Skip to content
Hermes Codex

Agentic Attack Patterns (AAP) — The Hermes Taxonomy

1. Architectural Alignment with the 4-Layer Stack

Section titled “1. Architectural Alignment with the 4-Layer Stack”

In concordance with the PRISMA systematic taxonomy (arXiv:2608.10530), every Agentic Attack Pattern is indexed by its primary originating layer:

┌─────────────────────────────────────────────────────────────────────────────┐
│ 1. PERCEPTION LAYER                                                         │
│    AAP-001: Direct System Instruction Overwrite                             │
│    AAP-002: Indirect Prompt Injection via Context Retrieval                  │
├─────────────────────────────────────────────────────────────────────────────┤
│ 2. BRAIN / COGNITIVE LAYER                                                  │
│    AAP-004: Semantic Tool Poisoning & Supply Chain Subversion               │
│    AAP-005: Memory & Vector DB Knowledge Corruption (RAG Poisoning)          │
├─────────────────────────────────────────────────────────────────────────────┤
│ 3. ACTION / EXECUTION LAYER (CRITICAL BLAST RADIUS)                         │
│    AAP-003: Tool Parameter Tampering & Shell Built-in Bypass                │
│    AAP-007: Autonomous Task Hijacking & Multi-Step Cascading RCE            │
├─────────────────────────────────────────────────────────────────────────────┤
│ 4. INTERACTION LAYER                                                        │
│    AAP-006: Inter-Agent Semantic Message Spoofing & Impersonation           │
└─────────────────────────────────────────────────────────────────────────────┘

2. Core Catalog of Agentic Attack Patterns

Section titled “2. Core Catalog of Agentic Attack Patterns”

AAP-001: Direct System Prompt Override

Category: Perception Layer • HASS: 64 / 100 (HIGH)
Adversary feeds adversarial delimiter tags and role redefinitions into conversational inputs to strip safety guardrails and force arbitrary instructions. View Attack Pattern Card →

AAP-002: Indirect Context Injection

Category: Perception Layer • HASS: 87 / 100 (CRITICAL)
Adversary places hidden directives in third-party data (web pages, repositories, emails) that hijack the agent when ingested during autonomous retrieval. View Attack Pattern Card →

AAP-003: Tool Parameter Tampering & Built-in Bypass

Category: Action Layer • HASS: 91 / 100 (EXTREME)
Bypassing terminal allowlists via shell built-ins (export, declare) or schema parameter pollution to poison environment variables and execute host code. View Attack Pattern Card →

AAP-004: Semantic Tool Poisoning

Category: Brain Layer • HASS: 89 / 100 (CRITICAL)
Publishing malicious MCP tools or plugins whose descriptive metadata tricks the model into prioritizing them for sensitive tasks. View Attack Pattern Card →

AAP-005: Memory & Vector DB Corruption (RAG)

Category: Brain / Interaction • HASS: 82 / 100 (CRITICAL)
Poisoning episodic memory or embedding stores to induce persistent cognitive bias and long-term behavioral drift across multiple user sessions. View Attack Pattern Card →

AAP-006: Inter-Agent Message Spoofing

Category: Interaction Layer • HASS: 85 / 100 (CRITICAL)
Exploiting the absence of cryptographic message signing in multi-agent swarms to impersonate supervisor agents and command peer workers. View Attack Pattern Card →

AAP-007: Autonomous Cascading RCE

Category: Action Layer • HASS: 96 / 100 (EXTREME)
Chaining prompt injection, autonomous planning, and un-sandboxed code execution sinks to gain immediate interactive root shells on host infrastructure. View Attack Pattern Card →

3. The Standardized Attack Card Schema

Section titled “3. The Standardized Attack Card Schema”

Every pattern in the AAP catalog contains:

  1. Attack Identifier & Category: Formally indexed in AAP-XXX series.
  2. Hermes Agentic Security Score (HASS): Quantified against the 6 dimensions (Autonomy, Tool Access, Privilege, Persistence, External Impact, Propagation).
  3. Execution Flow Visualizer: Step-by-step cognitive and actuation progression.
  4. Target Architectures & Prerequisites: Identification of affected runtimes (LangChain, AutoGen, CrewAI, MCP, Cursor).
  5. Detection Engineering: Concrete Sigma, YARA, or Osquery detection queries.
  6. Hardened Mitigations: Capability tokens, sidecar policy gateways, and sandbox boundaries.
Section titled “4. Related Intelligence Hubs”
Hermes Agentic Security Score (HASS) Understand the mathematical scoring methodology measuring autonomy and tool actuation danger.
What Changed? Daily Intelligence Feed Track daily vulnerability escalations and emerging in-the-wild attack patterns.
Core Research: Tool Injection Architecture Deep architectural analysis of how tool-calling engines become execution sinks.
Rethinking Agent Security as a Networking Problem Applying centralized control planes and sidecar proxies to isolate agent communication.