AI and Agentic Systems Threat Taxonomy

The AI and Agentic Systems Threat Taxonomy: five Elevation of Autonomy cards, one from each suit, fanned over a neon grid.

AI and Agentic Systems Threat Taxonomy

This is the reference for the Elevation of Autonomy card game: every card’s threat, its mitigation prompts, the mitigation principle a sound design follows, design measures, and mappings to STRIDE, OWASP, MITRE ATLAS, CAPEC and CWE.

Elevation of Autonomy is a threat modeling card deck for AI, LLM and agentic systems: 30 cards in five suits. It is free to print and play from GitHub, and a printed deck is available from CyberSec Games. This taxonomy keeps each card’s text and adds what a team needs once the card has been played: what a sound design does about it, concrete measures, where it sits in the frameworks people already use, and public cases.

IDs. Every entry uses the ID printed on its card, for example EOA·SA for Prompt Injection and EOA·T7 for Adversarial Subspace: the deck prefix EOA, a middle dot, the suit letter (S, H, D, C or T) and the card’s value. The deck is published, so these IDs are fixed. Cite them as they are printed, with the middle dot.

The deck at a glance: the five suits of Elevation of Autonomy and the 30 cards with their IDs and titles.

The suits

♠ Spades: Adversarial

Direct attacks on the model and the agent: text that becomes an instruction, tools turned against their owner, poisoned components, memory and tool descriptions, and output that a downstream consumer trusts.

EOA·SA Prompt Injection, EOA·SK Tool Misuse, EOA·SQ Supply Chain Compromise, EOA·SJ Memory Poisoning, EOA·S10 Improper Output Handling, EOA·S9 Tool Description Injection.

♥ Hearts: Autonomy

The risks that arrive when the system is allowed to act: more agency than the task needs, shared identities, agents that trust each other, failures that cascade, agents nobody inventoried, and clients brokering authority between servers.

EOA·HA Excessive Agency, EOA·HK Identity and Privilege Abuse, EOA·HQ Inter-Agent Trust Exploitation, EOA·HJ Cascading Failure, EOA·H10 Rogue Agent, EOA·H9 Confused Deputy Across Servers.

♦ Diamonds: Data

Risks to and through the data the system handles: disclosure, retrieval without access control, confident falsehoods, runaway spend, system prompts treated as secret stores, and servers that see everything routed to them.

EOA·DA Sensitive Information Disclosure, EOA·DK Vector and Embedding Weakness, EOA·DQ Hallucinated Facts, EOA·DJ Unbounded Consumption, EOA·D10 System Prompt Leakage, EOA·D9 Server Impersonation and Rogue Servers.

♣ Clubs: Privacy

Privacy threats from T.R.I.M. and LINDDUN, framed for systems that generate personal data as well as process it: transfer, retention and removal, inference, minimisation and unintervenability.

EOA·CA Transfer, EOA·CK Retention and Removal, EOA·CQ Inference, EOA·CJ Minimisation, EOA·C10 Unintervenability.

★ Trumps: Structural Hazards

Architectural, mathematical and product-design properties that cannot be mitigated inside the model. Trumps beat any other card, and they are played against the design as a whole rather than against a component.

EOA·T7 Adversarial Subspace, EOA·T6 Geometric Attack, EOA·T5 Context Rot, EOA·T4 Decision Boundary Transfer, EOA·T3 Excessive Autonomy by Design, EOA·T2 Invisible Dependency, EOA·T1 Wrong Abstraction.

What an entry contains

Anatomy of an entry, using EOA·SA Prompt Injection: the card, then its threat, prompts, principle, measures, mappings and a public case.
  • The card: ID, title and quote, exactly as printed.
  • Threat: what goes wrong, from the card.
  • Mitigation prompts: the questions the card asks the table, from the card.
  • Mitigation principle: one sentence on what a sound design does about the threat. A design that meets the principle has no finding for that card.
  • Design measures: three or four concrete measures that put the principle into practice. They are the shape of a fix; adapt them to your architecture.
  • Mappings: STRIDE (and LINDDUN for the privacy cards), the OWASP and other references printed on the card, MITRE ATLAS techniques, CAPEC and CWE.
  • Seen in the wild: a public case or the research behind the card, with its source, where there is one.
  • Touches: the cards most often played alongside it.

How to use it

  • After a game. Each trick the table records names a card. Look the ID up here and use the principle to decide whether the design already defeats the threat, and the measures to write the fix.
  • In a design review without the cards. Walk all 30 entries against every AI or agentic element in the data-flow diagram. Each one produces a finding or a one-line “no exposure” with the reason. Play the Trumps against the design as a whole.
  • In a threat model or a findings report. Tag findings with the ID (for example EOA·S9) next to the OWASP and ATLAS identifiers, so readers can come back to the full entry.
  • In tools. The SKOS and STIX downloads carry the same IDs, so the taxonomy can be loaded into a knowledge base, a threat modeling tool or a threat intelligence platform.

The principle behind the deck runs through every entry: a security guarantee for an AI system has to live in a deterministic control outside the model. Guardrails, refusals and classifiers reduce noise; they are never the control. The Trumps explain why.

Mappings

  • STRIDE: Spoofing 6, Tampering 14, Repudiation 3, Information disclosure 10, Denial of service 2, Elevation of privilege 12 (an entry can map to more than one). The privacy cards also map to LINDDUN.
  • MITRE ATLAS: 23 of 30 entries map to ATLAS techniques (39 distinct techniques, ATLAS 2026.10).
  • CAPEC: 5 of 30 entries. CWE: 18 of 30 entries (18 distinct CWEs, CWE 5.0).
  • Neither CAPEC nor CWE: 12 entries (EOA·SK, EOA·SJ, EOA·HJ, EOA·H10, EOA·DQ, EOA·CA, EOA·CK, EOA·CQ, EOA·C10, EOA·T5, EOA·T3, EOA·T1). That is a finding in itself: the weakness catalogues were written for code, and threats such as context rot, unintervenability or excessive autonomy by design are properties of the system and the product, not of a line of code.

Every CAPEC and ATLAS ID was checked against MITRE’s published data (CAPEC 3.9, ATLAS 2026.10), and every CWE against MITRE’s definition pages (CWE 5.0), on 3 November 2026. CWEs that MITRE marks Discouraged or Prohibited for mapping (such as CWE-1426) were removed, and loose tags were dropped rather than kept. The references printed on the cards are shown as printed; the mapping columns are the checked ones.

Seen in the wild

18 of the 30 entries cite a public case or the research behind the card, each with its source on the suit page. They include EchoLeak in Microsoft 365 Copilot, MCP tool poisoning, the postmark-mcp package, the Amazon Q Developer extension, slopsquatting and Moffatt v. Air Canada.

Scope and origin

The game came first. Elevation of Autonomy was published as a card deck, with a reference document, a facilitator’s runbook and a threat model template, in its repository. This taxonomy is the reference for that deck: the card text is unchanged, and the principles, measures, mappings and cases build on the mitigations published with it.

It covers the AI-specific threat surface: models, prompts, retrieval, memory, tools, MCP servers and agents. The build and delivery pipeline around an AI system is covered by the Software Factory Threat Taxonomy, AI in the mail path (scanner prompt injection, assistant-mediated deception) also appears in the Email Infrastructure Threat Taxonomy, and voice assistants and automations in the home in the Smart Home Threat Taxonomy.

Downloads

FormatFileWhat it is
PDFai-agentic-systems-threat-taxonomy.pdfLandscape A4, a section per suit and a page per entry, with the licence on the first pages
Excelai-agentic-systems-threat-taxonomy.xlsxAll entries on one sheet, a sheet per suit, and an About sheet with the licence
SKOS (JSON-LD)ai-agentic-systems-threat-taxonomy.skos.jsonldA concept scheme for knowledge bases, with CAPEC, CWE and ATLAS links
STIX 2.1ai-agentic-systems-threat-taxonomy.stix.jsonAn attack pattern and a course of action per entry, grouped by suit

Licence

© 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. You can share the whole taxonomy freely for non-commercial purposes, unchanged and with credit.

UsePermission needed?
Sharing the whole taxonomy non-commercially (OWASP, universities, conferences, individuals)No
Threat modeling with it, including for paying clientsNo
Internal use and training inside any organisationNo
Quoting entries, with credit, in paid courses, reports and talksNo
Shipping the taxonomy in a product: a tool’s built-in library, a printed deck, a reprint for saleYes, ask me

Additional permissions. In addition to the rights the licence gives, and whether or not the use is commercial, the copyright holder grants you permission to:

  • use the taxonomy to threat model systems you build, operate or assess, including for paying clients;
  • use it internally, and for training, inside any organisation;
  • quote individual entries, with credit, in paid courses, reports, findings and talks.

Any other commercial use, including shipping the taxonomy or a substantial part of it in a product (a tool’s built-in library, a printed deck, a reprint for sale), needs written permission. Ask me on LinkedIn.

Credit: “AI and Agentic Systems Threat Taxonomy” by Jonathan Brett Crawley, ostering.com, licensed under CC BY-NC-ND 4.0.

These additional permissions are given alongside the licence. They add to what the licence allows and do not take anything away from it.

The card text itself (each card’s threat, quote, mitigation prompts and references) is also published in the Elevation of Autonomy repository under CC BY-SA 4.0: https://github.com/BrettCrawley/elevation-of-autonomy. That licence still applies to the card text taken from the repository. The mitigation principles, design measures, mappings and cases are new in this taxonomy and are covered by the licence above.

Versions

VersionDateChange
1.03 November 2026First publication: 30 entries, the IDs printed on the Elevation of Autonomy v0.1 deck

Mapped against: OWASP Top 10 for LLM Applications 2025; OWASP Top 10 for Agentic Applications 2026 (December 2025); MITRE ATLAS 2026.10; CAPEC 3.9; CWE 5.0; STRIDE and LINDDUN category names.

Sources

AI and Agentic Systems Threat Taxonomy v1.0. © 2026 Jonathan Brett Crawley, CC BY-NC-ND 4.0 with additional permissions.