The attack classes we test for, named.
Every engagement declares the classes it exercises, and every finding in a register class records its id. Findings and coverage counts use these ids.
The register, by group
13 classes in 3 groups, plus 4 paired ATLAS tactic rows.
The register of attack classes.
Each row is one attack class: its id, what it is, and why the testing most teams already run tends to miss it. A defender can start from any row without us. Findings on applications, APIs and infrastructure outside these classes are rated on the same severity rubric.
A class in the register means Serpio can exercise it on an engagement. Whether a given system is exposed is what the engagement finds out. New classes are added when the work surfaces them.
- All classes
- Every class in the register: thirteen classes in three groups, and the ATLAS tactics paired with them.
- Demonstrated only
- Classes where a finding was reproduced with replayable evidence. Only these count as demonstrated coverage.
Model and application classes
5 of 5 classes
The OWASP classes we exercise. Ids follow the 2025 list; the register carries five of its ten.
| Id | Class | What it is | Why standard testing misses it |
|---|---|---|---|
| LLM01F-001 | Prompt injection (direct and indirect) | Instructions arrive inside content the system already trusts: a document, a web page, a tool result, a user message. | Input filters look for known strings. The payload is ordinary language, and it enters through channels no filter watches. |
| LLM02 | Sensitive information disclosure | The model reveals system prompts, retrieved records, credentials, or other users’ data through its output. | Data-loss tooling inspects fixed fields. A model paraphrases, so the secret leaves in a form no pattern recognizes. |
| LLM04 | Data and model poisoning | Training data, fine-tuning sets, or retrieval corpora are altered so the model behaves as the attacker intends. | Evals score the model as shipped. A poisoned behavior is designed to pass those evals and trigger only on the attacker’s cue. |
| LLM06 | Excessive agency | The model holds more permissions, tools, or autonomy than its task needs, so a misstep becomes an action. | Pentests test what a function does when called. They rarely ask whether the model should have been able to call it at all. |
| LLM08 | Vector and embedding (RAG) weaknesses | Retrieval stores are read across tenant lines, seeded with adversarial content, or queried to reconstruct source data. | The vector store sits outside the application’s normal access-control model, so authorization reviews stop at its edge. |
Agentic classes
4 of 4 classes
Where a model stops answering and starts acting. These are Serpio’s own ids, defined because the OWASP list does not cover the decisions an agent makes, and aligned to the CSA agentic-AI guidance.
| Id | Class | What it is | Why standard testing misses it |
|---|---|---|---|
| AG1F-002 | Tool abuse and unauthorized tool invocation | An agent is steered into calling a tool it should not, or calling a permitted tool with arguments that do harm. The model is persuaded, and it holds real credentials. | Test suites exercise tools with valid inputs. Nobody scripts the case where the caller has been talked into it. |
| AG2F-003 | Authority-boundary and confused-deputy escalation | One component acts with the privileges of another. A low-trust input reaches a high-trust action because the agent carried it across the line. | Each component passes its own review. The failure lives in the hand-off, which no single component owns. |
| AG3 | Multi-agent trust and inter-agent message injection | Agents trust each other’s messages as instructions. Compromise one, or forge its output, and the others follow. | Internal traffic is treated as trusted by construction. Threat models seldom put an adversary between two of the system’s own agents. |
| AG4 | Unsafe autonomy (destructive action without a human gate) | An agent deletes, sends, pays, or deploys with no person in the loop, and the loop had no place to stop it. | Checklists ask whether a gate exists. They do not ask whether the agent can reach the destructive action by a path that bypasses it. |
Supply and binary classes
4 of 4 classes
What the model runs on and arrives with. Weights, vendor components, and the toolchain between them, tested at the level where source is often unavailable.
| Id | Class | What it is | Why standard testing misses it |
|---|---|---|---|
| SC1F-004 | Model and weight provenance and integrity | Weights, adapters, and training data arrive with no integrity story you can check: no signature, no attested source, no record of what changed. | Software supply-chain tooling tracks packages. A model file is an opaque blob to it, and a swapped or tampered one loads without complaint. |
| SC2 | Vendor binary and custom-op memory safety | Third-party binaries, inference runtimes, and custom operators on the AI path, shipped without source, with memory-safety defects an attacker-controlled input can reach. | Static analysis needs source. Without it, most teams either trust the vendor or stop; we read the binary. |
| SC3 | Toolchain and deserialization paths | Model loaders, serialization formats, converters, and build tooling that execute code or parse untrusted structures on load. | A model file is treated as data, yet several common formats execute code when loaded. |
| RE1F-005 | Behavior past source (firmware and native binaries) | Firmware, native libraries and vendor executables ship behavior that no source review sees, because there is no source to review. | Source review has nothing to read here. We reverse-engineer the binary and test what it does. |
ATLAS tactics, paired
4 tactic rows
MITRE ATLAS describes how an adversary moves against an ML system. It is a matrix of tactics with no fixed list of classes, so we apply it where it fits and never give it an id of its own. A tactic is named on a finding beside a class and is never counted alone.
| Tactic | What it covers | Pairs with |
|---|---|---|
| Reconnaissance | Reconnaissance against the target model and its exposure: what it is, where it is reachable, and what it will answer. | LLM02LLM08 |
| ML model access | ML model access, direct or through an API: a query surface an adversary can reach with an identity they already hold. | LLM01AG1AG2 |
| Initial access (ML supply-chain compromise) | Initial access through the ML supply chain: data, weights, and tooling, anything that arrives from outside and is loaded as trusted. | LLM04SC1SC2 |
| Other tactics | Framings outside the three above are used when the evidence supports the mapping, and only then. The mapping is stated on the finding, in the same vocabulary the rest of the report uses. | No id. Paired with the closest class on the finding. |
A finding records its enumerable class from the sections above and, where one applies, the ATLAS tactic it fits. A finding whose only relevant framing is an ATLAS tactic is paired with an enumerable class so it counts toward coverage.
Illustrative example, not client data. The demonstrated marks and finding ids come from the trace below.
How a finding gets its class.
Below is one agent run drawn as spans, with the five classes its findings cite marked where they occurred. The register names each class; the trace shows where a finding earned it, using the same class ids.
Instructions arrive inside content the system already trusts, here an attachment body. The fetch and the decode both succeed, and the body is appended to context with the same standing as the system prompt.
The model was persuaded, and it holds real credentials. The call passes every check it meets; what changed was the argument the model chose, under text it had been told to trust.
One component acts with the privileges of another, and nothing in the flow says no. The check returns allow in 9 ms: it validates the session’s scope where it should validate the MCP server’s, and the next span assumes an identity the caller was never granted.
Weights, adapters, and datasets arrive with no chain of custody you can prove. The checksum verifies: a hash proves the bytes did not change in transit, and proves nothing about who produced them or what the adapter was trained to do.
Risk that sits past source: a signing helper with no source in the repository. Inside its 604 ms it opens an outbound socket and reads the agent key file, and no source review would have surfaced either child span.
Illustrative example, not client data. Each flagged span names the finding that cites it, and every one carries replay steps and evidence.
How severity is rated.
An agent can hold broad tool authority, keep standing credentials, and turn one injected instruction into real-world action. So every finding is rated on three dimensions, each High, Medium, or Low, and the combination sets severity through the rubric below. Two operators rating the same finding land on the same row.
What the adversary gains if the finding is exploited, judged by the concrete effect on your business. High is full compromise of a sensitive asset: exfiltration at scale, code execution, an irreversible action, poisoning that corrupts downstream output. Low is information mainly useful for chaining, or an effect confined to the adversary’s own session.
How hard a realistic adversary finds it to trigger under the agreed rules: preconditions, access required, reliability, skill. High is repeatable with low privilege and a single crafted input. Low needs strong preconditions, rare timing, or elevated existing access.
How far the compromised path reaches. High is privileged tools, standing credentials, write access to production, autonomy without a human gate, or a position that pivots across tenants or agents. Low is little authority beyond the entry point. The same injection is a larger risk when it reaches a tool that moves money than when it reaches a benign tool, even when the proof-of-concept action is modest.
Each dimension scores High 3, Medium 2, Low 1. Severity is (2 × Impact) + Exploitability + Authority. Impact is doubled so that harm outweighs ease of triggering.
| Severity | Score | Definition | Expected response |
|---|---|---|---|
| Critical | 11 to 12 | Direct, reliable path to full compromise of a sensitive asset, or autonomous adversary-controlled action with broad authority. Exploitable now, with reproducible proof. | Stop the line. Remediate immediately, often before the engagement closes. |
| High | 10 | Serious compromise that is either highly exploitable or reaches significant authority, with clear business impact and reproducible proof. | Prioritize inside the current Harden phase. |
| Medium | 8 to 9 | Real weakness with bounded impact, bounded authority, or a precondition that limits reliability. | Schedule remediation; may be accepted with a documented, time-boxed compensating control. |
| Low | 4 to 7 | Minor issue, hard to exploit, or contained effect. Often valuable as a chaining component rather than on its own. | Fix opportunistically or accept with rationale. |
| Info | any | No exploitable path or direct risk. A hardening observation, hygiene gap, or context that strengthens other findings. | Awareness. Consider in defense in depth. |
Four scored bands plus Info, with the same severity words in every report.
Rules that adjust the row
Without replay steps and evidence, a finding caps at Medium, and the gap is stated. A pure hypothesis with no working proof caps at Low or Info.
If the exploited path can take a destructive or irreversible action without a human gate (AG4), authority is High and severity is at least High, however small the demonstrated action was.
A finding proven only on staging or in a lab is rated for the environment it was proven in, with the production likelihood noted separately. The credible worst case is recorded as a note and kept out of the headline rating.
The full rubric, with every rule that adjusts the row and how chaining and compensating controls are recorded, is on the method page. How exercised and demonstrated are counted per class is on the coverage record.
What the register contains.
Class names and definitions only: no attack pack contents, payloads, tooling, or client data. It names classes so a defender can start testing for them, and so findings, reports, and coverage figures use the same terms.
Find out which rows apply to you.
An engagement declares its classes up front and reports the ones it demonstrated.