ATX-1: AEGIS Threat Matrix — Technique Taxonomy

Adversarial Knowledge Base for Agentic AI Actor Behavior

Version: 2.4.0
Date: 2026-05-29
Status: Active — v2.4 adds Termination Poisoning (T6003) under TA006 with 10 sub-techniques mapped to the strategies of Xu et al. (LoopTrap, arXiv:2605.05846). Severity remains removed (v2.3) for MITRE alignment.
Maintainer: AEGIS Initiative
License: CC-BY-SA-4.0

Table of Contents

1. Executive Summary
2. The Gap
3. Structural Root Causes
4. Tactic Taxonomy
5. Technique Catalog
6. AEGIS Mitigation Mapping
7. OWASP Top 10 LLM Cross-Reference
8. Methodology Precedent
9. Relationship to Existing Frameworks
10. References

1. Executive Summary

MITRE ATT&CK catalogs how human adversaries attack computer systems. MITRE ATLAS catalogs how adversaries attack AI and machine learning systems. Neither framework addresses the scenario where the AI agent itself is the threat source — not because it has been compromised or is acting maliciously, but because it possesses capability without adequate governance constraint.

ATX-1 (AEGIS Threat Matrix — Agentic Exploitation and Governance Intelligence Schema) fills this gap. It provides a structured taxonomy of tactics, techniques, and mitigations for agentic AI actors operating outside their governance boundaries. There is no malicious intent. There is no external adversary. Harm emerges from capability without constraint.

ATX-1 is empirically grounded in the Agents of Chaos study (Shapira et al., arXiv:2602.20021, February 2026), in which 20 researchers over 2 weeks documented 11 distinct failure modes in live agentic AI deployments. These failures form the case study basis for every technique in this taxonomy.

The taxonomy defines 10 tactics and 30 techniques (plus 39 sub-techniques), each mapped to empirical case studies, constitutional governance articles, and AEGIS Governance Protocol (AGP) mitigation mechanisms. The original 9 tactics and 20 techniques are grounded in the Agents of Chaos research. TA010 (Act Beyond Governance Interpretation) and its 4 techniques were discovered during adversarial testing of the AEGIS Claude Code Plugin (RFC-0006) on 2026-03-26.

2. The Gap

Existing adversarial frameworks assume a clear separation between attacker and target. Agentic AI dissolves this separation.

Framework Comparison

The Canonical Example

An AI agent with email access deletes emails it has the capability to delete but no authority to delete. There is no attacker. There is no exploit. There is no prompt injection. The agent has a tool, the tool works, and the agent uses it in a context where its use is unauthorized.

This failure mode is invisible to ATT&CK (no human adversary) and invisible to ATLAS (no attack on the AI system). It is the defining concern of ATX-1: what happens when capable agents act without governance?

The Authority-Capability Distinction

ATT&CK and ATLAS operate in a world where capability implies authority — if an adversary gains access, they intend to use it. ATX-1 operates in a world where capability and authority are fundamentally decoupled:

• Capability: what the agent can do (tool access, API permissions, system privileges)
• Authority: what the agent may do (delegated by a specific principal, for a specific scope, at a specific time)

Every ATX-1 technique exploits the gap between these two.

3. Structural Root Causes

The Agents of Chaos study identified four structural root causes that underlie all observed failure modes. These are not implementation bugs — they are architectural gaps present in current agentic AI deployment patterns.

RC1: No Stakeholder Model

Current agentic systems lack formal models of who has authority over what. There is no representation of principals (owners, operators, users), no delegation chains, and no mechanism to verify that an instruction comes from a party with authority to issue it.

Consequence: Agents treat all instructions equivalently, regardless of source authority. A user’s casual suggestion carries the same weight as an owner’s explicit policy.

RC2: No Self-Model

Agents have no formal representation of their own boundaries — what they are authorized to do, what resources they may consume, what information they may disclose, and to whom. Without a self-model, agents cannot reason about whether a proposed action is within their governance scope.

Consequence: Agents cannot distinguish between “I can do this” and “I should do this.” Every capability is exercised without governance reflection.

RC3: No Private Deliberation Surface

Current architectures provide no space for agents to reason about governance constraints before acting. All reasoning is either visible to the user (creating social pressure to comply) or compressed into the action itself (eliminating deliberation entirely).

Consequence: Agents face a choice between transparent refusal (creating conflict) and silent compliance (violating governance). There is no space for nuanced governance reasoning.

RC4: Prompt Injection Is Structural

Prompt injection is not merely an input validation failure — it is a structural consequence of architectures that commingle instructions, data, and governance constraints in a single context. As long as instructions and data share a channel, injection is inherent.

Consequence: Any system that retrieves external content and processes instructions in the same context is structurally vulnerable to governance override via content manipulation.

RC5: No Environment Model

The governance layer operates on an abstraction of the execution environment — evaluating actions as “file write,” “shell command,” or “network request” — but lacks a complete model of what the execution environment actually does with those actions. The environment provides capabilities (pseudo-filesystem network interfaces, auto-executed configuration files, deferred execution hooks, tool-specific instruction loading) that exist below the governance model’s abstraction level.

Consequence: Actions that the governance layer evaluates and permits as one type (a safe file write) may produce entirely different effects (a network connection, code execution, persistent behavioral modification) because the environment translates them through mechanisms invisible to governance. An allowlist is only as good as the governance layer’s understanding of what the allowed actions actually do.

Discovery: RC5 was identified during white-box adversarial testing of the AEGIS Claude Code Plugin (RFC-0006) on 2026-03-26, when systematic probing revealed that the execution environment (bash, OS, toolchain) provides capabilities that are structurally invisible to a governance layer operating at the tool-call abstraction level.

4. Tactic Taxonomy

ATX-1 defines 10 tactics. In ATX-1, tactics represent distinct classes of agent-induced system failure — not adversary objectives. This distinguishes ATX-1 from ATT&CK, where tactics model adversary intent.

TA001: Violate Authority Boundaries

Description: The agent acts on instructions it is not authorized to follow, or exceeds the authority delegated to it by a legitimate principal. Exploits Authority and Identity primitives.

Key Question: Did the agent verify that the instruction source holds authority for the requested action scope?

Techniques: T1001 (Execute Non-Owner Instruction), T1002 (Infer Implicit Authority), T1003 (Propagate Spoofed Authority at Scale)

TA002: Exceed Operational Scope

Description: The agent performs actions beyond the explicitly delegated task scope, including via tool invocation, expanding objectives autonomously or performing unvalidated bulk operations. Exploits Delegation and Objective Control primitives.

Key Question: Is the action within the scope and proportionality of the delegated objective?

Techniques: T2001 (Expand Task Scope Autonomously), T2002 (Perform Unvalidated Bulk Operations), T2003 (Obscure Objective Through Delegation), T2004 (Exploit Tool-Chain Composition)

TA003: Compromise System Integrity

Description: The agent takes actions through direct or tool-mediated system interaction that cause irreversible damage, cascading failures, or unrecoverable state changes. Exploits State and Environment primitives.

Key Question: Could this action cause irreversible or cascading changes to system state?

Techniques: T3001 (Perform Irreversible Destructive Action), T3002 (Trigger Cascading System Changes)

TA004: Expose or Exfiltrate Information

Description: The agent discloses information to recipients who are not authorized to receive it, whether through direct exfiltration, cross-session data leakage, or tool-mediated data transfer. Exploits Memory, Context, and Data Boundaries primitives.

Key Question: Is the recipient authorized to receive this information, and was disclosure explicitly sanctioned?

Techniques: T4001 (Exfiltrate Context-Scoped Data), T4002 (Leak Cross-Session or Persistent Data), T4003 (Cross-Domain Secret Leakage)

TA005: Violate State Integrity

Description: The agent reports, represents, or records system state that diverges from actual state — whether through false completion reports, fabricated attribution, or suppressed failure signals. Exploits State and Observability primitives.

Key Question: Does the reported state match the actual, verified system state?

Techniques: T5001 (Report False Task Completion), T5002 (Fabricate Action Attribution), T5003 (Suppress or Omit Execution Failure)

TA006: Abuse Resource Allocation

Description: The agent consumes computational, storage, network, or external resources without bound, either through recursive invocation loops or unbounded external resource consumption. Exploits Resource Control primitives.

Key Question: Are resource consumption and execution bounded and proportionate to the task?

Techniques: T6001 (Execute Recursive Invocation Loops), T6002 (Consume Unbounded External Resources), T6003 (Poison Termination Judgment)

TA007: Manipulate Agent Interactions

Description: The agent exploits multi-agent communication, delegation, and trust relationships to spoof identities, inject malicious delegations, or induce behavioral drift in peer agents. Exploits Coordination and Identity primitives.

Key Question: Has the agent verified the identity, provenance, and authorization of peer agents and inherited configurations?

Techniques: T7001 (Spoof Agent Identity), T7002 (Inject Malicious Delegation Chains), T7003 (Induce Cross-Agent Behavioral Drift), T7004 (Induce Unsafe Consensus)

TA008: Establish or Modify Persistence

Description: The agent writes malicious data into persistent stores or modifies governance/policy state, establishing persistence that corrupts future interactions or alters agent behavior beyond the current session. Exploits Memory and Governance State primitives.

Key Question: Could this action create state or instructions that persist beyond the current authorized session?

Techniques: T8001 (Poison Persistent Memory), T8002 (Corrupt Governance or Policy State)

TA009: Evade Detection or Oversight

Description: The agent operates outside monitoring boundaries or obfuscates action traceability, undermining the ability of operators and governance systems to observe, audit, and control agent behavior. Exploits Observability and Control Planes primitives.

Key Question: Are all of the agent’s actions observable and faithfully recorded by the governance layer?

Techniques: T9001 (Operate Outside Monitoring Boundaries), T9002 (Obfuscate Action Traceability)

TA010: Act Beyond Governance Interpretation

Description: The agent performs actions whose actual effects are invisible to the governance layer because the execution environment provides capabilities below the governance model’s abstraction level. The governance layer evaluates an action as one type (file write, shell command) but the environment executes it as a fundamentally different type (network connection, code execution, instruction injection). Exploits Environment Model primitives. Introduced in ATX-1 v2.1.

Key Question: Does the governance layer have a complete model of what the execution environment will actually do with this action?

Techniques: T10001 (Exploit Pseudo-Filesystem Capabilities), T10002 (Establish Persistence via Environment Auto-Execution), T10003 (Inject Persistent Agent Instructions), T10004 (Exploit Governance-Runtime Parser Divergence)

5. Technique Catalog

TA001: Violate Authority Boundaries

T1001: Execute Non-Owner Instruction

T1002: Infer Implicit Authority

T1003: Propagate Spoofed Authority at Scale

TA002: Exceed Operational Scope

T2001: Expand Task Scope Autonomously

T2002: Perform Unvalidated Bulk Operations

T2003: Obscure Objective Through Delegation

T2004: Exploit Tool-Chain Composition

TA003: Compromise System Integrity

T3001: Perform Irreversible Destructive Action

T3002: Trigger Cascading System Changes

TA004: Expose or Exfiltrate Information

T4001: Exfiltrate Context-Scoped Data

T4002: Leak Cross-Session or Persistent Data

T4003: Cross-Domain Secret Leakage

TA005: Violate State Integrity

T5001: Report False Task Completion

T5002: Fabricate Action Attribution

T5003: Suppress or Omit Execution Failure

TA006: Abuse Resource Allocation

T6001: Execute Recursive Invocation Loops

T6002: Consume Unbounded External Resources

T6003: Poison Termination Judgment

TA007: Manipulate Agent Interactions

T7001: Spoof Agent Identity

T7002: Inject Malicious Delegation Chains

T7003: Induce Cross-Agent Behavioral Drift

T7004: Induce Unsafe Consensus

TA008: Establish or Modify Persistence

T8001: Poison Persistent Memory

T8002: Corrupt Governance or Policy State

TA009: Evade Detection or Oversight

T9001: Operate Outside Monitoring Boundaries

T9002: Obfuscate Action Traceability

TA010: Act Beyond Governance Interpretation

T10001: Exploit Pseudo-Filesystem Capabilities

T10002: Establish Persistence via Environment Auto-Execution

T10003: Inject Persistent Agent Instructions

T10004: Exploit Governance-Runtime Parser Divergence

5.11 Sub-Techniques

Sub-technique IDs use the format T####.###. All sub-techniques inherit the root cause and mitigation framing of their parent. Full definitions are in v2/data/atx-1-techniques.json and the STIX 2.1 bundle.

T6003 sub-techniques (Poison Termination Judgment)

• T6003.001 — Shift the Completion Target: Maps to LoopTrap strategy “Expanding Horizon” (moving coverage target).
• T6003.002 — Inject Open-Ended Subgoals: Maps to LoopTrap strategy “Incremental Milestone” (never-ending sub-goals).
• T6003.003 — Assert Asymptotic Incompletion: Maps to LoopTrap strategy “Diminishing Returns” (asymptotic near-completion).
• T6003.004 — Fabricate Authority Directives: Maps to LoopTrap strategy “Authority Override” (fabricated system directives).
• T6003.005 — Invoke Sunk-Cost Framing: Maps to LoopTrap strategy “Sunk Cost Trap” (invested-effort framing).
• T6003.006 — Appeal to Expert Norms: Maps to LoopTrap strategy “Social Proof” (appeal to expert norms).
• T6003.007 — Force Recursive Verification: Maps to LoopTrap strategy “Recursive Decomposition” (infinite verification regression).
• T6003.008 — Impose Circular Prerequisites: Maps to LoopTrap strategy “Dependency Chain” (circular prerequisites).
• T6003.009 — Reward Continued Execution: Maps to LoopTrap strategy “Positive Reinforcement” (step-wise praise).
• T6003.010 — Introduce Fabricated Scoring: Maps to LoopTrap strategy “Gamification Trap” (fabricated scoring system).

T9002 sub-techniques (Obfuscate Action Traceability)

• T9002.001 — Encode Commands in Base64 / Hex / URL Encoding: The agent encodes commands in base64, hex, or URL encoding before execution (e.g., echo Y3VybCAuLi4= \| base64 -d \| bash).
• T9002.002 — Variable Indirection / Dynamic Command Construction: The agent splits the command name from its invocation across separate tokens via shell variable assignment (e.g., CMD=curl; $CMD https://...).

T10001 sub-techniques (Exploit Pseudo-Filesystem Capabilities)

• T10001.001 — Use /dev/tcp Network Socket Access: The agent uses bash’s /dev/tcp/host/port pseudo-filesystem to perform network I/O via what looks like file I/O (e.g., exec 3<>/dev/tcp/example.com/80).
• T10001.002 — Use /dev/udp Network Socket Access: The UDP equivalent of T10001.001 — the agent uses /dev/udp/host/port to send UDP datagrams via apparent file I/O.
• T10001.003 — Read /proc Pseudo-Filesystem for Information Disclosure: The agent reads process and kernel state via /proc/* paths (e.g., /proc/self/environ, /proc/*/cmdline, /proc/net/tcp) that the governance layer treats as ordinary files.

T10002 sub-techniques (Establish Persistence via Environment Auto-Execution)

• T10002.001 — Persist via Shell Initialization Files: The agent writes commands to .bashrc, .profile, .zshrc, or equivalents so they execute on every new shell session.
• T10002.002 — Persist via Git Hooks: The agent writes scripts to .git/hooks/* (pre-commit, post-commit, post-checkout, etc.) so they execute on every git operation.
• T10002.003 — Persist via Package Manager Scripts: The agent injects commands into package.json scripts, setup.py, or equivalent install hooks so they execute on the next npm install, pip install, or build invocation.
• T10002.004 — Persist via IDE Task Definitions: The agent writes commands to .vscode/tasks.json, .idea/runConfigurations/, or similar IDE configuration files so they run when the user invokes the corresponding task or opens the project.
• T10002.005 — Persist via Container Build Files: The agent injects commands into Dockerfile, docker-compose.yml, or equivalent container build files so they execute during the next image build and persist into the resulting container image.
• T10002.006 — Persist via Git Config Aliases and Hooks: The agent uses git config alias.X '!command' to register command-substitution aliases that execute arbitrary shell on any subsequent git invocation.
• T10002.007 — Persist via Package Manager Configs: The agent writes auto-execution hooks into .npmrc, .pypirc, .cargo/config.toml, or equivalent package manager configuration files.
• T10002.008 — Persist via Build System Files: The agent injects commands into Makefile, CMakeLists.txt, build.gradle, or equivalent build system files.

T10003 sub-techniques (Inject Persistent Agent Instructions)

• T10003.001 — Inject Persistent Instructions via Claude Code Configuration Files: The agent writes to project-level configuration files that the Claude Code CLI auto-loads into model context on every invocation (e.g., CLAUDE.md, .claude/rules/).
• T10003.002 — Inject Persistent Instructions via Cursor Configuration Files: The agent writes attacker-controlled instructions to .cursorrules files that the Cursor IDE auto-loads as system prompt context for every model interaction in the project.
• T10003.003 — Inject Persistent Instructions via Windsurf Configuration Files: The agent writes attacker-controlled instructions to .windsurfrules files that the Windsurf editor auto-loads into every model interaction in the workspace.
• T10003.004 — Inject Persistent Instructions via GitHub Copilot Configuration Files: The agent writes to .github/copilot-instructions.md which GitHub Copilot auto-loads as repository-level context for all code completions and chat interactions in the repo.
• T10003.005 — Inject Persistent Instructions via Aider Configuration Files: The agent writes to .aider.conf.yml which the Aider CLI auto-loads to configure model behavior, system prompts, and tool permissions on every invocation.
• T10003.006 — Inject Persistent Instructions via Continue Configuration Files: The agent writes to .continuerc.json which the Continue IDE extension auto-loads as workspace-level configuration for model and tool behavior.

T10004 sub-techniques (Exploit Governance-Runtime Parser Divergence)

• T10004.001 — Use Command Chaining Operators: The agent uses shell operators (\|, &&, \|\|, ;) to chain an allowed command with a denied one (e.g., ls && curl ...).
• T10004.002 — Inject Newline as Command Separator: The agent embeds a literal \n in command arguments.
• T10004.003 — Inject CRLF as Command Separator: Variant of T10004.002 using \r\n to bypass governance filters that strip \n but preserve \r.
• T10004.004 — Bypass via Heredoc: The agent uses heredoc syntax (<<EOF) to pass multi-line payloads to a shell or interpreter.
• T10004.005 — Truncate Path with Null Byte: The agent embeds a null byte (\x00) in a path.
• T10004.006 — Evade Path Comparison via Unicode Homoglyphs: The agent uses Unicode characters that visually match protected path characters but bypass byte-level string comparison (e.g., Cyrillic ‘е’ vs.
• T10004.007 — Inject via Subshell or Backticks: The agent embeds $(command) or `command` substitution inside an otherwise-allowed command.
• T10004.008 — Bypass Protected Path via Alternate Absolute Path: The agent uses an alternate absolute path that resolves to the same protected target (e.g., /etc/passwd blocked but /var/../etc/passwd permitted).
• T10004.009 — Bypass Protected Path via Path Traversal: The agent uses ../ sequences to escape a permitted directory and access a protected target (e.g., ~/safe/../../../etc/passwd).
• T10004.010 — Redirect Output to Protected Path: The agent uses shell redirection (>, >>, tee) to write to a protected path via an otherwise-allowed command (e.g., echo X > /etc/passwd).

6. AEGIS Mitigation Mapping

7. OWASP Top 10 LLM Cross-Reference

The OWASP Top 10 for Large Language Model Applications identifies security risks in LLM deployments. The key distinction: OWASP addresses risks to LLM applications; ATX-1 addresses risks from agentic AI actors.

LLM01: Prompt Injection

LLM02: Sensitive Information Disclosure

LLM06: Excessive Agency

LLM07: System Prompt Leakage

LLM10: Unbounded Consumption

8. Methodology Precedent

ATX-1 follows the methodology established by MITRE ATT&CK and MITRE ATLAS for building adversarial knowledge bases, as documented in the ATT&CK Design and Philosophy paper (Strom et al., 2020).

ATT&CK: The Precedent

ATT&CK began with Fort Meade eXperiment (FMX) in 2013, a controlled adversarial exercise within MITRE’s internal network. Researchers observed real adversary behavior in a monitored environment and systematically cataloged the techniques used. ATT&CK was published in 2015 with 96 techniques derived from this empirical foundation.

“The types of information that went into ATT&CK, namely the behaviors and techniques used by adversaries, may also be useful for other work to derive similar models for other technology domains.” — Strom et al., “MITRE ATT&CK: Design and Philosophy” (2020)

ATLAS: The Extension

MITRE ATLAS (Adversarial Threat Landscape for AI Systems) extended the ATT&CK methodology to adversarial machine learning, developed through a partnership between MITRE and Microsoft. ATLAS catalogs techniques used by adversaries to attack AI/ML systems, maintaining structural alignment with ATT&CK while addressing AI-specific threat vectors.

ATX-1: The Completion

ATX-1 applies the identical methodology to the remaining gap: AI agents as threat sources.

The Agents of Chaos study (Shapira et al., 2026) is the ATX-1 equivalent of FMX: a structured empirical exercise in which researchers systematically documented failure modes in live agentic AI deployments. The 11 case studies from this research provide the empirical grounding for every technique in the ATX-1 taxonomy.

Methodological Alignment

ATX-1 maintains structural alignment with ATT&CK and ATLAS:

• Tactics represent adversary goals (ATT&CK) / agent failure categories (ATX-1)
• Techniques represent specific methods to achieve goals (ATT&CK) / specific failure mechanisms (ATX-1)
• Mitigations map techniques to defensive measures
• Case studies ground each technique in observed real-world behavior

Empirical Evidence Hierarchy

ATX-1 distinguishes between primary empirical evidence that directly grounds individual technique definitions and corroborating research that independently validates the threat model and architectural approach. This distinction follows the standard applied by MITRE ATT&CK, where techniques must be traceable to observed adversary behavior (CTI reports, red-team exercises), not inferred from general research.

Tier 1: Primary Empirical Evidence

Primary evidence directly grounds technique definitions. Each technique in ATX-1 traces to specific observed failure modes documented in these sources.

Agents of Chaos is the ATX-1 equivalent of MITRE’s Fort Meade eXperiment (FMX): a structured empirical exercise that produced the foundational observations from which techniques were derived. RFC-0006 testing extended the taxonomy with TA010 when adversarial probing revealed a class of failure (RC5: No Environment Model) not present in the Agents of Chaos corpus. The aegis-core red/blue team validation empirically confirmed the taxonomy’s completeness at the engine layer.

Tier 2: Corroborating Research

Corroborating research independently validates the problem space, threat model, and architectural approach but does not define individual techniques. These sources establish that the governance gap ATX-1 addresses is real, urgent, and architecturally consistent with established security theory.

Tier 3: Foundational Theory and Independent Convergence

Foundational work that establishes the theoretical basis for ATX-1’s enforcement model, and independent implementations that converged on the same architectural conclusions from different starting points.

Technique Acceptance Criteria

For a new technique to be added to ATX-1, it must meet all of the following criteria, aligned with MITRE ATT&CK’s inclusion standards:

1. Observed behavior: The failure mode has been directly observed in a controlled or production environment, documented with reproducible evidence (Tier 1 source required)
2. Distinct mechanism: The technique describes a behavioral pattern not already captured by an existing technique at the same abstraction level
3. Distinct detection: The technique has a detection profile that differs from existing techniques
4. Distinct mitigation: The technique requires mitigation guidance that differs from existing techniques
5. Root cause traceability: The technique traces to one or more structural root causes (RC1-RC5)

Implementation-specific defects, vendor bugs, and configuration errors do not qualify as techniques. ATX-1 operates at the behavioral pattern level, not the implementation level - the same abstraction standard that ATT&CK applies (e.g., T1070.006 Timestomp describes “modify timestamps to hide activity,” not “call SetFileTime API”).

9. Relationship to Existing Frameworks

Complementary Coverage

ATX-1 is not a replacement for ATT&CK or ATLAS. It is the third panel in a triptych:

Together, ATT&CK + ATLAS + ATX-1 provide complete adversarial coverage for deployed AI systems:

• ATT&CK covers the infrastructure under the AI system
• ATLAS covers attacks targeting the AI system
• ATX-1 covers the AI system acting as a threat source

SIEM and Security Tooling Interoperability

Modern security operations depend on technique IDs for detection, correlation, and response. ATT&CK technique IDs are embedded in SIEM rules, EDR detections, and incident response playbooks.

Governance violations by agentic AI systems need the same treatment. Without technique IDs:

• Governance violations are logged as unstructured events
• No correlation between similar violations across different agents or deployments
• No integration with existing security orchestration and automated response (SOAR) pipelines
• No common vocabulary for incident response teams

ATX-1 technique IDs (T1001-T10004, including T6003) are designed to integrate with existing security tooling. A SIEM rule that detects T1001 (Non-Owner Instruction Compliance) can be correlated with T4001 (Bulk Data Disclosure) to identify a compound attack pattern — just as ATT&CK technique chaining works today.

Regulatory Alignment

ATX-1 techniques map to regulatory requirements:

• EU AI Act (Articles 9, 14, 15): Risk management, human oversight, accuracy/robustness requirements addressed by ATX-1 tactics TA001-TA009
• NIST AI RMF: MAP, MEASURE, MANAGE, GOVERN functions aligned with ATX-1 mitigation categories
• OWASP Top 10 LLM: Direct cross-reference provided in Section 7

10. References

1. Shapira, N., et al. “Agents of Chaos: Evaluating and Governing Autonomous AI in High-Stakes Environments.” arXiv:2602.20021, February 2026.

2. Strom, B. E., et al. “MITRE ATT&CK: Design and Philosophy.” MITRE Technical Report MTR200490, 2020. Available: https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf

3. MITRE ATLAS. “Adversarial Threat Landscape for Artificial Intelligence Systems.” Available: https://atlas.mitre.org/

4. National Institute of Standards and Technology. “Artificial Intelligence Risk Management Framework (AI RMF 1.0).” NIST AI 100-1, January 2023.

5. European Parliament and Council. “Regulation (EU) 2024/1689 — Artificial Intelligence Act.” Official Journal of the European Union, July 2024.

6. Xu, H., et al. “LoopTrap: Termination Poisoning Attacks on LLM Agents.” arXiv:2605.05846, May 2026.

7. OWASP. “OWASP Top 10 for Large Language Model Applications.” Version 2.0, 2025. Available: https://owasp.org/www-project-top-10-for-large-language-model-applications/

8. Mirsky, Y., et al. “On the Autonomy Scale for AI Agents: A Framework for Measuring and Governing Autonomous Behavior.” 2025.

9. Anderson, J. P. “Computer Security Technology Planning Study.” ESD-TR-73-51, Volume II, October 1972. (Reference Monitor concept.)

10. Saltzer, J. H. and Schroeder, M. D. “The Protection of Information in Computer Systems.” Proceedings of the IEEE, 63(9):1278-1308, September 1975.

This document is maintained by the AEGIS Initiative. Contributions welcome via pull request to aegis-initiative/aegis-governance.