Exploitation

Exploitation of AI systems covers techniques that use confirmed weaknesses to gain access, execute unintended actions, retrieve protected data, or cause measurable impact. Unlike traditional exploitation, AI exploitation does not always require a CVE or a memory corruption bug. The attack surface includes the model's instruction-following behavior, the retrieval pipeline feeding it context, the tools it can call, and the infrastructure hosting it.

AI exploitation techniques span from pure prompt manipulation — requiring only a chat interface — to deep infrastructure attacks against vector databases, model serving endpoints, and orchestration frameworks. The sections here are organized by attack surface rather than by technique, reflecting how these attacks are encountered during real assessments of AI-enabled environments.

Sections

Prompt and Agent Attacks covers the model's input handling as the attack surface — prompt injection, jailbreaking, system prompt extraction, memory poisoning, and indirect injection through content the agent retrieves.

Multi-Agent Systems covers trust relationship abuse between agents in pipelines — message manipulation, agent impersonation, workflow corruption, delegated trust exploitation, and shared memory poisoning.

RAG Pipelines covers the retrieval layer as an attack surface — knowledge base poisoning, retrieval parameter manipulation, direct vector database access, chunking behavior exploitation, and persistent vector store implants.

Embeddings and Model Internals covers statistical properties of trained models as an attack surface — embedding inversion, membership inference, model extraction, memorized data recovery, and adversarial classifier bypass.

Orchestration and Tool Surfaces covers the agent's tool execution layer — MCP server abuse, tool integration exploitation, over-permissioned scope abuse, lateral movement through connected services, and function calling manipulation.