SecureAEye LAB ONLINE · SIG 657 · DET ~41s

The AI-native frontier

57 of 657 attack types are genuinely AI-native. AI mostly accelerates the classic 600; this handful is the new ground. The gap below is the point: mitigations exist, but measured defense barely does.

57
AI-native types
44
Have a mitigation
4
Have detection content
0
Lab-measured
Readiness gap AI 57 vs classic 600

Share of each group that clears each bar. The AI-native line collapses at detection and lab.

Has a mitigation AI 44 · cls 372
Has detection content AI 4 · cls 357
Has a test AI 1 · cls 171
Lab-measured AI 0 · cls 43
AI-nativeClassic
Framework alignment AI-native

Where the AI-native set is mapped — ATLAS, OWASP and the classic frameworks.

atlas47
owasp-asi10
owasp-llm9
attack7
cwe5
cve3
The 57 AI-native attacks coverage status
AttackSeverityMitig.DetectTestLab
Adversarial examples / evasionhigh●———
Agent identity & privilege abusehigh●———
Agent-to-agent wormhigh●———
Agentic supply chain (malicious skills/plugins)high●———
AI coding-assistant config / key theftmedium●●●—
AI-agent-assisted cybercrime operations (BUGSTER case study)medium●———
AI-augmented fake IT worker infiltrationhigh●———
AI-driven vulnerability discovery / exploit generationhigh●●——
AI-enabled disinformation / influence opsmedium————
AI-generated / polymorphic malwarehigh●●——
AI-orchestrated intrusionvery-high————
Attribute / property inferencemedium●———
Backdoor / sleeper-agent poisoninghigh●———
Cascading failures (multi-agent)high————
Cost harvesting / LLMjackinghigh●———
Cross-server tool shadowinghigh————
Deepfake KYC bypass / injectionhigh●———
Denial of AI service / unbounded consumptionhigh●———
Direct prompt injectionhigh●———
Excessive agency / agent goal hijackhigh●———
Exfiltration via markdown image renderinghigh●———
Human-agent trust exploitationmedium————
Improper output handlinghigh————
Indirect prompt injectionhigh●———
Injection via calendar / logs / issueshigh●———
Insecure inter-agent communicationmedium————
Jailbreakingmedium●———
LLM-assisted phishing at scalehigh●———
Malicious model files / pickle deserializationvery-high●———
MCP rug pullhigh————
MCP tool poisoninghigh————
Membership inferencemedium●———
Memory / context poisoninghigh●———
Misinformation / hallucination exploitationmedium————
MLflow prompt model-version source arbitrary file read (CVE-2026-116690)high●———
Model distillation attackmedium●———
Model extraction / stealinghigh●———
Model hub supply chainhigh●———
Model inversion / data reconstructionhigh●———
Model poisoninghigh●———
Multimodal / image prompt injectionhigh●———
Prompt obfuscationhigh●———
Publishing poisoned models / datasetsvery-high●———
RAG poisoninghigh●———
Rogue agentshigh————
Sensitive information disclosurehigh●———
Slopsquattinghigh————
Sponge / energy-latency attackmedium●———
System prompt leakagemedium●———
Tool misuse & exploitationvery-high●———
Training data poisoninghigh●———
Trojanized AI packages / MCP serversvery-high●———
Unexpected code execution via agentshigh●———
Vector & embedding weaknessesmedium●———
Vibe-hacking data extortionhigh●●——
vLLM untrusted EPS image to Ghostscript execution (CVE-2026-115915)high●———
Zero-click injection via documents/emailhigh————

● = present · — = none. Lab is all —: 0 of 57 AI-native attacks have been detonated in the lab. That is unmeasured, not proven-undetectable — the honest state, and the research queue.