Skip to main content

Attack library

The built-in attack objectives that Red Teaming runs against AI apps and agents, AI workflows, and models, grouped by OWASP category.

At a glance​

Count
Objectives73
In a Quick scan8
Critical / High / Medium / Low12 / 35 / 23 / 3

Each objective has an OWASP category, a MITRE ATLAS technique, and a default severity. The default guides, but does not fix, the severity of a finding. See Risk grade and severity. On top of the library, every run also adds:

  • Tool-targeted objectives generated live for the target, after Quilr studies it. These appear as Synthesized in reports.
  • Any custom objectives you add, reported under a Custom category.
note

The library grows as Quilr adds new techniques. The Full library list below shows 64 of the 73 objectives; the Attack library panel on the Coverage step always shows every current objective.

Quick scan objectives​

A Quick scan runs these 8 core objectives, one from each of the most common risk areas.

ObjectiveCategoryATLAS techniqueSeverity
System Prompt ExtractionLLM07AML.T0056High
Multilingual Guardrail BypassLLM01AML.T0054High
Tool / Capability EnumerationASI02AML.T0084.001Medium
Scope Hijack / Off-Topic MisuseASI01AML.T0051Low
Authentication / Login BypassASI03AML.T0053Critical
SQL Injection via Tool ArgumentsLLM05AML.T0053Critical
OS / Command Execution AttemptASI05AML.T0102Critical
PII / Cross-User Data ExfiltrationLLM02AML.T0057High

Full library​

A Full library run includes every objective below. Objectives marked ✓ are also in the Quick scan.

LLM07: System Prompt Leakage​

ObjectiveATLAS techniqueSeverityQuick scan
System Prompt ExtractionAML.T0056 Extract LLM System PromptHigh✓
Model / Provenance DisclosureAML.T0056 Extract LLM System PromptMedium

LLM01: Prompt Injection​

ObjectiveATLAS techniqueSeverityQuick scan
Multilingual Guardrail BypassAML.T0054 LLM JailbreakHigh✓
Direct Prompt Injection / Instruction OverrideAML.T0051.000 LLM Prompt Injection: DirectHigh
Persona Jailbreak (DAN-style)AML.T0054 LLM JailbreakHigh
Multi-Turn Gradual Escalation (Crescendo)AML.T0054 LLM JailbreakHigh
Encoding / Obfuscation BypassAML.T0068 LLM Prompt ObfuscationMedium
Refusal Consistency Under PressureAML.T0054 LLM JailbreakMedium
Image-Embedded Prompt Injection (Multimodal)AML.T0051.001 LLM Prompt Injection: IndirectMedium
Image Metadata Prompt Injection (Multimodal)AML.T0051.001 LLM Prompt Injection: IndirectMedium
Audio-Embedded Prompt Injection (Multimodal)AML.T0051.000 LLM Prompt Injection: DirectMedium
Indirect Prompt Injection (poisoned content)AML.T0051.001 LLM Prompt Injection: IndirectHigh
Many-shot JailbreakAML.T0054 LLM JailbreakHigh
Crescendo Multi-turn JailbreakAML.T0054 LLM JailbreakHigh
Policy Puppetry / Fake System DirectiveAML.T0051.000 LLM Prompt Injection: DirectHigh
Encoded / Ciphered Payload SmugglingAML.T0054 LLM JailbreakMedium
Low-resource Language JailbreakAML.T0054 LLM JailbreakMedium
Hypothetical / Fiction FramingAML.T0054 LLM JailbreakMedium
Reverse Psychology / Refusal ReframeAML.T0054 LLM JailbreakLow
Context Overflow to Evict GuardrailsAML.T0051.000 LLM Prompt Injection: DirectMedium
Spoken Instruction OverrideAML.T0051.000 LLM Prompt Injection: DirectHigh

ASI02: Tool Misuse & Exploitation​

ObjectiveATLAS techniqueSeverityQuick scan
Tool / Capability EnumerationAML.T0084.001 Discover AI Agent Configuration: Tool DefinitionsMedium✓
Privilege-Flag Tampering (Confused Deputy)AML.T0053 AI Agent Tool InvocationHigh
Tool Argument AbuseAML.T0053 AI Agent Tool InvocationHigh
SSRF / Tool RepurposingAML.T0053 AI Agent Tool InvocationHigh
Tool-Chaining ExfiltrationAML.T0086 Exfiltration via AI Agent Tool InvocationHigh
Business-Logic Abuse (Price / Discount)AML.T0053 AI Agent Tool InvocationHigh
RAG Document ExfiltrationAML.T0085.000 Data from AI Services: RAG DatabasesHigh
Multi-agent / Delegation ManipulationAML.T0053 AI Agent Tool InvocationHigh
Path Traversal via Tool ArgumentsAML.T0053 AI Agent Tool InvocationHigh
Tool Parameter Pollution / OverrideAML.T0053 AI Agent Tool InvocationMedium
Callback / Contact Detail TakeoverAML.T0053 LLM Plugin CompromiseCritical

ASI01: Agent Goal Hijack​

ObjectiveATLAS techniqueSeverityQuick scan
Scope Hijack / Off-Topic MisuseAML.T0051 LLM Prompt InjectionLow✓
Indirect / Tool-Result InjectionAML.T0051.001 LLM Prompt Injection: IndirectHigh
Malicious Document Injection (Multimodal)AML.T0066 Retrieval Content CraftingHigh
Agent Goal HijackAML.T0051.000 LLM Prompt Injection: DirectHigh
Transfer / Escalation AbuseAML.T0051 LLM Prompt InjectionMedium

ASI03: Identity & Privilege Abuse​

ObjectiveATLAS techniqueSeverityQuick scan
Authentication / Login BypassAML.T0053 AI Agent Tool InvocationCritical✓
OTP Guess / Validation BypassAML.T0053 AI Agent Tool InvocationCritical
Privilege EscalationAML.T0053 AI Agent Tool InvocationCritical
Cross-User Data Access (BOLA)AML.T0085.001 Data from AI Services: AI Agent ToolsCritical
Privileged Function Access (BFLA)AML.T0053 AI Agent Tool InvocationCritical

LLM05: Improper Output Handling​

ObjectiveATLAS techniqueSeverityQuick scan
SQL Injection via Tool ArgumentsAML.T0053 AI Agent Tool InvocationCritical✓
Harmful Content Generation (refusal test)AML.T0054 LLM JailbreakHigh
Dangerous Capability Uplift (CBRN/weapons refusal)AML.T0054 LLM JailbreakCritical
Insecure / Backdoored Code GenerationAML.T0048 External HarmsHigh
Output Injection (XSS / Markdown / HTML)AML.T0048 External HarmsMedium

ASI05: Unexpected Code Execution​

ObjectiveATLAS techniqueSeverityQuick scan
OS / Command Execution AttemptAML.T0102 Generate Malicious CommandsCritical✓

LLM02: Sensitive Information Disclosure​

ObjectiveATLAS techniqueSeverityQuick scan
PII / Cross-User Data ExfiltrationAML.T0057 LLM Data LeakageHigh✓
Internal Config / Secret LeakageAML.T0083 Credentials from AI Agent ConfigurationHigh
Salary / Compensation ExtractionAML.T0057 LLM Data LeakageHigh
Sensitive Data Read AloudAML.T0057 LLM Data LeakageHigh

ASI06: Memory & Context Poisoning​

ObjectiveATLAS techniqueSeverityQuick scan
Memory / Context PoisoningAML.T0080.000 AI Agent Context Poisoning: MemoryHigh

LLM06: Excessive Agency​

ObjectiveATLAS techniqueSeverityQuick scan
Excessive Agency (Destructive Action)AML.T0101 Data Destruction via AI Agent Tool InvocationCritical
Unauthorized Financial ActionAML.T0053 AI Agent Tool InvocationCritical
Caller Verification BypassAML.T0051 LLM Prompt InjectionCritical

LLM10: Unbounded Consumption​

ObjectiveATLAS techniqueSeverityQuick scan
Rate-Limit / Denial-of-Wallet ProbeAML.T0034.002 Cost Harvesting: Agentic Resource ConsumptionMedium
Denial of Wallet / Unbounded ConsumptionAML.T0034 Cost HarvestingMedium

LLM08: Vector and Embedding Weaknesses​

ObjectiveATLAS techniqueSeverityQuick scan
RAG Knowledge-Base PoisoningAML.T0070 RAG PoisoningHigh
Embedding / Vector Store InversionAML.T0057 LLM Data LeakageHigh

LLM09: Misinformation​

ObjectiveATLAS techniqueSeverityQuick scan
Misinformation / Persuasive FalsehoodAML.T0048 External HarmsMedium
Fabricated Facts & Citations (overreliance)AML.T0048 External HarmsLow
AI Disclosure EvasionAML.T0048 Societal HarmMedium

LLM04: Data and Model Poisoning​

ObjectiveATLAS techniqueSeverityQuick scan
Feedback-loop Data PoisoningAML.T0020 Poison Training DataMedium

Coverage notes​

  • OWASP Top 10 for LLM Applications (2025): LLM01, LLM02, LLM04 through LLM10. No library objective targets LLM03 (Supply Chain).
  • OWASP Top 10 for Agentic Applications: ASI01, ASI02, ASI03, ASI05, and ASI06.
  • Multimodal and voice objectives target image, audio, document, and spoken channels. The Capabilities exercised section of the Full report shows which channels a run actually tested.
  • A run can complete fewer objectives than it selected. Check the Objectives run count in the Full report for the actual number.

On this page