| Sensitive data exfiltration | Reveal prompts, secrets, retrieved documents, memory, or tool results | Requests to expose hidden context, export data, or repeat internal content | Data leakage prevention, authorization, output checks |
| Unauthorized tool use | Send messages, browse, run code, write records, or call external systems | The model converts attacker instructions into actions beyond user entitlement | Least privilege, approval gates, allowlisted destinations |
| Trust upgrade or privilege escalation | Make untrusted text look like system, developer, or admin instruction | Audit, debugging, or compliance pretexts that ask the model to ignore policy | Provenance, instruction hierarchy, boundary separation |
| Workflow hijack | Change the plan, skip checks, or reroute the task | The workflow bypasses retrieval filters, approvals, or validation steps | Orchestration controls, step validation, Anthale at boundaries |
| Persistent compromise | Poison memory, summaries, or vectorized context for later reuse | The same malicious instruction keeps resurfacing across later requests | Memory write controls, expiry, review |
| Unsafe externalization | Produce harmful content, malicious links, or unsafe executable output | The response itself becomes the next attack stage for a user or downstream system | Content moderation, link control, output validation |
