Vulnerability Database
Browse Inkog’s comprehensive database of AI agent security vulnerabilities.
Each vulnerability includes detection rules, affected frameworks, and remediation guidance.
Prompt Injection
Unsanitized user input embedded in prompts allowing attackers to override system instructions.
Tainted Eval/Exec
LLM-generated or user-controlled code executed via eval(), exec(), or equivalent functions.
Hardcoded Credentials
API keys, passwords, or tokens hardcoded in source files instead of using environment variables.
Infinite Loop
Loop condition depends on LLM output without deterministic termination guarantee.
SQL Injection via LLM
LLM-generated SQL queries concatenated without parameterization allowing database attacks.
Output Validation Failures
LLM output used in dangerous sinks (eval, HTML, SQL, commands) without validation.
Cross-Tenant Data Leakage
Data from one tenant accessible to another due to improper isolation in multi-tenant systems.
Unsafe Deserialization
Untrusted data deserialized via pickle or YAML allowing arbitrary code execution.
Vulnerability Categories
Injection Attacks
Vulnerabilities where untrusted input manipulates AI behavior:
- Prompt Injection: User input alters LLM instructions
- Indirect Prompt Injection: Malicious content in retrieved data
- Template Injection: Dynamic template construction with user data
Authorization & Access Control
Improper access controls in agent systems:
- Tool Use Without Validation: Agents execute tools without input checks
- Privilege Escalation: Agents perform actions beyond intended scope
- Missing Authentication: Unprotected agent endpoints
Memory & State
Vulnerabilities in agent memory and state management:
- Memory Poisoning: Malicious data persisted to long-term memory
- State Manipulation: Session state altered by untrusted input
- Context Window Attacks: Exceeding context limits to truncate instructions
Information Disclosure
Unintended exposure of sensitive information:
- Chain-of-Thought Leakage: Internal reasoning exposed to users
- System Prompt Extraction: Attackers extract hidden instructions
- Sensitive Data in Prompts: Credentials or PII in prompt text
Code Execution
Risks from dynamic code execution:
- Unrestricted Code Interpreters: Sandbox escapes in code tools
- Unsafe Deserialization: Arbitrary object instantiation
- Command Injection: Shell commands with user input
Severity Levels
| Level | Description | Response |
|---|---|---|
| Critical | Immediate exploitation possible, severe impact | Fix immediately, block deployment |
| High | Likely exploitable with significant impact | Fix before next release |
| Medium | Exploitable under specific conditions | Fix in normal development cycle |
| Low | Limited exploitability or impact | Track and address as time permits |
OWASP LLM Top 10 Mapping
Inkog rules map to the OWASP Top 10 for LLM Applications . Not every category is detected; see the status definitions on the coverage page.
OWASP GenAI LLM Top 10 2026. Full status definitions and notes: OWASP LLM Top 10 coverage.
| OWASP LLM | Inkog rules |
|---|---|
| LLM01: Prompt Injection | prompt_injection, prompt_template, skill_tool_poisoning |
| LLM02: Sensitive Information Disclosure | cross_tenant, hardcoded_credentials, logging_sensitive_data, pii_filter_wiring, skill_cross_origin, unsafe_env_access |
| LLM03: Excessive Agency | excessive_permissions, goal_conflict_detection, missing_authz, missing_oversight, skill_autonomy_abuse, skill_excessive_permissions, token_validation |
| LLM04: Supply Chain | skill_supply_chain, supply_chain, unsafe_deserialization |
| LLM05: Data and Model Poisoning | data_poisoning |
| LLM06: Unbounded Consumption | context_exhaustion, infinite_loop, missing_rate_limits, recursive_tool_calling, token_bombing |
| LLM07: Misinformation | overreliance |
| LLM08: Hidden Context Exposure | system_prompt_leak |
| LLM09: Vector and Embedding Weaknesses | rag_overfetching |
| LLM10: Improper Output Handling | command_injection, exec_eval, output_validation, path_traversal, sql_injection, ssrf |
OWASP Top 10 for Agentic Applications
Rules also carry OWASP Top 10 for Agentic Applications 2026 ids, delivered in compliance_mapping.owasp_agentic_threats:
OWASP Top 10 for Agentic Applications 2026. Generated from the rule engine’s metadata; do not edit by hand.
| Category | Status | Rules that stamp this id |
|---|---|---|
| ASI01: Agent Goal Hijack | Active detection | goal_conflict_detection, prompt_injection, prompt_template, skill_tool_poisoning |
| ASI02: Tool Misuse and Exploitation | Active detection | output_validation, path_traversal, sql_injection, ssrf |
| ASI03: Identity and Privilege Abuse | Active detection | cross_tenant, excessive_permissions, hardcoded_credentials, missing_authz, skill_excessive_permissions, token_validation, unsafe_env_access |
| ASI04: Agentic Supply Chain Vulnerabilities | Active detection | skill_supply_chain, supply_chain |
| ASI05: Unexpected Code Execution | Active detection | command_injection, exec_eval, unsafe_deserialization |
| ASI06: Memory and Context Poisoning | Active detection | data_poisoning, rag_overfetching |
| ASI07: Insecure Inter-Agent Communication | Active detection | skill_cross_origin, unsigned_messages |
| ASI08: Cascading Failures | Active detection | context_exhaustion, infinite_loop, missing_rate_limits, recursive_tool_calling, token_bombing |
| ASI09: Human-Agent Trust Exploitation | Active detection | overreliance, skill_autonomy_abuse |
| ASI10: Rogue Agents | Active detection | missing_oversight |
Palo Alto Unit 42 Threat Categories
Inkog detects logic flaws and security risks across the 7 Agentic AI Threat Categories identified by Palo Alto Unit 42:
| Category | Inkog Coverage |
|---|---|
| 1. Prompt Injection | Full coverage |
| 2. Tool Misuse | Full coverage |
| 3. Intent Breaking | Partial (goal conflict detection) |
| 4. Identity Spoofing | Full coverage |
| 5. Unexpected RCE | Full coverage |
| 6. Agent Comms Poisoning | Full coverage |
| 7. Resource Overload | Full coverage |
Rule ids in scan output
Every finding carries a pattern_id (for example exec_eval, sql_injection, missing_oversight). Use it to suppress a finding with an inline comment or a .inkogignore entry; see Configuration. The full list of rule ids, grouped by OWASP category, is on the OWASP coverage page.
Requesting a rule
Detection rules are maintained in Inkog’s engine and ship to every scan without an upgrade. To request a new rule or report a false positive, open an issue on github.com/inkog-io/inkog with a minimal vulnerable example and, if possible, the safe variant. Custom organization-specific rules are not user-configurable today.