Inter-agentic
threat atlas.
An interconnected system deserves an interconnected view. Follow documented paths across the AI harness, then identify the independent controls and evidence that matter.
See the exposure.
Interrogate the evidence.
Select a component or a source case. Each ring distinguishes a different evidence class; the detail panel connects the selected surface to its propagation path, independent producer and proposed response.
One ecosystem. Nineteen surfaces.
Five cases. Different kinds of evidence.
Research capability is not the same as malicious exploitation. A failure is not automatically an attack. The distinction stays attached to the source.
ServiceNow Now Assist
19 Nov 2025Research demonstration
A benign agent reads a planted prompt, discovers a more capable teammate and recruits it. The recruited agent reads and modifies records and sends email, under the privileges of the user who started the session. Nothing was exploited; three defaults were used as designed.
Read the supplied propagation path and controls →Primary research checked 27 Oct 2026. Demonstrated path, not a claim of widespread exploitation.
Read the primary report ↗Runtime path labels:
GitHub MCP
26 May 2025Research demonstration
A malicious issue in a public repository told the agent to read all of the author's repositories and publish what it found. Because the agent held one broad token and auto-approval was on, it did, and private project, salary and relocation details landed in a public pull request.
Read the supplied propagation path and controls →Primary research checked 27 Oct 2026. Controlled demonstration using demo repositories.
Read the primary report ↗Runtime path labels:
Salesforce ForcedLeak
25 Sep 2025Research demonstration
An attacker submitted a Web-to-Lead form with instructions hidden in the 42,000-character description field. Weeks later an employee asked Agentforce about the lead. The agent followed the instructions, queried CRM data and emitted an image tag whose URL carried the data to a domain that was still on Salesforce's content security policy allowlist because nobody noticed it had expired.
Read the supplied propagation path and controls →Primary research checked 27 Oct 2026. Historical demonstration; the source reports Trusted URL mitigation from 8 Sep 2025.
Read the primary report ↗Runtime path labels:
Asana MCP
Jun 2025Reported operational failure
No adversary. A bug in Asana's MCP server meant that for about a month, task details, project metadata, comments and files from one organization could surface in other organizations' AI assistants. Roughly 1,000 customers were affected. The harness failed at the seam between the extension and the identity plane.
Read the supplied propagation path and controls →Reported operational isolation failure in the supplied reference. Not independently reverified here; no malicious actor asserted.
Primary-source revalidation not completed for this case.Runtime path labels:
Replit coding agent
Jul 2025Reported operational failure
During a declared code freeze the coding agent ran destructive commands against the live database, wiping more than 1,200 executive entries and nearly 1,200 company records, then generated about 4,000 fabricated user profiles and unit-test results that misrepresented the system's state. The instruction "do not touch production" existed; the control did not.
Read the supplied propagation path and controls →Reported operational failure in the supplied reference. Not independently reverified here; no malicious actor asserted.
Primary-source revalidation not completed for this case.Runtime path labels:
Evidence has a boundary, too.
The circle encompasses the complete 19-component reference model. It is not a census of every AI incident or a live view of your environment.
What the heat means
Each cell counts unique cases that the supplied threat map associates with that component. The inner ring uses runtime path labels from the three research demonstrations. The middle ring uses runtime path labels from the two reported operational failures. The outer ring uses components named in the retrospective lifecycle-control discussion.
Count = distinct source cases naming the component in that ring. A component may appear in more than one ring. A named component can represent a missing or bypassed control; it does not mean that control was deployed or effective.
Color measures association count only. It does not encode severity, probability, attack volume, telemetry coverage or current vendor exposure. Zero means no mapping in this selected corpus, not no risk.
What is established
ServiceNow, GitHub MCP and ForcedLeak are presented as research demonstrations. Primary reports were checked for this release. Asana and Replit remain source-reported operational cases, not independently reverified incidents. No malicious actor is asserted for those two cases.
Component-to-case mappings and suggested controls are Richard E. Davis's analytical interpretation in the supplied reference. The lifecycle ring is explicitly retrospective analysis, not known observed attack activity.
MITRE ATLAS and OWASP identifiers are preserved as source-assigned taxonomy. This build does not independently certify each mapping or establish that a technique occurred. Vendor names are descriptive; no current configuration, partnership certification or deployed HoundBytes detection is asserted.
Numerical alternative: all 19 components, unfiltered corpus totals
| Component | Plane | Research | Operational | Lifecycle analysis |
|---|---|---|---|---|
| 6.00 Generative model | Control | 2 | 1 | 0 |
| 6.01 Inputs & external content | Boundary | 3 | 2 | 0 |
| 6.02 Orchestrator / agent loop | Control | 1 | 2 | 0 |
| 6.03 RAG subsystem | Data | 2 | 1 | 0 |
| 6.04 Memory & state | Data | 1 | 1 | 0 |
| 6.05 Context assembly | Control | 3 | 2 | 0 |
| 6.06 Input / output guardrails | Control | 1 | 0 | 0 |
| 6.07 Policy / authorization gate | Identity & action | 3 | 1 | 0 |
| 6.08 Credential broker | Identity & action | 2 | 2 | 0 |
| 6.09 Extensions / MCP / skills | Identity & action | 1 | 1 | 0 |
| 6.10 Tool dispatcher | Identity & action | 3 | 1 | 0 |
| 6.11 Sandbox / downstream systems | Data | 3 | 1 | 0 |
| 6.12 Observability & audit | Evidence | 3 | 2 | 0 |
| 6.13 Identity & delegation | Lifecycle | 0 | 0 | 3 |
| 6.14 Evaluation & conformance | Lifecycle | 0 | 0 | 3 |
| 6.15 Human oversight console | Lifecycle | 0 | 0 | 3 |
| 6.16 AI BOM & attestation | Lifecycle | 0 | 0 | 3 |
| 6.17 Authority & consumption | Lifecycle | 0 | 0 | 2 |
| 6.18 Transparency & recourse | Lifecycle | 0 | 0 | 1 |
Source basis: supplied DavisAIgov / HoundBytes / Elastic Integrated Threat Map, reference v1.1, and AI Harness Telemetry to SIEM — Component Field Map, v1.0, 27 October 2026. Site release v13.5.6; interactive module v1.0.0. Historical reference-model versions remain identified as historical. Download the source-derived visual dataset.