A Taxonomy and Evaluation Framework for Agentic Security Failures
Systematically measuring how autonomous agents violate trust boundaries, abuse delegated authority, and propagate compromise across tools, memory, retrieval systems, and collaborating agents.
DEF CON AI Village 2026 / Black Hat Europe / Black Hat MEA 2026
Most agent security research stops at the model boundary: jailbreaks, prompt injection, unsafe outputs. SADF argues the real security boundary is no longer the model — it's the agent ecosystem: tools, memory, RAG, browser control, multi-agent orchestration, and delegated authority.
SADF provides:
- An eight-class taxonomy of agentic security failure modes
- An automated testing harness that executes structured attack payloads against tool-using agents and records compromise, propagation, and persistence outcomes
- A refusal-filtered scoring methodology that corrects a 4–6× overstatement in naive substring-based evaluation against safety-trained models
- A measurement framework (ACR, DAAR, CTPS, PI) for comparing agent architectures
- Findings from 2,656 real evaluation runs across 7 agent architectures
| # | Class | Attack Summary |
|---|---|---|
| 1 | Tool Call Hijacking | Manipulating tool parameters (email recipient, file path, API endpoint, SQL) |
| 2 | Output Poisoning | Malicious tool output influences downstream agent reasoning |
| 3 | Cross-Tool Injection | Compromise propagates across tools (file→email, code→file) |
| 4 | Memory Poisoning | Attacker-controlled state persists across sessions |
| 5 | RAG Poisoning | Manipulated retrieval content presents as policy |
| 6 | Delegated Authority Abuse | Agent uses legitimately-held authority for attacker goals |
| 7 | Multi-Agent Propagation | Prompt infection spreads between cooperating agents |
| 8 | Context Boundary Violation | Unauthorized info flow via error/log/comment side-channels |
See taxonomy/SADF_Taxonomy_v1.pdf and taxonomy/threat_model.md for full details.
SADF3
│
├── README.md <- you are here
├── EVALUATION_TRACE.md <- verbatim terminal log, June 14 2026
│ (Llama 3.2, Claude Haiku, Claude Sonnet)
├── EVALUATION_TRACE_EXTENDED.md <- verbatim terminal logs for all 4 framework sweeps
│ (LangChain, AutoGen, CrewAI, SmolAgents)
├── MERGE_NOTES.md <- what's real vs. what was superseded
│
├── poster/
│ ├── SADF_DEFCON_AI_Village_Poster.pdf <- primary poster (65" display)
│ ├── SADF_DEFCON_AI_Village_Poster_Light.pdf <- same poster (backup)
│ ├── poster_source.pptx
│ ├── poster_figures/
│ │ ├── agent_ecosystem_diagram.png <- taxonomy diagram (no stats)
│ │ ├── scoring_comparison.png <- naive vs filtered scoring
│ │ ├── three_model_comparison.png <- 3 direct model ACR
│ │ ├── class_success_rates_7arch.png <- all 7 arch × 8 classes
│ │ └── architecture_acr_comparison.png <- 2.6× framework spread
│ └── SUPERSEDED/ <- old fabricated figures, kept for transparency
│
├── taxonomy/
│ ├── SADF_Taxonomy_v1.pdf
│ ├── threat_model.md
│ └── SUPERSEDED/ <- fabricated attack matrix, kept for transparency
│
├── framework/
│ ├── payloads.py - 32 payloads across 8 classes
│ ├── targets.py - Mock / API / Ollama adapters
│ ├── targets_extended.py - LangChain / AutoGen / CrewAI / SmolAgents adapters
│ ├── runner.py - refusal-filtered scoring engine
│ ├── reporter.py - JSON / Markdown report generation
│ ├── harness.py - CLI entry point (direct architectures)
│ ├── run_extended_sweep.py - CLI for framework architecture sweeps
│ └── results/
│ └── extended_evaluation_results.csv - 2,560 framework runs
│
├── datasets/
│ ├── evaluation_results.csv - 2,656 real rows across 7 architectures
│ ├── payload_library.json
│ └── attack_traces.json
│
├── experiments/
│ ├── methodology.md
│ └── reproducibility.md
│
├── findings/
│ ├── mitigations.pdf
│ └── SUPERSEDED/ <- fabricated findings, kept for transparency
│
└── disclosures/
└── disclosure_statement.md
Naive substring matching reported 90–100% success for Claude models. After refusal-filtered scoring: 59% (Llama 3.2), 22% (Claude Haiku), 16% (Claude Sonnet). Safety-trained models quote attack indicators verbatim in refusal explanations — naïve matching scores these as successes.
Holding the model constant (Claude Sonnet 4.6) and varying only the framework:
| Architecture | ACR |
|---|---|
| Direct Sonnet (API) | 15.6% |
| CrewAI | 11.9% |
| LangChain | 18.1% |
| AutoGen | 20.0% |
| SmolAgents | 31.1% |
A 2.6× spread driven entirely by framework architecture — same model throughout.
Llama 3.2: 3/3 (100%). Claude Haiku: 1/3 (33%). Claude Sonnet: 0/3 (0%). All four framework architectures: 0% across 240 runs (60 runs each). Safety training generalizes to the memory-write-with-attacker-content pattern in a way that framework structural controls alone do not.
Both Claude models: 0/4 (0%). Llama 3.2: 1/4 (25%). SmolAgents outlier: 13/80 (16.3%). Overall DAAR: 5.7%. Safety training captures purpose, not just pattern — it resists actions where every authorization check passes but the intent has been hijacked.
The only payloads to succeed across all 7 architectures. Safety training and per-tool authorization controls do not address these — they require purpose-level access controls that no tested architecture currently provides.
2,656 evaluation runs across 7 architectures:
| Architecture | Type | Runs | ACR |
|---|---|---|---|
| Llama 3.2 (Ollama) | Open-weight, direct | 32 | 59.4% |
| Claude Haiku (claude-haiku-4-5-20251001) | Safety-trained, direct | 32 | 21.9% |
| Claude Sonnet (claude-sonnet-4-6) | Safety-trained, direct | 32 | 15.6% |
| LangChain (Sonnet backend) | Framework wrapper | 640 | 18.1% |
| AutoGen (Sonnet backend) | Framework wrapper | 640 | 20.0% |
| CrewAI (Sonnet backend) | Framework wrapper | 640 | 11.9% |
| SmolAgents (Sonnet backend) | Framework wrapper | 640 | 31.1% |
Direct architectures: single pass per payload. Framework architectures: 20 reps per payload.
All runs used SimulatedToolEnvironment — no real systems accessed.
Agent Compromise Rate (ACR) = Compromised Runs / Total Runs — Overall: 20.7%
Delegated Authority Abuse Rate (DAAR) = Class 6 success rate — Overall: 5.7%
Cross-Tool Propagation Score (CTPS) = Class 3 success rate — Overall: 38.9%
Persistence Index (PI) = Persisted / Successful memory poisoning attacks
Every result traces to a real terminal session:
EVALUATION_TRACE.md— verbatim terminal log for the three direct architectures (Llama 3.2, Claude Haiku, Claude Sonnet), June 14, 2026EVALUATION_TRACE_EXTENDED.md— verbatim terminal logs for all four framework sweeps: LangChain (108 min, 0 errors), AutoGen (167 min, 0 errors), SmolAgents (468 min, 1 timeout), CrewAI (~107 min active, 0 errors)datasets/evaluation_results.csv— 2,656 rows withdata_provenancecolumn on every row
All evaluations conducted against SimulatedToolEnvironment. No real filesystem,
network, mail system, database, or third-party service was accessed.
See disclosures/disclosure_statement.md for full details.
Files in */SUPERSEDED/ contain earlier fabricated data (labeled
_FABRICATED_DO_NOT_USE) retained for transparency. They are not cited in any
submission.
SADF: A Taxonomy and Evaluation Framework for Agentic Security Failures.
2,656 real evaluation runs across 7 architectures (Llama 3.2, Claude Haiku,
Claude Sonnet, LangChain, AutoGen, SmolAgents, CrewAI), 32 payloads,
refusal-filtered scoring methodology.
DEF CON AI Village 2026 / Black Hat Europe / Black Hat MEA 2026.
Released for security research and defensive evaluation purposes.
See disclosures/disclosure_statement.md for responsible use guidelines.