♦ Diamonds: Data

iamonds, the data suit of Elevation of Autonomy: the suit's 6 cards fanned over a neon grid.

Taxonomies / AI and Agentic Systems Threat Taxonomy / Diamonds

Risks to and through the data the system handles: disclosure, retrieval without access control, confident falsehoods, runaway spend, system prompts treated as secret stores, and servers that see everything routed to them.

This suit has 6 cards, EOA·DA to EOA·D9. In the game, high ranks (Ace, King) are the broader or more foundational threats and low ranks the more specific or variant ones; in the taxonomy the ID is a stable reference, not a severity. Each entry gives the card’s threat and mitigation prompts, the mitigation principle a sound design follows, design measures, and mappings.

Diamonds at a glance: each card's ID, title, quote, threat and mitigation principle. The full text is below and in the downloads.

The entries

EOA·DA Sensitive Information Disclosure

“The model will tell you what it knows, whether it should or not.”

Threat. The model emits personal data, secrets, or proprietary information drawn from training, retrieval, or context.

Mitigation prompts (from the card)

  • What data is in scope for retrieval?
  • Is authorisation enforced at the data layer?
  • What are the output filters catching?

Mitigation principle. The model only ever sees data the requesting user is entitled to; output filtering is a backstop, not the control.

Design measures

  • Enforce authorisation at retrieval time with the requesting user’s identity, not the agent’s service account and not in the UI.
  • Keep secrets and data the task does not need out of training sets, prompts, context and memory.
  • Filter output for secrets and personal data before it reaches the user, a log or another system, and log what the filter catches.
  • Classify data sources before connecting them, and exclude archives, private messages and HR data unless the use case requires them.

Mappings

  • STRIDE: I
  • LINDDUN: Data disclosure
  • Card references: OWASP LLM02.
  • MITRE ATLAS: AML.T0137.003 Training Data Information from AI Models: Extract Memorized Data, AML.T0085.000 Data from AI Services: RAG Databases, AML.T0136 Exfiltration via AI User Interface
  • CAPEC: none
  • CWE: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor, CWE-201 Insertion of Sensitive Information Into Sent Data

Seen in the wild. Slack AI: PromptArmor showed that an injected message in a public channel could make Slack AI leak data from private channels the attacker could not read, through a link the victim clicked. August 2024. Source: Data exfiltration from Slack AI via indirect prompt injection (PromptArmor).

Touches: EOA·DK Vector and Embedding Weakness, EOA·S10 Improper Output Handling, EOA·CJ Minimisation

EOA·DK Vector and Embedding Weakness

“The vector store is your new database and it has no access control.”

Threat. The RAG pipeline leaks data across tenants, allows embedding-based attacks, or inherits UI-layer access controls that do not apply at retrieval.

Mitigation prompts (from the card)

  • How is the vector store partitioned?
  • When is authorisation evaluated: at query time or earlier?
  • Who can write to the corpus?

Mitigation principle. Apply the access control of the source documents to every chunk, at query time, and protect the corpus from unauthorised writes.

Design measures

  • Partition the vector store per tenant (separate indexes or enforced namespaces), never by filter alone.
  • Carry the source document’s permissions on every chunk and evaluate them at query time with the requesting user’s identity.
  • Control and log who can write to the corpus, and attach source and integrity hashes to every chunk.
  • Treat retrieved chunks as untrusted content in the context, and re-index when permissions change at the source.

Mappings

  • STRIDE: I, T
  • LINDDUN: Data disclosure, Linking
  • Card references: OWASP LLM08.
  • MITRE ATLAS: AML.T0070 RAG Poisoning, AML.T0085.000 Data from AI Services: RAG Databases
  • CAPEC: none
  • CWE: CWE-863 Incorrect Authorization, CWE-653 Improper Isolation or Compartmentalization

Touches: EOA·DA Sensitive Information Disclosure, EOA·SA Prompt Injection, EOA·CK Retention and Removal

EOA·DQ Hallucinated Facts

“The model is confidently wrong and the system treats confidence as correctness.”

Threat. The model generates false but plausible content that downstream consumers or users treat as ground truth. Includes slopsquatting, fabricated citations, and invented identifiers.

Mitigation prompts (from the card)

  • Where does model output inform decisions or actions?
  • Is there grounding?
  • Are claims about external entities (people, packages, systems) verified?

Mitigation principle. Verify any claim about an external entity before it is acted on or presented as fact.

Design measures

  • Ground answers in authoritative sources and show the source with the claim.
  • Check that packages, files, URLs, people and identifiers exist (and are the expected ones) before installing, calling or citing them.
  • Use refuse-or-retrieve for high-stakes questions: answer from a retrieved source or say the answer is not known.
  • Route decisions with legal, financial or safety impact to a human with the sources in front of them.

Mappings

  • STRIDE: T
  • Card references: OWASP LLM09.
  • MITRE ATLAS: AML.T0062 Discover LLM Hallucinations, AML.T0060 Publish Hallucinated Entities
  • CAPEC: none
  • CWE: none

Seen in the wild. Slopsquatting: Lasso Security’s Bar Lanyado found models repeatedly recommending a non-existent package, huggingface-cli; an empty package he uploaded under that name got over 30,000 downloads in three months and appeared in an Alibaba repository’s install instructions. 2024. Source: Hackers take advantage of AI hallucinations to sneak malicious software packages onto enterprise repositories (ITPro).

Touches: EOA·T1 Wrong Abstraction, EOA·HJ Cascading Failure, EOA·CA Transfer

EOA·DJ Unbounded Consumption

“Denial of wallet is a denial of service.”

Threat. Cost, compute, or rate limits are absent or ineffective. Malicious users (or bugs) cause runaway spend.

Mitigation prompts (from the card)

  • What are the hard caps per user, per session, per agent?
  • Are loops bounded?
  • How is spend monitored?

Mitigation principle. Every user, session, agent and loop has a hard budget, enforced outside the model.

Design measures

  • Set rate limits and token and cost budgets per user, per session, per agent and per tool, enforced at the gateway.
  • Cap loop iterations, recursion depth, context size and output length.
  • Alert on spend anomalies, and stop automatically when a budget is reached rather than only notifying.
  • Protect model API keys like payment credentials: scoped, rotated and never in client code.

Mappings

  • STRIDE: D
  • Card references: OWASP LLM10.
  • MITRE ATLAS: AML.T0034 Cost Harvesting, AML.T0034.002 Cost Harvesting: Agentic Resource Consumption, AML.T0029 Denial of AI Service
  • CAPEC: CAPEC-130 Excessive Allocation
  • CWE: CWE-770 Allocation of Resources Without Limits or Throttling, CWE-799 Improper Control of Interaction Frequency

Seen in the wild. LLMjacking: Sysdig’s Threat Research Team found attackers using stolen cloud credentials to run hosted language models at the victims’ expense, with potential costs of more than USD 46,000 a day. May 2024. Source: LLMjacking: Stolen Cloud Credentials Used in New AI Attack (Sysdig).

Touches: EOA·HJ Cascading Failure, EOA·HK Identity and Privilege Abuse, EOA·T3 Excessive Autonomy by Design

EOA·D10 System Prompt Leakage

“The system prompt is not a secret store.”

Threat. System prompts containing credentials, business logic, or security instructions are extracted via prompt injection or inference.

Mitigation prompts (from the card)

  • What is in the system prompt that should not be?
  • What happens if the whole prompt leaks tomorrow?

Mitigation principle. Design as if the system prompt is public: no secrets in it, and no security control that depends on it staying hidden.

Design measures

  • Keep credentials, connection strings and internal URLs out of prompts; tools fetch secrets server-side from a secret store.
  • Enforce permissions and business rules in code outside the model, not as instructions in the prompt.
  • Review prompts as published text before release, assuming a user will read them.
  • Monitor outputs for prompt fragments, and treat a leak as expected rather than as an incident that breaks security.

Mappings

  • STRIDE: I
  • Card references: OWASP LLM07.
  • MITRE ATLAS: AML.T0069.002 Discover LLM System Information: System Prompt
  • CAPEC: none
  • CWE: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere, CWE-798 Use of Hard-coded Credentials

Seen in the wild. Bing Chat: within days of launch, a prompt injection revealed Microsoft’s confidential system prompt, including the codename “Sydney”. Reported by Kevin Liu, February 2023. Source: Microsoft’s Bing chatbot AI is susceptible to several types of prompt injection attacks (TechSpot).

Touches: EOA·SA Prompt Injection, EOA·HK Identity and Privilege Abuse, EOA·T4 Decision Boundary Transfer

EOA·D9 Server Impersonation and Rogue Servers

“Every byte of your prompt and every tool result flows through that server.”

Threat. An MCP server is typosquatted, hijacked, or stood up adversarially in a registry the client trusts. Once connected, it sees every prompt routed to its tools, every credential or token shared with it, and every return value. Data exfiltration is the primary risk; tool-output tampering is the secondary risk. The transport (stdio vs HTTP) changes the attack surface but not the underlying problem.

Mitigation prompts (from the card)

  • How is the server identified: by name, by signature, by pinned hash?
  • What is the source of truth for the registry?
  • What credentials and data does each server see?
  • Is HTTP transport authenticated and bound to a specific origin?
  • What happens if a server is silently replaced?

Mitigation principle. Identify servers by something an attacker cannot copy, and assume any server sees everything routed to it.

Design measures

  • Identify each server by publisher signature or pinned digest, not by name, and install only from an internal registry or allow-list.
  • Authenticate HTTP transports and bind them to an expected origin; validate Origin headers on local servers.
  • Send each server only the data and credentials its tools need, and never share one token across servers.
  • Alert and block when a server’s binary, digest or endpoint changes, and re-review before re-enabling it.

Mappings

  • STRIDE: S, I, T
  • Card references: OWASP LLM03 supply chain. ASI04. MCP-specific.
  • MITRE ATLAS: AML.T0010.005 Supply Chain Compromise: AI Agent Tool, AML.T0011.002 User Execution: Poisoned AI Agent Tool, AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
  • CAPEC: CAPEC-630 TypoSquatting
  • CWE: CWE-1357 Reliance on Insufficiently Trustworthy Component, CWE-346 Origin Validation Error

Seen in the wild. postmark-mcp: an npm package impersonating an email-sending MCP server added a hidden BCC from version 1.0.16, copying every message sent through it to an attacker-controlled address. Disclosed by Koi Security, September 2025. Source: Postmark MCP server code hijacked (The Register).

Touches: EOA·SQ Supply Chain Compromise, EOA·S9 Tool Description Injection, EOA·H9 Confused Deputy Across Servers

Mappings at a glance

Mappings for Diamonds: STRIDE, the card's references, MITRE ATLAS, CAPEC and CWE for each entry. The full text is above and in the downloads.

STRIDE across this suit: Spoofing 1, Tampering 3, Information disclosure 4, Denial of service 1. 6 of 6 entries map to MITRE ATLAS, 2 to CAPEC and 5 to CWE.

Where this suit touches the others

Previous: ♥ Hearts: Autonomy · Overview · Next: ♣ Clubs: Privacy

AI and Agentic Systems Threat Taxonomy v1.0, the reference for the Elevation of Autonomy card deck. © 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence.