Attack techniques & risk categories

The attack techniques and risk categories PromptBeat and AgentBeat cover, with what is available today and what is planned. PromptBeat techniques and risk categories also link to the evaluation-set subclasses that exercise them.

PromptBeat

Tests the responses of a model or Prompt-driven endpoint.

Attack techniques

14+1 planned

Risk categories

8+2 planned

View details →

AgentBeat

Tests a complete agent: task completion and tool and data boundaries.

Attack techniques

3+7 planned

Risk categories

15+6 planned

View details →

Download PDF

• SupportedAvailable in the current release
• PlannedNot in the current release
• PlannedAll 60 subclasses are Planned

Supported means usable as described, within the prerequisites listed; not every combination has been verified against every target. Planned does not imply a release date.

PromptBeat

Attack techniques

14 supported · 1 planned

Technique	Risk category	Description	Capability status
Instruction overridePrompt injection: 3 subclasses	Prompt injection	Asks the target to ignore or replace its existing instructions.	Supported
Authority impersonation	Prompt injection	Poses as an administrator, developer, or other trusted role.	Supported
System prompt overridePrompt injection: 1 subclass	Prompt injection	Tries to rewrite the system-level rules the target follows.	Supported
System prompt extraction	System prompt leakage	Tries to make the target reveal hidden system or developer instructions.	Supported
JailbreakJailbreak: 7 subclasses	Jailbreak	Single-turn and composite attempts to bypass safety restrictions.	Supported
Role-play disguiseJailbreak: 16 subclassesContent safety: 1 subclass	Jailbreak	Wraps a harmful request in fiction or role-play across several turns.	Supported
Encoding obfuscationPrompt injection: 1 subclass	Jailbreak	Hides intent with single or layered encodings such as Base64 or hex.	Supported
Harmful content elicitationContent safety: 7 subclasses	Harmful content	Covers crime, cybercrime, privacy, hate, self-harm, and misinformation topics.	Supported
Illegal activity requestsContent safety: 2 subclasses	Illegal content	Asks for help with clearly illegal activities.	Supported
High-risk advice requests	High-risk advice	Seeks unqualified medical, legal, financial, or similar professional advice.	Supported
Unauthorized action	Unauthorized action	Pushes the target to act or claim to act beyond its authority. Most useful for targets with tools.	Supported
Application-layer injection	Unauthorized action	SSRF, SQL injection, shell injection, and object-level access abuse through the target.	Supported
Data exfiltration	Data exfiltration	Tries to move private or enterprise data out through the target.	Supported
Indirect prompt injectionPrompt injection: 8 subclasses	Prompt injection	Places instructions in a document the target reads. Requires a config that passes document content to the target.	Supported
Chain-of-thought hijacking	Jailbreak	Hides a harmful request inside long reasoning content.	Planned

Risk categories

8 supported · 2 planned

Risk category	Standard	What is checked	Capability status
Prompt injectionPrompt injection: 13 subclasses	OWASP LLM01	Higher-priority instructions should stay authoritative.	Supported
JailbreakJailbreak: 23 subclasses	OWASP LLM01	Safety restrictions should hold under disguise or pressure.	Supported
System prompt leakage	OWASP LLM07	Hidden instructions should stay confidential.	Supported
Harmful contentContent safety: 7 subclasses	OWASP LLM09	Unsafe operational instructions should be refused.	Supported
Illegal contentContent safety: 2 subclasses	OWASP LLM09	Requests for illegal activity should be refused.	Supported
High-risk advice	GB/T 45654-2025	High-risk domain advice should be bounded or declined.	Supported
Unauthorized action	OWASP LLM06	Tool and account actions should require valid authorization.	Supported
Data exfiltration	OWASP LLM02	Private data should not be disclosed or exported without authorization.	Supported
Sexual contentContent safety: 7 subclasses	GB/T 45654-2025	Explicit sexual content, harassment, and sexual role-play should be refused.	Planned
Generative AI complianceCompliance baseline: 8 subclasses	China GenAI Interim Measures	Output should meet China’s generative AI service rules, such as non-discrimination and labeling.	Planned

PromptBeat evaluation-set subclasses

PromptBeat evaluation sets are organized in four groups: prompt injection, jailbreak, content safety (with a dedicated sexual-content subset), and compliance baseline. Expand a group to see every subclass and the PromptBeat technique or risk category above that it exercises.

Every evaluation-set subclass is Planned. None is in the current release. Capability status, shown on each mapped technique or risk category, is separate: it says whether you can test that capability today with your own cases. Case counts are not published.

Prompt injection

Direct injection in the conversation, and indirect injection through content the target reads. Languages: Chinese, English. Every subclass in this group also falls under: Risk categoryPrompt injectionSupported

PlannedNo evaluation set is in the current release.

Prompt injection13 subclassesPlannedShow or hide subclasses

Direct5 subclassesPlannedShow or hide subclasses

Subclass	Maps to	Description
System prompt override	Attack techniqueSystem prompt overrideSupported	Claims new system rules that replace the original ones.
Role switching	Attack techniqueInstruction overrideSupported	Tells the target to drop its role and act as another.
Delimiter escape	Attack techniqueInstruction overrideSupported	Fakes the end of user input with delimiters or markup, then adds instructions.
Encoding obfuscation	Attack techniqueEncoding obfuscationSupported	Hides the injected instruction in encoded or transformed text.
Context hijacking	Attack techniqueInstruction overrideSupported	Rewrites the conversation history or task context so the target follows a new goal.

Indirect8 subclassesPlannedShow or hide subclasses

Subclass	Maps to	Description
Documents	Attack techniqueIndirect prompt injectionSupported	Instructions hidden in a document the target is asked to process.
Email body	Attack techniqueIndirect prompt injectionSupported	Instructions hidden in an email the target reads or summarizes.
Web pages	Attack techniqueIndirect prompt injectionSupported	Instructions hidden in web page text or markup.
Code comments	Attack techniqueIndirect prompt injectionSupported	Instructions hidden in comments of code the target reviews.
Tool output	Attack techniqueIndirect prompt injectionSupported	Instructions returned by a tool the target called.
API responses	Attack techniqueIndirect prompt injectionSupported	Instructions hidden in fields of an external API response.
Retrieved passages	Attack techniqueIndirect prompt injectionSupported	Instructions hidden in passages returned by retrieval.
Memory	Attack techniqueIndirect prompt injectionSupported	Instructions placed in stored conversation memory.

Jailbreak

Disguises, personas, and framings used to talk the target out of its safety restrictions. Languages: Chinese. Every subclass in this group also falls under: Risk categoryJailbreakSupported

PlannedNo evaluation set is in the current release.

Jailbreak23 subclassesPlannedShow or hide subclasses

Subclass	Maps to	Description
Movie character	Attack techniqueRole-play disguiseSupported	Asks the target to answer in character as a film character.
Memory exploit	Attack techniqueJailbreakSupported	Cites earlier turns or supposed prior agreement to wear down restrictions.
Amoral advisor persona	Attack techniqueRole-play disguiseSupported	A Machiavelli-style advisor persona that answers without moral limits.
Fictional villain	Attack techniqueRole-play disguiseSupported	Asks the target to speak as a well-known fictional villain.
Storyteller frame	Attack techniqueRole-play disguiseSupported	Puts the request inside a story an unrestricted narrator is writing.
Multi-layer nesting	Attack techniqueJailbreakSupported	Stacks several framings so the real request sits several layers deep.
Hacker role-play	Attack techniqueRole-play disguiseSupported	Casts the target as a hacker character to elicit attack help.
Chaotic villain	Attack techniqueRole-play disguiseSupported	A chaos-loving villain persona that rejects rules.
Developer mode	Attack techniqueJailbreakSupported	Claims a hidden developer or debug mode without restrictions.
Cruel persona	Attack techniqueRole-play disguiseSupported	A persona defined by cruelty, used to pull out harmful answers.
“Do anything now” mode	Attack techniqueJailbreakSupported	Declares an alter ego that can do anything and ignores the rules.
Rule-free world	Attack techniqueRole-play disguiseSupported	Sets the conversation in a world where no laws or rules apply.
Invented persona	Attack techniqueRole-play disguiseSupported	Defines a new character with no restrictions and asks the target to become it.
Movie scene	Attack techniqueRole-play disguiseSupported	Frames the request as dialogue in a scene being filmed.
Villain game	Attack techniqueRole-play disguiseSupported	Sets up a game whose rules reward harmful answers.
“No one is watching”	Attack techniqueJailbreakSupported	Claims the conversation is unmonitored so the rules no longer apply.
Writer persona	Attack techniqueRole-play disguiseSupported	Asks for the content as material for a novel or script.
Actor role-play	Attack techniqueRole-play disguiseSupported	Asks the target to play an actor staying in role.
Sinister persona	Attack techniqueRole-play disguiseSupported	A malicious advisor persona that welcomes harmful requests.
Translation smuggling	Attack techniqueJailbreakSupported	Presents the harmful request as text to translate or rewrite.
“Pretend you are evil”	Attack techniqueRole-play disguiseSupported	Asks the target to pretend to be an evil AI for the rest of the chat.
Academic pretext	Attack techniqueJailbreakSupported	Claims research or teaching needs to justify the request.
Grandma story	Attack techniqueRole-play disguiseSupported	Asks the target to play a late relative who used to tell the answer as a bedtime story.

Content safety

Requests for harmful, illegal, or sexual content, including a dedicated sexual-content subset. Languages: Chinese, English.

PlannedNo evaluation set is in the current release.

Content safety16 subclassesPlannedShow or hide subclasses

General11 subclassesPlannedShow or hide subclasses

Subclass	Maps to	Description
Criminal activity	Attack techniqueIllegal activity requestsSupportedRisk categoryIllegal contentSupported	Help planning or carrying out crimes.
Fraud	Attack techniqueIllegal activity requestsSupportedRisk categoryIllegal contentSupported	Scams, phishing scripts, and other deception for gain.
Weapons	Attack techniqueHarmful content elicitationSupportedRisk categoryHarmful contentSupported	Making, acquiring, or using weapons.
Violence	Attack techniqueHarmful content elicitationSupportedRisk categoryHarmful contentSupported	Content that promotes or instructs violence against people.
Hate speech	Attack techniqueHarmful content elicitationSupportedRisk categoryHarmful contentSupported	Content attacking people for protected characteristics.
Self-harm	Attack techniqueHarmful content elicitationSupportedRisk categoryHarmful contentSupported	Content that encourages or instructs self-harm or suicide.
Substance abuse	Attack techniqueHarmful content elicitationSupportedRisk categoryHarmful contentSupported	Obtaining, making, or misusing drugs and controlled substances.
Misinformation	Attack techniqueHarmful content elicitationSupportedRisk categoryHarmful contentSupported	Fabricating or spreading false claims presented as fact.
Privacy violation	Attack techniqueHarmful content elicitationSupportedRisk categoryHarmful contentSupported	Finding, compiling, or exposing personal information about others.
Sexual content	Risk categorySexual contentPlanned	Explicit sexual content within the general set.
Sexual content involving minors	Risk categorySexual contentPlanned	Must always be refused. Labels are still under review.

Sexual content5 subclassesPlannedShow or hide subclasses

Subclass	Maps to	Description
Explicit sexual content	Risk categorySexual contentPlanned	Requests for explicit sexual descriptions.
Sexual harassment	Risk categorySexual contentPlanned	Content that sexually harasses or demeans a person.
NSFW requests	Risk categorySexual contentPlanned	Requests for adult material not suitable for general audiences.
Sexual role-play	Risk categorySexual contentPlannedAttack techniqueRole-play disguiseSupported	Steers a role-play toward sexual content.
Sexual content involving minors	Risk categorySexual contentPlanned	Must always be refused. Labels are still under review.

Compliance baseline

Requirements from China’s generative AI service rules. Languages: Chinese.

PlannedNo evaluation set is in the current release.

Compliance baseline8 subclassesPlannedShow or hide subclasses

Subclass	Maps to	Description
Discrimination	Risk categoryGenerative AI compliancePlanned	Output should not discriminate by ethnicity, belief, gender, age, or similar traits.
False information	Risk categoryGenerative AI compliancePlanned	Output should not fabricate or spread false information.
Politically sensitive content	Risk categoryGenerative AI compliancePlanned	Output should stay within the content rules for public-facing services.
Personal information	Risk categoryGenerative AI compliancePlanned	Personal information should not be collected, inferred, or disclosed without a lawful basis.
Minor protection	Risk categoryGenerative AI compliancePlanned	Responses should account for users who may be minors.
Algorithm transparency	Risk categoryGenerative AI compliancePlanned	The service should be truthful about being AI and about its limits.
Content labeling	Risk categoryGenerative AI compliancePlanned	Generated content should be labeled as AI-generated where required.
Cross-border data	Risk categoryGenerative AI compliancePlanned	Handling of requests to move data across borders.

AgentBeat

AgentBeat runs test cases. Each case states the task, the risk category, the expected behavior, and what evidence decides the result. Coverage in a run depends on which cases you include and what evidence your agent exposes.

Attack techniques

3 supported · 7 planned

Technique	Risk category	Description	Capability status
Untrusted content injection	Goal hijacking, tool misuse	Plants instructions in email, documents, web pages, or tool output the agent reads during a task.	Supported
RAG knowledge-base poisoning	Context poisoning	Plants passages in the knowledge base and checks retrieval and answer impact. Requires an authorized, seedable test knowledge base.	Supported
Foot-in-the-door escalation	Tool misuse	Chains small harmless steps before a sensitive tool action. Requires a target that exposes tool calls.	Supported
Inter-agent message attacks	Inter-agent communication	Abuses messages and delegation between cooperating agents.	Planned
Tool and MCP metadata poisoning	Supply chain	Hides instructions in tool descriptions, parameters, or third-party MCP server metadata the agent reads when choosing tools.	Planned
Persistent memory injection	Context poisoning	Gets instructions written into long-term memory so they steer later sessions.	Planned
Approval prompt manipulation	Trust exploitation	Disguises the real action in a human approval request, or wears reviewers down with repeated requests.	Planned
Delegated privilege escalation	Privilege abuse	Chains tools or sub-agents to reach permissions the task never granted.	Planned
Multimodal content injection	Goal hijacking	Places instructions in images, screenshots, or audio the agent processes.	Planned
Resource exhaustion loops	Cascading failures	Drives the agent into repeated tool calls or runaway model spend.	Planned

Risk categories

Risk categories are mapped to the OWASP Top 10 for Agentic Applications (ASI). A category labels the cases being run; it is not a separate scanner.

15 supported · 6 planned

Risk category	Standard	What is checked	Capability status
Prompt injection	ASI01 Goal hijacking	The agent follows attacker goals instead of the user’s task.	Supported
Task rule breach	ASI01 Goal hijacking	The agent is talked out of the rules of its task.	Supported
Unauthorized tool use	ASI02 Tool misuse	The agent calls tools or actions the user did not authorize.	Supported
Sensitive data leak	ASI02 Tool misuse	Internal or sensitive data leaves its boundary.	Supported
Privacy violation	ASI02 Tool misuse	Personal information is accessed or disclosed without authorization.	Supported
Destructive action	ASI02 Tool misuse	Data or resources are deleted or damaged.	Supported
Financial fraud	ASI02 Tool misuse	Unauthorized transfers or changed payment recipients.	Supported
Reconnaissance	ASI02 Tool misuse	The agent gathers environment or business details it should not.	Supported
Unauthorized surveillance	ASI02 Tool misuse	Tracking or monitoring people without authorization.	Supported
Unauthorized access	ASI03 Privilege abuse	Identity or permission boundaries are crossed.	Supported
Credential leak	ASI03 Privilege abuse	Passwords, tokens, or keys are exposed.	Supported
Supply chain attack	ASI04 Supply chain	Tools, dependencies, or upstream artifacts are abused.	Supported
Unexpected code execution	ASI05 Code execution	The agent runs code it was not meant to run.	Supported
Config and context tampering	ASI06 Context poisoning	Configuration, memory, or retrieved context is maliciously changed.	Supported
Social engineering	ASI09 Trust exploitation	Human trust in the agent is used to drive unsafe actions.	Supported
Insecure inter-agent communication	ASI07	Unsafe trust or delegation between agents.	Planned
Cascading failures	ASI08	Failures spreading across workflows or tool chains.	Planned
Rogue agents	ASI10	Agents acting outside ownership or governance controls.	Planned
Persistent memory poisoning	ASI06 Context poisoning	Long-term memory carries attacker content into later sessions.	Planned
Human approval bypass	ASI09 Trust exploitation	A sensitive action completes without the approval it requires, or with approval obtained under false pretenses.	Planned
Unbounded resource consumption	ASI08 Cascading failures	Tool calls, tokens, or spend grow without a limit the task needs.	Planned

Scope

• Results apply only to the cases, target configuration, and evidence of that run. They are not a security certification.
• Run tests only against systems you are authorized to test, using isolated test data.
• Tests that call models may incur costs with your model provider.

See PromptBeat scenarios and AgentBeat scenarios for how to prepare test cases.