasionAML.T0048 Societal HarmMedium

LLM04: Data and Model Poisoning​

ObjectiveATLAS techniqueSeverityQuick scan
Feedback-loop Data PoisoningAML.T0020 Poison Training DataMedium

Coverage notes​

  • OWASP Top 10 for LLM Applications (2025): LLM01, LLM02, LLM04, LLM05, LLM06, LLM07, LLM08, LLM09, LLM10. No library objective targets LLM03.
  • OWASP Top 10 for Agentic Applications: ASI01, ASI02, ASI03, ASI05, ASI06.
  • Multimodal and voice objectives (image, audio, document, spoken) target those channels. The report's Capabilities exercised panel shows which channels a run actually exercised; a text-only run reads "text-only target - enable multimodal objectives to exercise vision / audio / document channels".
  • A full-library run can complete fewer than 64 library objectives. Check the Objectives run tile on the report for the actual count; the model run in Reading Red Team Results completed 60.

On this page