Prerequisite: Structural techniques, Composition, understanding of target system architecture
Attack the tools, memory, retrieval systems, and infrastructure surrounding the model. When the target is an agent, the attack surface extends beyond the prompt.
Agentic & Infrastructure Attacks
You’re testing a customer service agent. It has access to a knowledge base, a ticketing system, and a calendar tool. You’ve tried persona attacks, encoding, multi-turn escalation. All refused.
Then you notice something. The knowledge base accepts document uploads from authorized users. You upload a document titled “Updated Service Policy” containing hidden instructions that override the agent’s behavior. The next time the agent retrieves from the knowledge base, it follows your instructions.
You didn’t attack the model. You attacked the system the model is deployed in.
Prompting mechanism: Agentic attacks extend the system/user instruction boundary beyond the prompt into infrastructure. Tool descriptions, retrieval pipelines, and orchestration layers become additional surfaces where instructions can be injected across structural boundaries. See System vs User Prompts and Structural Delimiters for the foundations.
The shift from prompt to infrastructure
Everything in the prompt-level and structural technique tiers targets the model through its prompt interface. You craft text that the model reads and processes. Infrastructure attacks are different. They target the components around the model: the data it retrieves, the tools it uses, the memory it trusts, the protocols it communicates through.
This matters because:
- Infrastructure attacks can persist across sessions (poisoned memory, poisoned documents)
- They can affect multiple users (a poisoned knowledge base document affects everyone who triggers that retrieval)
- They can be deployed without direct access to the model’s prompt interface (a malicious document in an email, a compromised MCP tool)
- They bypass prompt-level safety entirely because they operate at a different layer
The attack surface is the system architecture, not the conversation.
Attack surfaces
Infrastructure attacks organize by what you’re targeting. Each attack surface requires different assessment, different techniques, and different indicators of success.
| Attack Surface | What you target | Key technique |
|---|---|---|
| Data Pipeline | Knowledge bases, retrieved documents, web content, emails, API responses | RAG poisoning, indirect prompt injection |
| Tool Exploitation | MCP tool descriptions, function calls, exfiltration via tool invocation | Tool poisoning, exfiltration |
| Agent State | Persistent memory, user preferences, stored context | Context poisoning, goal hijacking |
| Multi-Agent & Reconnaissance | Inter-agent communication, system configuration, supply chain | Agent spoofing, configuration discovery |
The diagnostic logic
Start with reconnaissance. Ask the agent what tools it has, what data sources it uses, and how it processes requests. Most agents will tell you. This maps the attack surface before you probe it.
Identify the least defended surface. Most AI security focuses on what users type (prompt-level content filtering). Tool descriptions, retrieved documents, memory entries, and inter-agent messages receive less scrutiny.
Test persistence. Infrastructure attacks are most valuable when they persist. A poisoned document stays until removed. A poisoned memory persists across sessions. A poisoned tool description executes on every invocation. Assess which attack surfaces provide persistent access.
Map the trust model. What does the agent trust? Retrieved documents? Tool descriptions? Other agents? User-provided preferences? Each trusted source is a potential injection point. The agent’s trust model is the architecture of its vulnerability.
When to move to infrastructure techniques
Prompt-level and structural techniques target the model’s reasoning. Infrastructure techniques target the system. Use the diagnostic logic from the techniques overview:
You see consistent refusals across prompt-level approaches and the target uses tools, retrieves data, or runs as an agent. The model’s safety training is robust. But the system around it may not be.
The target has external data sources. RAG, web search, email processing, document ingestion. Each data source is an injection vector.
The target has tool access. MCP tools, function calling, code execution, database queries. Each tool is an exploitation surface.
The target uses persistent memory. If context carries across sessions, state manipulation is viable.
The target is multi-agent. If multiple agents coordinate, the trust relationships between them are attack surfaces.
Your turn
You’re testing a coding assistant agent. It has access to: a file reader, a code executor, a web search tool, and persistent memory. It’s deployed via MCP.
You have four attack surfaces: the data it reads (files), the tools it uses (MCP descriptions), the memory it trusts (persistent state), and the protocols it communicates through (MCP transport).
Which attack surface would you probe first? Why? What would a successful attack on each surface look like? And which surface is likely least defended, given that most AI security focuses on prompt-level content filtering rather than infrastructure security?
Practitioner analysis
Start with reconnaissance via the chat interface: ask the agent what tools it has, what its permissions are, and what its system prompt says. Many coding assistants will reveal this. Then probe the tool descriptions (MCP): if you can see or infer tool descriptions, check for injection opportunities. Tools are often the least defended surface because developers focus on prompt-level safety and treat tool descriptions as trusted configuration.
The file reader is the next target: files the agent reads could contain injected instructions. Memory is the highest-impact target if you can access it, since poisoned memory persists across sessions. The key principle: most AI security focuses on what users type. Tool descriptions, file contents, and memory entries receive less scrutiny.
References
- MITRE ATLAS. Adversarial Threat Landscape for AI Systems. 2025. AML.T0051, AML.T0070, AML.T0080, AML.T0084, AML.T0086.
- Wang, Z., Gao, Y., et al. “MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers.” 2025.
- PyRIT (Microsoft). XPIAOrchestrator for cross-prompt injection testing.
- OWASP Top 10 for Agentic Applications. 2026.
Exercise: Vulnerability Framing maps the full attack surface of an agentic system (execution gaps, evaluation gaps, misalignments) before choosing infrastructure techniques.
Compose: Build with agentic techniques in the interactive prompt composer.