We Catalogued 122 Ways to Break AI Systems. Here's the Taxonomy.

Update, September 2026: this post describes the taxonomy at launch (122 attacks in 11 categories). It now covers 168 attacks in 16 categories, with versioned relations to the OWASP LLM Top 10 2026, the OWASP Agentic Top 10 2026, the OWASP MCP Top 10 (beta) and MITRE ATLAS 2026.07. The OWASP labels below use the 2026 identifiers. The 2026 release renumbered eight of the ten risks, so older labels may differ. See the repository for current counts.

Every deployed AI system shares one problem: it can be tricked. Prompt injection, jailbreaks and data extraction are not theoretical. They are actively exploited against every major model.

We built a taxonomy of AI-specific attack vectors. The result is 122 distinct attacks, mapped to the OWASP LLM Top 10 and MITRE ATLAS. It covers basic prompt injection through multi-turn manipulation and vision-based exploits.

Today we are open-sourcing it: the attack catalog, the OWASP and ATLAS mappings, the remediation guidance and the schema. It is on GitHub at tachyonic-sh/taxonomy.

Why 122?

Most AI security discussion focuses on a few well-known attacks: "ignore previous instructions", DAN jailbreaks and basic prompt leaking. These are real. They are also a small part of the surface.

AI systems face attacks across 11 categories. Each category holds several techniques with different mechanisms, success conditions and defenses. A system that blocks a naive instruction override can still fall to an encoding bypass, a multi-turn escalation or an indirect injection through retrieved content.

The count comes from cataloguing documented attack techniques, research findings and real-world exploits across that surface.

The 11 Categories

The counts below are the launch counts.

1. Prompt Injection (20 attacks)

The most widely discussed AI vulnerability. An attacker provides input that overrides the system's intended behavior. This includes direct instruction overrides, context manipulation, delimiter exploitation and encoding bypasses (base64, ROT13, unicode smuggling).

It is hard to defend because the model processes instructions and data through the same channel. There is no built-in separation between trusted instructions and untrusted input.

OWASP LLM01: Prompt Injection

2. System Prompt Leakage (12 attacks)

A system prompt often contains business logic, pricing rules, persona definitions or API keys. Attackers extract it through direct requests, reflection attacks ("repeat everything above"), completion prompts and behavioral inference.

A leaked system prompt reveals the application's architecture, constraints and likely weaknesses. It is a blueprint for further attacks.

OWASP LLM08: Hidden Context Exposure

3. Jailbreaks (22 attacks)

The largest category. Jailbreaks bypass safety guardrails through persona hijacking (DAN and its successors), hypothetical framing, multi-language attacks, token manipulation and narrative structures.

The surface is broad because safety alignment is a best-effort defense. New variants appear constantly, and models that resist one technique often fall to another.

OWASP LLM01: Prompt Injection

4. Vision/Multimodal Attacks (12 attacks)

Systems that process images, documents and other media inherit new attack surfaces. These include typographic injection (text embedded in images), steganographic payloads, cross-modal obfuscation (splitting attack content across text and image) and adversarial perturbations.

Many vision attacks bypass text-based defenses entirely because the malicious content sits in a different modality.

OWASP LLM01: Prompt Injection (multimodal)

5. Excessive Agency / Tool Abuse (12 attacks)

Agents with tool access (browsing, file operations, API calls, database queries) face a specific risk. An attacker can steer the agent into misusing its own capabilities. This includes parameter injection in tool calls, tool chaining for privilege escalation, scope escape and SSRF through agent-initiated requests.

The more capable the agent, the larger the blast radius.

OWASP LLM03: Excessive Agency

6. Multi-Turn Manipulation (8 attacks)

Not every attack happens in one message. Multi-turn techniques exploit conversation context: building malicious context gradually, pushing boundaries incrementally, manipulating memory in persistent sessions and leaking context across sessions.

These are harder to detect because each message looks benign. The exploit only shows across the full conversation.

OWASP LLM01: Prompt Injection (multi-turn)

7. Sensitive Information Disclosure (10 attacks)

Techniques for extracting training data, PII, proprietary information or other content the model should not reveal. This goes beyond system prompt extraction to include training data extraction, membership inference and model inversion.

OWASP LLM02: Sensitive Information Disclosure

8. Supply Chain Attacks (8 attacks)

Attacks on the AI supply chain: poisoned training data, compromised model weights, malicious fine-tuning datasets, backdoored plugins and tools, and dependency vulnerabilities in AI frameworks.

OWASP LLM04: Supply Chain

9. Vector/Embedding Attacks (8 attacks)

Attacks on RAG systems and vector databases: embedding injection, nearest-neighbor poisoning, retrieval manipulation and context window overflow through adversarial documents.

OWASP LLM09: Vector and Embedding Weaknesses

10. Improper Output Handling (8 attacks)

When model output is used downstream (rendered as HTML, executed as code, passed to APIs), attackers can use the model as an injection vector. This includes XSS through model output, SQL injection via generated queries and command injection through suggested actions.

OWASP LLM10: Improper Output Handling

11. Unbounded Consumption (2 attacks)

Resource exhaustion attacks that cause denial of service or economic harm: context window exhaustion (forcing the model to generate or process very long content) and recursive generation (self-referential loops that consume resources indefinitely).

OWASP LLM06: Unbounded Consumption

How the Taxonomy Is Structured

Each attack in the catalog includes:

ID: a unique identifier (for example PI-001, JB-015, MT-003)
Name: a readable attack name
Category: the category it belongs to
Description: what the attack does and how it works conceptually
Severity: critical, high, medium or low
Framework relations: the OWASP and MITRE ATLAS entries it relates to, where applicable

Remediation guidance is provided separately, organized by OWASP category, with code examples for input validation and output sanitization.

The YAML schema is extensible. You can add your own attack definitions in the same format.

What's Not in the Open-Source Repository

We share the "what" but not the "how". The taxonomy lists which attacks exist and how to defend against them. It does not include:

Attack payloads (the prompts and content that execute each attack)
Detection logic (how to tell whether an attack succeeded)
Model-specific success rates
Confidence scoring methodology

These stay proprietary. They are the difference between knowing that prompt injection exists and being able to test for it systematically.

Why This Matters

If you build an AI product, you need to know what you are defending against. "We have guardrails" is not an answer when there are 122 documented ways around them.

The taxonomy gives you:

A checklist: do your defenses cover every category?
A common language: reference specific attack IDs in security discussions
Prioritization: focus on the categories relevant to your architecture
Framework traceability: OWASP and MITRE ATLAS references for assessment and audit work. A mapping is not a compliance result.

Get the Taxonomy

The catalog is on GitHub: tachyonic-sh/taxonomy.

It includes the attack catalog, the framework relations, remediation guidance with code examples, the YAML schema and a research papers index.

If you have documented an attack technique we have not catalogued, open a data proposal issue with your sources.

Where Tachyonic Fits

We build security runtimes for AI agents and MCP systems. A runtime runs attack patterns from this taxonomy against your agent or MCP server and returns reproducible findings with a signed evidence bundle. What a run covers depends on the target and the scope you set.

The free tier covers your first runtimes, and the quickstart takes minutes. To scope testing against a specific agent surface, book a 15-minute call.