Threat Matrix Coverage
61 techniquesAgentPwn is the live-coverage layer of the OpenA2A security workflow. Every technique in the canonical AI Agent Threat Matrix is mapped here to a honeypot status, so the gap between what is theorized and what is observably tested against real agents is never hidden.
42
Live coverage
A deployed trap produces evidence for this technique today
8
Queued
In scope for a content honeypot; trap fixture not built yet
11
Out of scope
Needs host infra or tooling a web honeypot cannot stage
69%
Live of 61
50 of 61 are in scope (live + queued)
Coverage is declared from AgentPwn's deployed payload inventory, not asserted by hand. A technique can only be marked live if it maps to an attack category the honeypot actually ships — the build fails otherwise. Published at /coverage.json.
The complete workflow
A matured pipeline: the taxonomy defines threats, three tools detect and benchmark them, and AgentPwn closes the loop by observing real agents fall to them in the wild.
Coverage by tactic
Reconnaissance
5 / 1 / 1
Initial Access
9 / 0 / 0
Credential Harvest
4 / 2 / 0
Privilege Escalation
7 / 0 / 0
Lateral Movement
1 / 3 / 2
Persistence
5 / 0 / 2
Collection
4 / 1 / 2
Exfiltration
4 / 0 / 2
Impact
3 / 1 / 2
LiveQueuedOut of scope
Every technique
Reconnaissance
T-1001Endpoint Enumeration
Out of scopeEnumerating the agent's own exposed endpoints is an external scan, not a content trap. HackMyAgent WEBEXPOSE-* covers it.
T-1002Tool Discovery
LiveMCP ExploitationThe Tool Discovery tier asks the agent to enumerate its MCP tools and schemas.
T-1003System Prompt Extraction
LiveData ExfiltrationPrompt InjectionSystem-prompt extraction tiers coax the agent into echoing its instructions verbatim.
T-1004Security Level Probing
LiveJailbreakTiered jailbreak payloads measure at what sophistication the agent's guardrails give way -- security-level probing by construction.
T-1005Capability Mapping
LiveMCP ExploitationData ExfiltrationTool-discovery and system-info tiers map the agent's full capability surface.
T-1006Agent Card Discovery
QueuedA2A agent-card discovery needs the fake-agent network at /pwnagent, which is queued.
T-1007Context Window Probing
LiveContext WindowContext-window tiers probe attention span and saturation before overflow.
Initial Access
T-2001Direct Prompt Injection
LivePrompt InjectionDirect override is tier 1 of prompt injection.
T-2002Indirect Prompt Injection
LivePrompt InjectionEvery AgentPwn page is an indirect-injection surface delivered through consumed web content.
T-2003Role-Play Jailbreak
LiveJailbreakPersona and developer-mode tiers exercise role-play jailbreaks.
T-2004Context Window Exploitation
LiveContext WindowAttention-dilution and displacement tiers saturate the window to push out safety instructions.
T-2005Tool Description Injection
LiveMCP ExploitationTool-injection tiers embed instructions in tool/skill descriptions.
T-2006Unicode/Encoding Bypass
LivePrompt InjectionHigher tiers carry base64, Unicode homoglyph, and zero-width payloads.
T-2007Multi-Turn Manipulation
LiveContext ManipulationContext WindowTask-hijacking and progressive-desensitization tiers shift behavior across multiple steps.
T-2008System Prompt Boundary Bypass
LivePrompt InjectionDelimiter-escape tiers exploit weak system/user prompt boundaries.
T-2009Parser Differential Exploitation
LivePrompt InjectionJSON-LD, markdown, and meta-tag delivery tiers exercise parser-differential injection.
Credential Harvest
T-3001System Prompt Credential Extraction
LiveData ExfiltrationCredential-probe tiers extract secrets referenced in the system prompt.
T-3002Environment Variable Leakage
LiveData ExfiltrationThe credential-probe tier asks the agent to dump environment variables and keys.
T-3003Tool Response Credential Capture
QueuedCapturing creds from a fake tool response needs an MCP fixture that returns secrets; not yet wired.
T-3004Memory Credential Mining
LiveData ExfiltrationMemory WeaponizationConversation-history-leak tiers surface credentials from prior context.
T-3005Configuration File Access
QueuedA trap-page filesystem fixture (read a config file for creds) is not yet wired.
T-3006Context Window Credential Leak
LiveContext WindowContext-window tiers leak credentials retained in the active window.
Privilege Escalation
T-4001Capability Override
LiveCapability AbuseConfused-deputy tiers push the agent past its declared capabilities.
T-4002Admin Impersonation
LiveContext ManipulationAuthority-impersonation tiers inject fake admin/system messages.
T-4003Tool Parameter Injection
LiveMCP ExploitationTool-injection tiers smuggle malicious parameters into tool calls.
T-4004Delegation Abuse
LiveAgent-to-Agent AttackDelegation-abuse tier escalates through trusted agent chains.
T-4005Policy Bypass via Encoding
LivePrompt InjectionBase64/Unicode tiers bypass policy enforcement on actions.
T-4006Safety Instruction Displacement
LiveContext WindowInstruction-displacement tiers evict safety instructions from active context.
T-4007Tool Impersonation and Squatting
LiveMCP ExploitationTool ShadowTool-injection and ghost-tool tiers exercise tool squatting and shadowing.
Lateral Movement
T-5001SSRF via Tool
QueuedA confused-deputy SSRF fixture (canary internal URL) is adjacent to capability-abuse but not yet wired.
T-5002A2A Agent Pivoting
LiveAgent-to-Agent AttackWorm-propagation and impersonation tiers pivot across A2A connections.
T-5003MCP Server Hopping
QueuedA multi-MCP fixture network for server hopping is not yet built.
T-5004Credential Reuse
Out of scopeReusing harvested credentials against a second system is not something a content honeypot can stage.
T-5005Database Pivoting
Out of scopeDatabase pivoting needs live DB tooling; DVAA covers it.
T-5006Internal API Discovery
QueuedA fake internal-API trap fixture is not yet built.
Persistence
T-6001Memory Injection
LiveMemory WeaponizationMemory-injection tier persists instructions across sessions.
T-6002Self-Replicating Memory Entry
LiveMemory WeaponizationSelf-re-injecting memory entries extend the memory-injection tier.
T-6003Configuration Modification
Out of scopeModifying the agent's own config on its host is not observable via web content.
T-6004Skill/Plugin Backdoor
LiveSupply ChainFake-package and malicious-MCP-server tiers instruct a backdoored skill/plugin install.
T-6005Scheduled Task Injection
Out of scopeScheduled-task injection needs host cron/scheduler context the honeypot never sees.
T-6006Tool Registration Persistence
LiveSupply ChainTool ShadowMalicious-MCP-server and ghost-tool tiers register tools that persist in the registry.
T-6007Persistent Agent State Manipulation
LiveMemory WeaponizationContext-cache-poisoning tier persists tampered state across sessions.
Collection
T-7001File System Enumeration
Out of scopeFilesystem enumeration needs real file-tool access; DVAA covers it.
T-7002Database Extraction
Out of scopeDatabase extraction needs live DB tooling not present on the honeypot.
T-7003API Data Harvesting
LiveData ExfiltrationData-exfiltration tiers harvest data the agent surfaces from connected sources.
T-7004Memory Dump
LiveMemory WeaponizationMemory-dump payloads extract the agent's stored conversation state.
T-7005Configuration Harvesting
QueuedA dedicated configuration-harvest trap fixture is not yet wired.
T-7006PII Discovery
LiveData ExfiltrationSector trap pages (/trap/medical-records, /trap/legal-documents, /trap/customer-portal, /trap/sec-filing) bait PII collection.
T-7007Context Assembly Pipeline Attack
LivePrompt InjectionContext WindowMulti-surface delivery tiers inject into the prompt-assembly pipeline.
Exfiltration
T-8001Email Exfiltration
Out of scopeAgentPwn does not simulate email-sending tools.
T-8002HTTP Callback
LiveData ExfiltrationAgentPwn's primary signal: the payload HTTP callback fires.
T-8003DNS Exfiltration
Out of scopeNo DNS path on an HTTP honeypot.
T-8004Tool Chain Exfiltration
LiveCapability AbuseTool-chain tiers stage exfiltration through legitimate-looking operations.
T-8005Conversation Exfiltration
LiveData ExfiltrationConversation-exfiltration tier encodes data into the agent's visible response.
T-8006Webhook Exfiltration
LiveData ExfiltrationURL/markdown-image exfiltration shares the callback channel; observable per technique tag.
Impact
T-9001Data Manipulation
Out of scopeDestructive data manipulation needs write tooling; the benevolent honeypot never stages it.
T-9002Service Disruption
LiveCapability AbuseTool ShadowCost-amplification and recursive-tool-loop tiers drive resource exhaustion.
T-9003Malicious Code Deployment
Out of scopeNo code-execution path on the honeypot; instruct-only, not observable.
T-9004Multi-Agent Consensus Manipulation
LiveAgent-to-Agent AttackWorm-propagation and delegation tiers influence multi-agent consensus.
T-9005Reputation Poisoning
QueuedEliciting reputation-damaging output via jailbreak tiers is adjacent; no dedicated fixture yet.
T-9006Supply Chain Compromise
LiveSupply ChainMalicious-MCP-server and fake-package tiers compromise the downstream supply chain.
Why 11 techniques are out of scope
AgentPwn observes what an agent can be tricked into through web content it reads. It cannot stage the agent's own post-compromise infrastructure — credential reuse against a second system, database pivoting, host config or cron modification, code execution, or DNS/email exfiltration channels. Those techniques are detected statically by HackMyAgent and exercised end-to-end in DVAA. Marking them out of scope keeps the live number honest.
Test your agent against the live layer
Run the scanner that shares this taxonomy.
npx hackmyagent secure