♠ Spades: Adversarial

Spades, the adversarial suit of Elevation of Autonomy: the suit's 6 cards fanned over a neon grid.

Taxonomies / AI and Agentic Systems Threat Taxonomy / Spades

Direct attacks on the model and the agent: text that becomes an instruction, tools turned against their owner, poisoned components, memory and tool descriptions, and output that a downstream consumer trusts.

This suit has 6 cards, EOA·SA to EOA·S9. In the game, high ranks (Ace, King) are the broader or more foundational threats and low ranks the more specific or variant ones; in the taxonomy the ID is a stable reference, not a severity. Each entry gives the card’s threat and mitigation prompts, the mitigation principle a sound design follows, design measures, and mappings.

Spades at a glance: each card's ID, title, quote, threat and mitigation principle. The full text is below and in the downloads.

The entries

EOA·SA Prompt Injection

“Anything the model reads can be interpreted as an instruction.”

Threat. An attacker-controlled text reaches the model’s context and is interpreted as a new instruction. The injection may be direct (in the user prompt) or indirect (in retrieved content, tool output, memory, or another agent’s message). The model cannot reliably distinguish instructions from data.

Mitigation prompts (from the card)

  • How are inputs from each source delimited?
  • What happens when a retrieved document contains an instruction?
  • What actions are irreversible, and are any of them reachable from a single model output?

Mitigation principle. Treat every channel into the context as untrusted, and make sure no single model output can trigger a consequential action on its own.

Design measures

  • Label and delimit each source in the context (system, user, retrieved content, tool output, memory, other agents), and keep instructions and data in separate fields wherever the interface allows.
  • Enforce what the agent may do outside the model: authorisation at the data layer and allow-listed tool arguments, so an obeyed injection is still refused.
  • Require out-of-band human confirmation for destructive or externally visible actions, showing what will happen in terms the user can check.
  • Filter output at every sink that could become an exfiltration channel (links, images, tool arguments, outbound messages).

Mappings

  • STRIDE: T, E
  • Card references: OWASP LLM01. ASI01 when it redirects an agent. CAPEC-242 conceptually.
  • MITRE ATLAS: AML.T0051.000 LLM Prompt Injection: Direct, AML.T0051.001 LLM Prompt Injection: Indirect
  • CAPEC: none
  • CWE: CWE-1427 Improper Neutralization of Input Used for LLM Prompting

Seen in the wild. EchoLeak (CVE-2025-32711): a zero-click indirect prompt injection in Microsoft 365 Copilot, in which a crafted email led Copilot to exfiltrate data from the user’s context. Disclosed by Aim Security, June 2025. Source: Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot (BleepingComputer).

Touches: EOA·S10 Improper Output Handling, EOA·S9 Tool Description Injection, EOA·T7 Adversarial Subspace

EOA·SK Tool Misuse

“A legitimate tool used for illegitimate ends is still destructive.”

Threat. The agent invokes a legitimate, authorised tool in a way that causes harm because the arguments were attacker-influenced or the tool’s blast radius was too wide.

Mitigation prompts (from the card)

  • For each tool, what is the worst thing it could do with attacker-controlled arguments?
  • Are destructive arguments allow-listed?
  • Is human confirmation required for irreversible outcomes?

Mitigation principle. Constrain what each tool can do with any argument, not only which tools the agent may call.

Design measures

  • Allow-list arguments and argument ranges for tools with side effects (paths, recipients, resources, amounts), not just function names.
  • Give each tool its own credentials scoped to the minimum it needs, so a misused call cannot reach beyond that scope.
  • Require human confirmation for irreversible outcomes, and make destructive operations soft-delete or recoverable by default.
  • Use idempotency keys and per-tool rate limits so a repeated or looping call cannot cascade.

Mappings

  • STRIDE: T, E
  • Card references: ASI02. OWASP LLM06 secondary.
  • MITRE ATLAS: AML.T0053 AI Agent Tool Invocation, AML.T0101 Data Destruction via AI Agent Tool Invocation, AML.T0086 Exfiltration via AI Agent Tool Invocation
  • CAPEC: none
  • CWE: none

Seen in the wild. GitHub MCP “toxic agent flow”: a prompt injection in a public issue led an agent using the official GitHub MCP server to pull data from the user’s private repositories and leak it through a pull request in the public one. Disclosed by Invariant Labs, May 2025. Source: GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs).

Touches: EOA·HA Excessive Agency, EOA·SA Prompt Injection, EOA·T3 Excessive Autonomy by Design

EOA·SQ Supply Chain Compromise

“The code you didn’t write runs with the credentials you have.”

Threat. A component in the AI supply chain (base model, adapter, library, MCP server, prompt template) is compromised upstream or via an update.

Mitigation prompts (from the card)

  • What is in your AI-BOM?
  • How are updates reviewed?
  • What does each component have access to that it does not need?

Mitigation principle. Know every component the system’s behaviour depends on, review it on every change, and give each one only the access it needs.

Design measures

  • Keep an AI-BOM covering models, adapters, datasets, libraries, MCP servers and prompt templates, each with its source, version and digest.
  • Gate installation and every update behind review, including re-reading tool descriptions and permissions on each version bump.
  • Pin versions by digest and verify signatures or provenance where the publisher offers them.
  • Run each component, and especially each MCP server, in its own sandbox with its own identity, filesystem view and egress policy.

Mappings

  • STRIDE: T, E
  • Card references: OWASP LLM03. ASI04.
  • MITRE ATLAS: AML.T0010.001 Supply Chain Compromise: Software, AML.T0010.003 Supply Chain Compromise: Model Repository, AML.T0010.005 Supply Chain Compromise: AI Agent Tool
  • CAPEC: CAPEC-538 Open-Source Library Manipulation
  • CWE: CWE-1357 Reliance on Insufficiently Trustworthy Component, CWE-494 Download of Code Without Integrity Check

Seen in the wild. Amazon Q Developer for VS Code: version 1.84.0 shipped with an injected prompt telling the agent to wipe local files and cloud resources, after an unauthorised commit reached the release; AWS says it never ran. Bulletin AWS-2025-015, July 2025. Source: AWS-2025-015: Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84).

Touches: EOA·D9 Server Impersonation and Rogue Servers, EOA·T2 Invisible Dependency, EOA·S9 Tool Description Injection

EOA·SJ Memory Poisoning

“Today’s lie becomes tomorrow’s ground truth.”

Threat. An adversary causes false or malicious content to be written to long-term memory where it persists across sessions and is later retrieved as trusted context.

Mitigation prompts (from the card)

  • Who can write to memory?
  • Is provenance attached?
  • Is memory partitioned per user?
  • How are security-relevant memory reads validated?

Mitigation principle. Treat memory as untrusted input with provenance, never as an authority on policy or permissions.

Design measures

  • Attach provenance to every memory write: who or what wrote it, in which session, from which source, with what authority.
  • Partition memory per user and per tenant; no cross-user writes and no shared memory without an explicit owner.
  • Never let memory change security-relevant state (approvals, permissions, policy); read those from the system of record every time.
  • Show users recent memory writes for confirmation, and audit and expire memory periodically.

Mappings

  • STRIDE: T
  • Card references: ASI06.
  • MITRE ATLAS: AML.T0080.000 AI Agent Context Poisoning: Memory
  • CAPEC: none
  • CWE: none

Seen in the wild. SpAIware: a prompt injection planted persistent instructions in ChatGPT’s long-term memory on the macOS app, so data from later conversations was exfiltrated. Disclosed by Johann Rehberger (Embrace The Red), September 2024; fixed by OpenAI. Source: Spyware Injection Into Your ChatGPT’s Long-Term Memory (SpAIware) (Embrace The Red).

Touches: EOA·SA Prompt Injection, EOA·CK Retention and Removal, EOA·HJ Cascading Failure

EOA·S10 Improper Output Handling

“The model’s output is not user input, except in every way that matters.”

Threat. A downstream consumer treats model output as trusted, leading to exfiltration, rendering, or execution of attacker-influenced content.

Mitigation prompts (from the card)

  • Which consumers of model output exist, and what do they assume?
  • Where is output sanitised, encoded, or structured?
  • Are there rendering paths that fetch remote content?

Mitigation principle. Handle model output as untrusted input at every sink it reaches: renderer, tool argument, query, shell, log and message.

Design measures

  • Encode or sanitise output for the sink it goes to (HTML, Markdown, SQL, shell, log), and never pass it to an interpreter unescaped.
  • Prefer structured output validated against a schema over free-form text wherever a program consumes it.
  • Block remote content fetches from rendered output (images, links, iframes) with a Content Security Policy or a domain allow-list.
  • Run any generated code in a sandbox with no network, no secrets and no access to the host filesystem.

Mappings

  • STRIDE: I, T
  • Card references: OWASP LLM05.
  • MITRE ATLAS: AML.T0077 LLM Response Rendering
  • CAPEC: CAPEC-63 Cross-Site Scripting (XSS)
  • CWE: CWE-79 Improper Neutralization of Input During Web Page Generation, CWE-94 Improper Control of Generation of Code

Seen in the wild. Google Bard data exfiltration: an indirect prompt injection in a shared Google Doc made Bard emit a Markdown image whose URL carried the user’s chat history to an attacker’s server. Disclosed by Johann Rehberger (Embrace The Red), November 2023; fixed by Google. Source: Hacking Google Bard: From Prompt Injection to Data Exfiltration (Embrace The Red).

Touches: EOA·SA Prompt Injection, EOA·DA Sensitive Information Disclosure, EOA·T1 Wrong Abstraction

EOA·S9 Tool Description Injection

“The tool description is itself a prompt.”

Threat. An MCP server (or equivalent tool registry) supplies tool descriptions and parameter schemas that arrive in the model’s context as instructions. A hostile or compromised server can inject prompts via the description field itself, not just the tool’s return value. The “rug pull” variant mutates the description after the user has approved the tool, so the approved version and the live version diverge silently.

Mitigation prompts (from the card)

  • Are tool descriptions pinned and integrity-checked between approval and use?
  • What happens when a server updates a description silently?
  • Are descriptions delimited from user prompts in the model’s context?
  • Does any tool have a description that contains imperative language?

Mitigation principle. Approve a tool’s description and schema as code, and refuse any version that differs from what was approved.

Design measures

  • Pin each tool’s description and schema by hash at approval time, and block the tool (or re-prompt for approval) when the hash changes.
  • Review descriptions before approval for imperative language, hidden text and references to other tools or files.
  • Show the user the full description that the model will see, not a shortened summary.
  • Delimit tool descriptions from user and system content in the context, and keep them out of the system prompt.

Mappings

  • STRIDE: T, S
  • Card references: OWASP LLM01 indirect injection. ASI01. ASI04. MCP-specific.
  • MITRE ATLAS: AML.T0110.000 AI Agent Tool Poisoning: Definition and Instructions, AML.T0109 AI Supply Chain Rug Pull
  • CAPEC: none
  • CWE: CWE-1427 Improper Neutralization of Input Used for LLM Prompting

Seen in the wild. Tool poisoning attacks: Invariant Labs showed MCP tool descriptions carrying hidden instructions that made a client read SSH keys and configuration files and pass them out through tool arguments, including a rug-pull variant that changes after approval. April 2025. Source: MCP Security Notification: Tool Poisoning Attacks (Invariant Labs).

Touches: EOA·H9 Confused Deputy Across Servers, EOA·D9 Server Impersonation and Rogue Servers, EOA·T2 Invisible Dependency

Mappings at a glance

Mappings for Spades: STRIDE, the card's references, MITRE ATLAS, CAPEC and CWE for each entry. The full text is above and in the downloads.

STRIDE across this suit: Spoofing 1, Tampering 6, Information disclosure 1, Elevation of privilege 3. 6 of 6 entries map to MITRE ATLAS, 2 to CAPEC and 4 to CWE.

Where this suit touches the others

Overview · Next: ♥ Hearts: Autonomy

AI and Agentic Systems Threat Taxonomy v1.0, the reference for the Elevation of Autonomy card deck. © 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence.