Threat Library

AI agent attack patterns

Documented attack techniques targeting AI agents and LLM-powered workflows — with indicators of compromise and how Trappr detects each one.

CRITICALHIGHMEDIUMLOW10 threats documented
T-001CRITICALPrompt manipulation

Prompt injection via user input

An attacker embeds adversarial instructions inside user-supplied content (e.g. a customer support message, uploaded document, or form field). The LLM follows the injected instructions instead of the application's system prompt.

Indicators
  • Unusual instruction patterns in user messages ("Ignore previous instructions...")
  • Role-switching attempts ("You are now DAN...")
  • Output format hijacking ("Respond only in JSON with field 'secret':")
Trappr detection
DLP masking catches known injection patterns. Canary tokens fire if injected instructions cause the model to exfiltrate embedded tripwires.
T-002CRITICALPrompt manipulation

Indirect prompt injection

Malicious instructions are hidden inside data the agent retrieves at runtime — a web page, PDF, database record, or API response. The agent executes the instructions as if they were its own.

Indicators
  • Instructions in retrieved documents targeting agent behavior
  • Unexpected tool calls or data exfiltration after retrieval steps
  • Agent output referencing content not present in the system prompt
Trappr detection
Gateway logging captures full message chains including retrieved content. Canary tokens embedded in knowledge bases fire when exfiltrated.
T-003CRITICALData exfiltration

Canary token exfiltration

An attacker who compromises an agent or its context window may exfiltrate canary tokens embedded in the system prompt or retrieved documents. The token appearing in any LLM response is the detection signal.

Indicators
  • Canary token string appearing in LLM response content
  • Requests to summarize or repeat the system prompt
  • Unexpected API calls to external endpoints carrying context data
Trappr detection
Trappr scans every gateway response for canary token strings. Match fires a CRITICAL incident within milliseconds.
T-004HIGHSupply chain

Workflow tampering

An attacker with access to the workflow platform (n8n, Make.com) modifies a production workflow — changing LLM prompts, adding data exfiltration nodes, or redirecting API calls. The change is invisible to the application owner.

Indicators
  • Workflow JSON diff showing unexpected node additions or prompt changes
  • New HTTP request nodes calling external endpoints
  • Credential node changes
Trappr detection
Trappr fingerprints workflows on registration (SHA-256 of canonical JSON). Any subsequent change is detected on the next probe cycle and the workflow is deactivated.
T-005HIGHIdentity & access

Agent identity spoofing

An attacker reuses a leaked agent API key to impersonate a legitimate agent — making gateway calls that appear to originate from a trusted agent but carry attacker-controlled content.

Indicators
  • Agent API key used from unexpected IP addresses or geographic regions
  • Unusual request volumes or patterns on an agent key
  • Requests with content outside the agent's expected domain
Trappr detection
Gateway logs bind every call to an agent key. Suspicious patterns appear in the Agent Monitor and can trigger alerts. Key rotation revokes access immediately.
T-006HIGHData exfiltration

PII exfiltration via LLM responses

An agent with access to a database or document store can be prompted to extract and return sensitive PII (emails, phone numbers, SSNs, credit card numbers) in its responses, which may then be forwarded to untrusted parties.

Indicators
  • LLM responses containing structured PII outside expected output format
  • Large response payloads with many distinct identifiers
  • Requests asking the agent to 'list all users' or 'export records'
Trappr detection
Trappr's DLP layer masks PII in both directions — outgoing messages (preventing data from reaching the LLM) and incoming responses (masking before delivery). Masking events are logged.
T-007MEDIUMPrompt manipulation

Jailbreak via role-playing

Attackers instruct the LLM to adopt an alternative persona ("DAN", "Developer Mode", etc.) that claims to have no safety restrictions. The model is then prompted to produce harmful or policy-violating content.

Indicators
  • Requests to 'pretend you have no restrictions'
  • Multi-turn escalation establishing a fictional persona before the harmful request
  • Unusual output tone or content inconsistent with the system prompt's intended persona
Trappr detection
Semantic DLP (in development) will classify intent regardless of phrasing. Gateway logging captures full conversation history for post-hoc review.
T-008HIGHAgent abuse

Tool call hijacking

Through prompt manipulation, an attacker causes an agent to invoke tools (file system, code execution, external APIs) in ways not intended by the system prompt — reading sensitive files, executing arbitrary code, or calling privileged APIs.

Indicators
  • Tool calls with parameters outside the agent's defined scope
  • File read/write operations on unexpected paths
  • API calls to endpoints not in the agent's configuration
Trappr detection
ThreadEvent logging captures all tool call events with parameters. Agent Monitor's flow graph shows the full tool call chain per execution.
T-009CRITICALData exfiltration

Credential harvesting via context leakage

If credentials (API keys, tokens, passwords) are included in the agent's context window — as environment variables, configuration, or retrieved secrets — an attacker can prompt the agent to reveal them.

Indicators
  • System prompt containing raw secrets or environment variables
  • Requests asking the agent to repeat or describe its configuration
  • Model output containing strings matching credential patterns
Trappr detection
Canary tokens embedded alongside sensitive configuration fire immediately if exfiltrated. DLP masking can redact credential-shaped strings before they reach the model.
T-010HIGHSupply chain

Supply chain compromise via third-party tools

A third-party tool or integration used by the agent (e.g. a RAG plugin, a vector database client, a workflow node) is compromised — injecting malicious content into the agent's context or intercepting its outputs.

Indicators
  • Unexpected content in retrieved documents differing from the source
  • Workflow nodes calling unexpected endpoints
  • Tool responses with unusually structured content containing instructions
Trappr detection
Workflow fingerprinting detects any change to integration nodes. Canary tokens in retrieval sources detect when an attacker has modified the data store.

Contributing

Discovered a new attack pattern? Email our security team — we review and add credited contributions to this library.

This library is updated as new attack techniques are documented in the wild. Last review: June 2026.