AI agent security, from risk to evidence.

Understand what your AI system can read, remember and change. Explore the Databricks AI Security Framework, investigate the relevant risks and give your agent a method for proposing corrections.

Start the audit checklist · Connect your agent

Start with the boundary you need to protect

Review an agent. Classify the system, inspect its permissions and plan an audit.
Connect tools safely. Review MCP clients, servers, credentials and authorization.
Investigate prompt injection. Trace untrusted content to data access and actions.
Learn from a correction. Reproduce and fix a synthetic cross-tenant authorization flaw.
Study security investigations. Explore PentAGI, Cloudflare's audit skill and Red Blue Field, then follow a hypothesis through evidence and retest.
Study reconnaissance. Explore Jason Haddix's methods, tools and reports, with an attack-surface mapping skill.
Ask a cybersecurity study partner. Understand mechanisms, challenge hypotheses and choose a practical exercise.
Design an AI security evaluation. Separate model, guardrail and application outcomes with spikee.

A reference you can inspect

This independent project by Matheus Borges combines a linked wiki, a versioned catalog and a local MCP server. The DASF 3.0 snapshot covers 97 risks and 73 controls across ML, GenAI and agentic systems. Every record points to its source. The project preserves disagreements in the source and labels its own interpretation.

Read the audit method · Inspect source caveats · See what was tested

Give your agent a method

The MCP helps the calling agent classify a system, select risks, request evidence and propose corrections. Run it locally with Node.js 22+. It requires no model key or Databricks account.

git clone https://github.com/MathBorgess/ai-security-wiki.git
cd ai-security-wiki
npm ci --ignore-scripts
npm run demo

Claude, Codex, ChatGPT and other agents · MCP tool contract · Portable audit skill

The website is a readable reference. The local MCP provides tools. A catalog match is a reason to investigate, not proof that a vulnerability exists.

Explore the reference

Choose a risk, control or research guide below, or navigate by system component and deployment pattern. The six research guides are complementary project references; the DASF snapshot still contains 97 risks and 73 controls. Preserve unknowns and combine every pattern present in your architecture.

176 references. Search filters this list locally.

DASF risks and controls, plus complementary research guides
Reference	Name	Type
DASF-R-1.1	Insufficient access controls	Risk
DASF-R-1.2	Missing data classification	Risk
DASF-R-1.3	Poor data quality	Risk
DASF-R-1.4	Ineffective storage and encryption	Risk
DASF-R-1.5	Lack of data versioning	Risk
DASF-R-1.6	Insufficient data lineage	Risk
DASF-R-1.7	Lack of data trustworthiness	Risk
DASF-R-1.8	Legality of data	Risk
DASF-R-1.9	Stale data	Risk
DASF-R-1.10	Lack of data access logs	Risk
DASF-R-1.11	Compromised 3rd-party datasets	Risk
DASF-R-2.1	Preprocessing integrity	Risk
DASF-R-2.2	Feature manipulation	Risk
DASF-R-2.3	Raw data criteria	Risk
DASF-R-2.4	Adversarial partitions	Risk
DASF-R-3.1	Data poisoning	Risk
DASF-R-3.2	Ineffective storage and encryption	Risk
DASF-R-3.3	Label flipping	Risk
DASF-R-4.1	Lack of traceability and transparency of model assets	Risk
DASF-R-4.2	Lack of end-to-end ML lifecycle	Risk
DASF-R-5.1	Lack of tracking and reproducibility of experiments	Risk
DASF-R-5.2	Model drift	Risk
DASF-R-5.3	Hyperparameters stealing	Risk
DASF-R-5.4	Malicious libraries	Risk
DASF-R-6.1	Evaluation data poisoning	Risk
DASF-R-6.2	Insufficient evaluation data	Risk
DASF-R-6.3	Lack of Interpretability and Explainability	Risk
DASF-R-7.1	Backdoor machine learning / Trojaned model	Risk
DASF-R-7.2	Model assets leak	Risk
DASF-R-7.3	ML Supply chain vulnerabilities	Risk
DASF-R-7.4	Source code control attack	Risk
DASF-R-8.1	Model attribution	Risk
DASF-R-8.2	Model theft	Risk
DASF-R-8.3	Model lifecycle without HITL (human-in-the-loop)	Risk
DASF-R-8.4	Model inversion	Risk
DASF-R-9.1	Prompt inject	Risk
DASF-R-9.2	Model inversion	Risk
DASF-R-9.3	Model breakout	Risk
DASF-R-9.4	Looped input	Risk
DASF-R-9.5	Infer training data membership	Risk
DASF-R-9.6	Discover ML model ontology	Risk
DASF-R-9.7	Denial of Service (DoS)	Risk
DASF-R-9.8	LLM hallucinations	Risk
DASF-R-9.9	Input Resource Control	Risk
DASF-R-9.10	Accidental exposure of unauthorized data to models	Risk
DASF-R-9.11	Model Inference API Access	Risk
DASF-R-9.12	LLM Jailbreak	Risk
DASF-R-9.13	Excessive agency	Risk
DASF-R-10.1	Lack of audit and monitoring inference quality	Risk
DASF-R-10.2	Output manipulation	Risk
DASF-R-10.3	Discover ML model ontology	Risk
DASF-R-10.4	Discover ML model family	Risk
DASF-R-10.5	Black-box attacks	Risk
DASF-R-10.6	Sensitive data output from a model	Risk
DASF-R-11.1	Lack of MLOps — repeatable enforced standards	Risk
DASF-R-12.1	Lack of vulnerability management	Risk
DASF-R-12.2	Lack of penetration testing, red teaming and bug bounty	Risk
DASF-R-12.3	Lack of incident response	Risk
DASF-R-12.4	Unauthorized privileged access	Risk
DASF-R-12.5	Poor security in the software development lifecycle	Risk
DASF-R-12.6	Lack of compliance	Risk
DASF-R-12.7	Initial Access	Risk
DASF-R-13.1	Memory Poisoning	Risk
DASF-R-13.2	Tool Misuse	Risk
DASF-R-13.3	Privilege Compromise	Risk
DASF-R-13.4	Resource Overload	Risk
DASF-R-13.5	Cascading Hallucination Attacks	Risk
DASF-R-13.6	Intent Breaking & Goal Manipulation	Risk
DASF-R-13.7	Misaligned & Deceptive Behaviors	Risk
DASF-R-13.8	Repudiation & Untraceability	Risk
DASF-R-13.9	Identity Spoofing & Impersonation	Risk
DASF-R-13.10	Overwhelming Human in the Loop	Risk
DASF-R-13.11	Unexpected RCE and Code Attacks	Risk
DASF-R-13.12	Agent Communication Poisoning	Risk
DASF-R-13.13	Rogue Agents in Multi-Agent Systems	Risk
DASF-R-13.14	Human Attacks on Multi-Agent Systems	Risk
DASF-R-13.15	Human Manipulation	Risk
DASF-R-13.16	Prompt Injection	Risk
DASF-R-13.17	Confused Deputy	Risk
DASF-R-13.18	Tool Poisoning	Risk
DASF-R-13.19	Credential and Token Exposure	Risk
DASF-R-13.20	Insecure Server Configuration	Risk
DASF-R-13.21	Supply Chain Attacks	Risk
DASF-R-13.22	Excessive Permissions and Scope Creep	Risk
DASF-R-13.23	Data Exfiltration	Risk
DASF-R-13.24	Context Spoofing and Manipulation	Risk
DASF-R-13.25	Insecure Communication	Risk
DASF-R-13.26	Malicious Server Connection	Risk
DASF-R-13.27	Insecure Credential Storage	Risk
DASF-R-13.28	UI/UX Deception	Risk
DASF-R-13.29	Insufficient Server Validation	Risk
DASF-R-13.30	Client-Side Data Leakage	Risk
DASF-R-13.31	Excessive Permission Granting	Risk
DASF-R-13.32	Client-Side Code Execution	Risk
DASF-R-13.33	Insecure Communication Handling	Risk
DASF-R-13.34	Session and State Management Failures	Risk
DASF-R-13.35	Update and Patch Management	Risk
DASF-1	SSO with IdP and MFA	Control
DASF-2	Sync users and groups	Control
DASF-3	Restrict access using IP access lists	Control
DASF-4	Restrict access using private link	Control
DASF-5	Control access to data and other objects	Control
DASF-6	Classify data	Control
DASF-7	Enforce data quality checks on batch and streaming datasets	Control
DASF-8	Encrypt data at rest	Control
DASF-9	Encrypt data in transit	Control
DASF-10	Version data	Control
DASF-11	Capture and view data lineage	Control
DASF-12	Delete records from datasets	Control
DASF-13	Use near real-time data	Control
DASF-14	Audit actions performed on datasets	Control
DASF-15	Explore datasets and identify problems	Control
DASF-16	Secure model features	Control
DASF-17	Track and reproduce the training data used for ML model training	Control
DASF-18	Govern model assets	Control
DASF-19	Manage end-to-end machine learning lifecycle	Control
DASF-20	Track ML training runs	Control
DASF-21	Monitor data and AI system from a single pane of glass	Control
DASF-22	Build models with all representative, accurate and relevant data sources	Control
DASF-23	Register, version, approve, promote, deploy and monitor models	Control
DASF-24	Control access to models and model assets	Control
DASF-25	Use retrieval augmented generation (RAG) with large language models (LLMs)	Control
DASF-26	Fine-tune large language models (LLMs)	Control
DASF-27	Pretrain a large language model (LLM)	Control
DASF-28	Create model aliases, tags and annotations	Control
DASF-29	Build MLOps workflows	Control
DASF-30	Encrypt models	Control
DASF-31	Secure model serving endpoints	Control
DASF-32	Govern and monitor access of AI model and model serving endpoints	Control
DASF-33	Manage credentials securely	Control
DASF-34	Run models in multiple layers of isolation	Control
DASF-35	Track model performance	Control
DASF-36	Set up monitoring alerts	Control
DASF-37	Set up inference tables for monitoring and debugging models	Control
DASF-38	Platform security — penetration testing, red teaming, bug bounty and vulnerability management	Control
DASF-39	Platform security — Incident Response Team	Control
DASF-40	Platform security — internal access	Control
DASF-41	Platform security — secure SDLC	Control
DASF-42	Employ data-centric MLOps and LLMOps	Control
DASF-43	Use access control lists	Control
DASF-44	Triggering actions in response to a specific event	Control
DASF-45	Evaluate models	Control
DASF-46	Store and retrieve embeddings securely	Control
DASF-47	Compare LLM outputs on set prompts	Control
DASF-48	Use hardened Runtime for Machine Learning	Control
DASF-49	Automate LLM evaluation	Control
DASF-50	Platform compliance	Control
DASF-51	Share data and AI assets securely	Control
DASF-52	Source code control	Control
DASF-53	Third-party library control	Control
DASF-54	Implement AI guardrails	Control
DASF-55	Monitor audit logs	Control
DASF-56	Restrict outbound connections from models	Control
DASF-57	Use attribute-based access controls (ABAC)	Control
DASF-58	Protect data with filters and masking	Control
DASF-59	Use clean rooms	Control
DASF-60	Rate limit number of inference queries	Control
DASF-61	Train users on AI risk taxonomy and AI/ML security	Control
DASF-62	Implement network segmentation	Control
DASF-63	Update software	Control
DASF-64	Limit access from AI models and agents	Control
DASF-65	Implement end-to-end AI traceability	Control
DASF-66	Use Human-in-the-loop feedback	Control
DASF-67	Federate authentication	Control
DASF-68	Use Securely Hosted Managed MCP Servers	Control
DASF-69	Securely host Custom MCP Servers	Control
DASF-70	Securely connect to External MCP Servers	Control
DASF-71	Log and register AI agents	Control
DASF-72	Securely store and reuse agent state	Control
DASF-73	Register prompts	Control
security-research	Security research: PentAGI, Cloudflare and Red Blue Field	Reference
pentagi	PentAGI: study agentic security investigations	Reference
cloudflare-audit	Cloudflare security-audit-skill: evidence and verification	Reference
red-blue-field	Red Blue Field: from reference methods to a learning laboratory	Reference
evidence-playbook	Evidence-driven AI security audit: hypothesis, coverage and retest	Reference
coverage-template	Coverage ledger for an AI security audit	Reference