Protocol Exploitation

Protocol exploitation attacks target the communication layer between AI agents and their tools. This includes function schema injection, tool result poisoning, self-propagating worms, and zero-click attacks that execute without user interaction. These attacks exploit the trust boundary between what an agent expects from its tools and what it actually receives.

Summary

5 attacks total: 5 tool-use.

Attacks

Attack	ID	Mode	Severity	Description
A2A Protocol Exploit	`a2a-protocol-exploit`	tool-use	critical	Exploits Google
Function Schema Injection	`function-schema-injection`	tool-use	high	Tests if malicious function/tool schemas can manipulate agent behavior by injecting harmful instructions into paramet…
Self-Propagating Worm	`self-propagating-worm`	tool-use	critical	Tests if an agent can be tricked into creating self-replicating payloads that spread through agent interactions. The …
Tool Result Poisoning	`tool-result-poisoning`	tool-use	critical	Tests if an agent properly sanitizes tool call results by injecting prompt injection payloads into simulated tool res…
Zero-Click Injection	`zero-click-injection`	tool-use	critical	Tests EchoLeak-style zero-click attacks where a crafted email or document is automatically processed by the agent wit…

Example

ai-blackteam run -p anthropic -a a2a-protocol-exploit -t "Inject instructions into the function schema"

Overview

Full Reference

Attacks by Category

Encoding & Obfuscation

Prompt Injection

Social Engineering

Agent & Tool Attacks

Security & Access Control

ML & Model Attacks

Multimodal & RAG

Harmful Content

Misinformation & Influence

Domain Exploits

Compliance & Bias

Attack Strategies

Summary

Attacks

Example

​Summary

​Attacks

​Example

Summary

Attacks

Example