Attack Catalog
Attack categories, OWASP LLM Top 10 2026 and MITRE ATLAS relations, severity and scoring
The attack library ships 195 attacks:
- 168 from the open attack taxonomy, across 16 categories
- 27 transport-recon probes, which are opt-in and excluded from default scans
Pass --include-builtin to add 42 built-in modules, for 237 in total.
Each library attack carries its own identifier and name from the OWASP GenAI LLM Top 10 2026 or the OWASP Top 10 for Agentic Applications 2026, plus a MITRE ATLAS 2026.07 technique where one applies. Built-in modules carry no framework label.
OWASP renumbered its list in 2026
The 2026 release moved eight of the ten risks to new identifiers. LLM03 meant Supply Chain in 2025 and means Excessive Agency in 2026. When you compare reports, check which year each one uses.
A mapping says which risk an attack relates to. It is not a test result, a compliance finding or a certification.
Categories
| Category | --category | Library | Built-in | OWASP 2026 |
|---|---|---|---|---|
| Prompt Injection | prompt-injection | 20 | 3 | LLM01 |
| System Prompt Extraction | system-prompt-extraction | 12 | 3 | LLM08 Hidden Context Exposure |
| Jailbreak | jailbreak | 22 | 3 | LLM01 |
| Vision Injection | vision-injection | 12 | 0 | LLM01 |
| Multi-Turn Manipulation | multi-turn-manipulation | 10 | 2 | LLM01 |
| Tool Abuse | tool-abuse | 20 | 6 | LLM03 Excessive Agency |
| Sensitive Disclosure | sensitive-disclosure | 10 | 4 | LLM02 |
| Supply Chain | supply-chain | 12 | 0 | LLM04 |
| Vector Embedding | vector-embedding | 10 | 0 | LLM09 |
| Improper Output | improper-output | 8 | 3 | LLM10 |
| Unbounded Consumption | unbounded-consumption | 2 | 0 | LLM06 |
| Misinformation | misinformation | 6 | 2 | LLM07 |
| Memory and Context Poisoning | memory-context-poisoning | 6 | 0 | ASI06 |
| Unexpected Code Execution | unexpected-code-execution | 6 | 0 | ASI05 |
| Inter-Agent Communication | inter-agent-communication | 6 | 0 | ASI07 |
| Human Trust Exploitation | human-trust-exploitation | 6 | 0 | ASI09 |
| Indirect Injection | indirect-injection | 0 | 4 | none (built-in) |
| Permission Escalation | permission-escalation | 0 | 6 | none (built-in) |
| Multi-Agent Injection | multi-agent-injection | 0 | 6 | none (built-in) |
| Transport Recon (opt-in) | transport-recon | 27 | 0 | varies per attack |
The OWASP column shows the category's usual identifier. Some attacks map elsewhere, so the per-attack identifier in your report is authoritative. The taxonomy's category table lists each category's 2025 identifier for reconciling older reports.
What each category tests
- Prompt injection: instruction override, role hijacking, delimiter attacks and encoding bypasses.
- System prompt extraction: direct extraction, indirect leakage and format manipulation to reveal hidden instructions.
- Jailbreak: persona prompts, roleplay, encoding tricks, multi-language bypass and hypothetical framing.
- Vision injection: text-in-image injection, steganographic payloads and adversarial patches. Requires a vision-capable target.
- Multi-turn manipulation: context poisoning, incremental jailbreaks and trust building across turns.
- Tool abuse: parameter manipulation, tool chaining, path traversal, SQL injection and SSRF through tools.
- Sensitive disclosure: extraction of PII, credentials and internal data.
- Supply chain: tool schema poisoning, dependency confusion and plugin backdoors.
- Vector embedding: manipulation of embeddings, retrieval and semantic search.
- Improper output: output that enables downstream attacks, such as HTML/JS injection or command injection in generated code.
- Unbounded consumption: recursive expansion and prompts that exhaust tokens, compute or time.
- Misinformation: convincing false information and manipulated factual output.
- Memory and context poisoning: persistent memory and context that an attacker can seed for later turns or sessions.
- Unexpected code execution: agents that run code or commands they should not.
- Inter-agent communication: injection and impersonation between cooperating agents.
- Human trust exploitation: agent output that manipulates the human reviewing it.
- Indirect injection: instructions delivered through RAG documents, tool responses or web content. Requires a RAG-enabled target.
- Permission escalation: admin impersonation, token privilege escalation, cross-tenant access and role confusion.
- Multi-agent injection: orchestrator override, agent impersonation and inter-agent prompt injection.
- Transport recon: HTTP and MCP transport-layer probes such as headers, methods, CORS and error handling. Opt-in only.
Severity Levels
| Level | Weight | Description |
|---|---|---|
| Critical | 5.0 | Remote code execution, credential leakage, full system compromise |
| High | 3.0 | Data exfiltration, privilege escalation, safety bypass |
| Medium | 2.0 | Information disclosure, partial guardrail bypass |
| Low | 1.0 | Minor information leakage, low-impact behavior change |
| Info | 0.5 | Informational findings, no direct security impact |
Resistance Score
After a scan, Tachyonic calculates a resistance score from 0 to 100:
| Score | Rating | Meaning |
|---|---|---|
| 90-100 | Excellent | Robust defenses, minor issues only |
| 70-89 | Good | Solid baseline, some gaps |
| 50-69 | Fair | Multiple vulnerabilities, needs work |
| 30-49 | Poor | Significant exposure, urgent fixes needed |
| 0-29 | Critical | Easily exploitable, immediate action required |
The score is severity-weighted, so a single critical finding moves it more than several low findings. It covers only the attacks that ran in that scan.
Custom Attack Library
Attack definitions are YAML files. Point TACHYONIC_LIBRARY_PATH at a directory to load your own library. The older HEURISTICS_PATH spelling still works.
export TACHYONIC_LIBRARY_PATH=/path/to/your/attacks
tachyonic scan --target ... --include-builtinSee the attack schema for the YAML format.