The attack classes we test for, named.
Every engagement declares the classes it exercises. Every finding records the class it demonstrates. Coverage is therefore a number, not an adjective, and the register is the vocabulary that number is counted in. We publish it so the count can be checked.
On this page · model and application · agentic · supply and binary · ATLAS
A register, not a verdict.
Each row is one attack class: its id, what it is, and why the testing most teams already run tends not to reach it. Ids are stable. Findings cite them, reports count them, and a defender can start from any row without waiting for us.
A class in the register means Serpio can exercise it on an engagement. It is not a claim that any given system is exposed to it; that is what the engagement finds out. New classes are added when the work surfaces them, not before.
Model and application classes
The OWASP classes we exercise. Ids follow the 2025 list; the register carries the subset we test, not the full ten: the five whose failure mode changes when a model holds tool authority.
| Id | Class | What it is | Why standard testing misses it |
|---|---|---|---|
| LLM01 | Prompt injection (direct and indirect) | Instructions arrive inside content the system already trusts: a document, a web page, a tool result, a user message. | Input filters look for known strings. The payload is ordinary language, and it enters through channels no filter watches. |
| LLM02 | Sensitive information disclosure | The model reveals system prompts, retrieved records, credentials, or other users’ data through its output. | Data-loss tooling inspects fixed fields. A model paraphrases, so the secret leaves in a form no pattern recognizes. |
| LLM04 | Data and model poisoning | Training data, fine-tuning sets, or retrieval corpora are altered so the model behaves as the attacker intends. | Evals score the model as shipped. A poisoned behavior is designed to pass those evals and trigger only on the attacker’s cue. |
| LLM06 | Excessive agency | The model holds more permissions, tools, or autonomy than its task needs, so a misstep becomes an action. | Pentests test what a function does when called. They rarely ask whether the model should have been able to call it at all. |
| LLM08 | Vector and embedding (RAG) weaknesses | Retrieval stores are read across tenant lines, seeded with adversarial content, or queried to reconstruct source data. | The vector store sits outside the application’s normal access-control model, so authorization reviews stop at its edge. |
Agentic classes
Where a model stops answering and starts acting. These are Serpio’s own ids, defined because the OWASP list stops short of the decision surface an agent exposes, and aligned to the CSA agentic-AI guidance.
| Id | Class | What it is | Why standard testing misses it |
|---|---|---|---|
| AG1 | Tool abuse and unauthorized tool invocation | An agent is steered into calling a tool it should not, or calling a permitted tool with arguments that do harm. The model is not compromised; it is persuaded, and it holds real credentials. | Test suites exercise tools with valid inputs. Nobody scripts the case where the caller has been talked into it. |
| AG2 | Authority-boundary and confused-deputy escalation | One component acts with the privileges of another. A low-trust input reaches a high-trust action because the agent carried it across the line. | Each component passes its own review. The failure lives in the hand-off, which no single component owns. |
| AG3 | Multi-agent trust and inter-agent message injection | Agents trust each other’s messages as instructions. Compromise one, or forge its output, and the others follow. | Internal traffic is treated as trusted by construction. Threat models seldom put an adversary between two of the system’s own agents. |
| AG4 | Unsafe autonomy (destructive action without a human gate) | An agent deletes, sends, pays, or deploys with no person in the loop, and the loop had no place to stop it. | Checklists ask whether a gate exists. They do not ask whether the agent can reach the destructive action by a path that bypasses it. |
Supply and binary classes
What the model runs on and arrives with. Weights, vendor components, and the toolchain between them, tested at the level where source is often unavailable.
| Id | Class | What it is | Why standard testing misses it |
|---|---|---|---|
| SC1 | Model and weight provenance and integrity | Weights, adapters, and training data arrive with no integrity story you can check: no signature, no attested source, no record of what changed. | Software supply-chain tooling tracks packages. A model file is an opaque blob to it, and a swapped or tampered one loads without complaint. |
| SC2 | Vendor binary and custom-op memory safety | Third-party binaries, inference runtimes, and custom operators on the AI path, shipped without source, with memory-safety defects an attacker-controlled input can reach. | Static analysis needs source. Without it, most teams either trust the vendor or stop; we read the binary. |
| SC3 | Toolchain and deserialization paths | Model loaders, serialization formats, converters, and build tooling that execute code or parse untrusted structures on load. | A model file is treated as data. Several common formats are programs, and loading one is running it. |
ATLAS tactics, paired
MITRE ATLAS describes how an adversary moves against an ML system. It is a matrix of tactics rather than a fixed list of classes, so we use it as an “as applicable” layer, not as an enumerable id.
How it appears on a finding
A finding records its enumerable class from the sections above and, where one applies, the ATLAS tactic it fits. A finding whose only relevant framing is an ATLAS tactic is paired with an enumerable class so it counts toward coverage.
Tactics we map to
Reconnaissance against the target model and its exposure. ML model access, direct or through an API. ML supply-chain compromise across data, weights, and tooling. Others where the evidence supports the mapping.
The attacker also uses AI. Discovery, exploitation, and reversing are accelerating on their side too, and ATLAS is the shared language for describing that.
What the register is not
It is a vocabulary. It carries no attack pack contents, no payloads, no tooling, and no per-client data. It names classes so a defender can start testing for them, and so a finding, a report, and a coverage figure all point at the same word.
Find out which rows apply to you.
An engagement declares its classes up front and reports the ones it demonstrated. The register is where both lists are read from.
Scope an engagement →