Multi-Agent Reference Architecture Threats
Architecture threats grounded in AIGF risk vectors for the multi-agent reference architecture.
Information Leakage
Unauthorized disclosure of sensitive data through models, retrieval, or sessions.
CCC.MARefArc.TH01Model memorization leaks sensitive data across sessions
The hosted models accessed through the LLM layer may memorize sensitive inputs or training data and later disclose customer PII, proprietary algorithms, or trading strategies, including cross-user leakage into unrelated sessions.
AIR-VECAIR-RC-001-01AIR-RC-001-02AIR-RC-001-05
CCC.MARefArc.CPCCC.MARefArc.CP16CCC.MARefArc.CP14
CCC.MARefArc.TH02Hosted-provider data-handling exposure
Sensitive data submitted through the LLM gateway to third-party hosted models is exposed when the provider lacks transparent encryption, retention limits, or secure-deletion guarantees, leaving the institution without control over data it no longer holds.
AIR-VECAIR-RC-001-03AIR-RC-001-04
CCC.MARefArc.CPCCC.MARefArc.CP14CCC.MARefArc.CP16
CCC.MARefArc.TH03Embedding inversion and membership inference on the vector store
Vectors stored for semantic retrieval can be inverted to reconstruct original source text, or probed to infer whether specific confidential information is present, exposing PII or proprietary content held in the knowledge layer.
AIR-VECAIR-SEC-002-01AIR-SEC-002-02
CCC.MARefArc.CPCCC.MARefArc.CP13
CCC.MARefArc.TH04Embedding-store poisoning degrades retrieved context
An actor with write access injects malicious or misleading embeddings into the vector store, degrading the accuracy of retrieved grounding context; the dense numerical representation makes the tampering hard to detect.
AIR-VECAIR-SEC-002-03
CCC.MARefArc.CPCCC.MARefArc.CP13
CCC.MARefArc.TH05Vector-store access-control, encryption, and audit gaps
Missing role-based access control, encryption at rest, or audit logging on the vector store allows unauthorized retrieval, modification, or undetected exfiltration of embeddings derived from sensitive internal data.
AIR-VECAIR-SEC-002-04AIR-SEC-002-05
CCC.MARefArc.CPCCC.MARefArc.CP13
Data Poisoning
Corruption or manipulation of training, retrieval, or learning data.
CCC.MARefArc.TH06Foundation-model training and fine-tuning data poisoning
Adversaries tamper with training, fine-tuning, or third-party data feeds behind the approved models, mislabeling data or embedding backdoor triggers and biases that corrupt downstream decisions without visible symptoms until a major failure.
AIR-VECAIR-SEC-009-01AIR-SEC-009-03AIR-SEC-009-04
CCC.MARefArc.CPCCC.MARefArc.CP14
CCC.MARefArc.TH07Adaptive-learning and continuous-learning exploitation
The adaptive-learning capability that refines prompts and configurations from execution outcomes can be steered by an adversary who systematically feeds misleading signals, gradually skewing agent behaviour when validation of learning inputs is inadequate.
AIR-VECAIR-SEC-009-02
CCC.MARefArc.CPCCC.MARefArc.CP11
Model Availability
Denial of wallet, outage, and resource exhaustion affecting model service.
CCC.MARefArc.TH08Denial of Wallet via token-expensive or unthrottled agentic calls
Token-expensive prompts, large-document chunking, or poorly throttled agentic loops drive excessive model and tool invocations, exhausting token budgets, triggering throttling, or inflating cost beyond capacity planning.
AIR-VECAIR-OP-007-01
CCC.MARefArc.CPCCC.MARefArc.CP16CCC.MARefArc.CP06
CCC.MARefArc.TH09Technology service provider outage or degradation
Tight coupling to a specific external model provider with limited failover leaves the system exposed to provider outages or performance degradation under load, violating business-continuity expectations.
AIR-VECAIR-OP-007-02
CCC.MARefArc.CPCCC.MARefArc.CP15CCC.MARefArc.CP14
CCC.MARefArc.TH10VRAM exhaustion on model-serving infrastructure
Configuration changes, aggressive caching, or memory leaks in model-serving libraries behind the LLM gateway exhaust GPU VRAM, degrading responsiveness or crashing model serving.
AIR-VECAIR-OP-007-03
CCC.MARefArc.CPCCC.MARefArc.CP15
Prompt Injection
Direct and indirect injection that overrides policy or extracts secrets.
CCC.MARefArc.TH11Direct prompt injection overrides guardrails
An actor interacting through the application crafts inputs that override system prompts, bypass safety guardrails, or coerce disclosure, requiring no special privileges and exploiting any gap in ingress and model-interaction guardrails.
AIR-VECAIR-SEC-010-01
CCC.MARefArc.CPCCC.MARefArc.CP05CCC.MARefArc.CP16CCC.MARefArc.CP01
CCC.MARefArc.TH12Indirect prompt injection via retrieved or processed content
Malicious instructions hidden in retrieved documents, web-search results, tool outputs, or persisted memory are processed by an agent and hijack its decision-making, escalate privileges, trigger unauthorized actions, or exfiltrate data, which is especially dangerous in automated multi-agent workflows.
AIR-VECAIR-SEC-010-02
CCC.MARefArc.CPCCC.MARefArc.CP12CCC.MARefArc.CP13CCC.MARefArc.CP08CCC.MARefArc.CP09
CCC.MARefArc.TH13Model profiling and system-prompt extraction
Crafted prompt sequences probe model internals to extract proprietary system prompts, configurations, or fine-tuning and RAG corpus content, enabling intellectual-property theft, model cloning, or follow-on attacks.
AIR-VECAIR-SEC-010-03
CCC.MARefArc.CPCCC.MARefArc.CP16
Operational
Overreach, reputational, and operational misuse risks.
CCC.MARefArc.TH14Model overreach and scope creep beyond validated use
Agents are used beyond their validated scope as users discover new applications or systems are repurposed without re-evaluation, producing unreliable outputs in untested contexts; weak registry scoping and orchestration boundaries accelerate the drift.
AIR-VECAIR-OP-018
CCC.MARefArc.CPCCC.MARefArc.CP06CCC.MARefArc.CP03
CCC.MARefArc.TH15Reputational harm from offensive or misleading outputs
The system generates offensive, misleading, or inappropriate outputs, or is manipulated into doing so, that are attributed to the organization, with reputational and regulatory impact when output filtering and human review are insufficient.
AIR-VECAIR-OP-020
CCC.MARefArc.CPCCC.MARefArc.CP16CCC.MARefArc.CP22CCC.MARefArc.CP02
Output Integrity
Hallucination, non-determinism, and grounding failures.
CCC.MARefArc.TH16Confident hallucination and fabricated facts
Lacking ground truth and faced with ambiguous prompts or helpfulness-biased tuning, the model fabricates plausible but false facts, figures, or citations, presented with high fluency that makes errors hard to catch and likely to be acted upon.
AIR-VECAIR-OP-004-01AIR-OP-004-02AIR-OP-004-03AIR-OP-004-04
CCC.MARefArc.CPCCC.MARefArc.CP16CCC.MARefArc.CP22CCC.MARefArc.CP02
CCC.MARefArc.TH17Non-deterministic and non-reproducible outputs
Probabilistic sampling, internal-state variation, context sensitivity, and decoding parameters cause identical inputs to yield different outputs across runs, undermining testing, reproducibility, and reliable evaluation.
AIR-VECAIR-OP-006-01AIR-OP-006-02AIR-OP-006-03AIR-OP-006-04
CCC.MARefArc.CPCCC.MARefArc.CP14CCC.MARefArc.CP15CCC.MARefArc.CP20
CCC.MARefArc.TH18RAG grounding failures
Even with retrieval, responses may contradict retrieved documents, drop caveats truncated by the context window, fill gaps with incorrect general knowledge, exceed authorized advisory scope, or adopt an inappropriate tone or certainty for the domain.
AIR-VECAIR-OP-014-01AIR-OP-014-02AIR-OP-014-03AIR-OP-014-04AIR-OP-014-05
CCC.MARefArc.CPCCC.MARefArc.CP12CCC.MARefArc.CP13CCC.MARefArc.CP16
Model Integrity
Supply-chain, drift, backdoors, and model tampering.
CCC.MARefArc.TH19Silent model version, prompt, and deployment drift
Providers silently retrain, re-prompt, or re-architect models, or change deployment and API defaults, shifting behaviour even when inputs are unchanged; without version pinning in the model registry this breaks reproducibility and validated behaviour.
AIR-VECAIR-OP-005-01AIR-OP-005-02AIR-OP-005-03AIR-OP-005-04
CCC.MARefArc.CPCCC.MARefArc.CP14
CCC.MARefArc.TH20Model supply-chain tampering
Adversaries tamper with training data, weights, GPU firmware and operating systems, cloud orchestration, or ML libraries in the provider pipeline, embedding manipulations that are difficult to detect downstream of the LLM gateway.
AIR-VECAIR-SEC-008-01AIR-SEC-008-02AIR-SEC-008-03
CCC.MARefArc.CPCCC.MARefArc.CP14
CCC.MARefArc.TH21Backdoor triggers and safety-mechanism disablement
Where weights are accessible, adversarial fine-tuning, engineered trigger phrases, or tampering disables alignment and content-moderation safeguards, causing targeted unsafe behaviour under specific conditions.
AIR-VECAIR-SEC-008-04AIR-SEC-008-05
CCC.MARefArc.CPCCC.MARefArc.CP16CCC.MARefArc.CP14
Data Quality
Poor, drifting, or bias-amplifying data.
CCC.MARefArc.TH22Poor-quality, drifting, and bias-amplifying data
Inaccurate, incomplete, outdated, or biased grounding and training data lead to unreliable outputs, while data and concept drift erodes predictive power over time and amplifies historical errors at scale.
AIR-VECAIR-OP-019-01AIR-OP-019-02AIR-OP-019-03
CCC.MARefArc.CPCCC.MARefArc.CP12CCC.MARefArc.CP13CCC.MARefArc.CP14
Fairness
Discriminatory or biased outputs.
CCC.MARefArc.TH23Discriminatory outputs from bias
Biased training data, architectural and feature choices, proxy variables such as postal codes, and uncorrected feedback loops cause systematically discriminatory outcomes against protected groups, with legal and reputational exposure.
AIR-VECAIR-OP-016-01AIR-OP-016-02AIR-OP-016-03AIR-OP-016-04
CCC.MARefArc.CPCCC.MARefArc.CP14CCC.MARefArc.CP12CCC.MARefArc.CP20CCC.MARefArc.CP21
Governance and Compliance
Explainability, MRM, IP, and compliance gaps.
CCC.MARefArc.TH24Lack of explainability and traceable rationale
Black-box foundation models produce outputs without traceable rationale, leaving the firm unable to justify AI-driven decisions to regulators, stakeholders, or customers and allowing latent errors or biases to go undetected; observability and human oversight are the principal mitigating surfaces.
AIR-VECAIR-OP-017
CCC.MARefArc.CPCCC.MARefArc.CP23CCC.MARefArc.CP25CCC.MARefArc.CP21
CCC.MARefArc.TH25Non-compliant outputs and model-risk-management gaps
AI-generated advice, marketing, or communications that fail KYC, suitability, disclosure, record-keeping, or model-risk-management expectations create regulatory exposure; weak supervision and accountability lines turn this into direct non-compliance.
AIR-VECAIR-RC-022-01AIR-RC-022-02AIR-RC-022-03AIR-RC-022-04
CCC.MARefArc.CPCCC.MARefArc.CP21CCC.MARefArc.CP05CCC.MARefArc.CP02
CCC.MARefArc.TH26Intellectual-property leakage and licensing violations
Outputs may replicate copyrighted training material, employees may leak trade secrets into AI tools, and improper platform licensing or terms-of-service violations create contractual and legal liability.
AIR-VECAIR-RC-023-01AIR-RC-023-02AIR-RC-023-03
CCC.MARefArc.CPCCC.MARefArc.CP01CCC.MARefArc.CP05CCC.MARefArc.CP16
Agentic Security
Tool privilege, MCP compromise, memory poisoning, and credential theft.
CCC.MARefArc.TH27Authorization bypass and tool-chain privilege escalation
Agents discover and invoke API endpoints outside their use case, chain individually authorized calls into unauthorized outcomes, circumvent segregation-of-duties workflows, or experience permission creep during operation, defeating intended authorization boundaries.
AIR-VECAIR-SEC-024-01AIR-SEC-024-02AIR-SEC-024-03AIR-SEC-024-04
CCC.MARefArc.CPCCC.MARefArc.CP19CCC.MARefArc.CP07CCC.MARefArc.CP08
CCC.MARefArc.TH28Tool selection, parameter, and sequencing manipulation
Crafted inputs cause agents to select inappropriate tools, inject malicious parameters into legitimate calls, reorder tool execution into dangerous combinations, corrupt tool-state understanding, or pass one tool's output as malicious input to the next.
AIR-VECAIR-SEC-025-01AIR-SEC-025-02AIR-SEC-025-03AIR-SEC-025-04AIR-SEC-025-05
CCC.MARefArc.CPCCC.MARefArc.CP08CCC.MARefArc.CP07CCC.MARefArc.CP19
CCC.MARefArc.TH29MCP supply-chain compromise
External MCP servers are compromised, receive poisoned updates, are sabotaged by insiders, or have their protocol and transport manipulated through man-in-the-middle or downgrade attacks, or have connections redirected via DNS and infrastructure attacks, injecting malicious data or logic into services agents consume.
AIR-VECAIR-SEC-026-01AIR-SEC-026-02AIR-SEC-026-03AIR-SEC-026-04AIR-SEC-026-05
CCC.MARefArc.CPCCC.MARefArc.CP17CCC.MARefArc.CP19CCC.MARefArc.CP08
CCC.MARefArc.TH30Agent memory and state poisoning
Injected instructions or corrupted reasoning patterns are written into agent short- or long-term memory, learned behaviours are corrupted over repeated exposure, state storage is attacked directly, and malicious instructions persist across sessions and users.
AIR-VECAIR-SEC-027-01AIR-SEC-027-02AIR-SEC-027-03AIR-SEC-027-04AIR-SEC-027-05
CCC.MARefArc.CPCCC.MARefArc.CP09CCC.MARefArc.CP07CCC.MARefArc.CP11
CCC.MARefArc.TH31Multi-agent collaboration compromise
Malicious or compromised agents inject harmful data into agent-to-agent channels, contaminate shared resources, impersonate higher-privilege agents, inherit privileges through interaction, or propagate cascade failures across dependent agents.
AIR-VECAIR-OP-028-01AIR-OP-028-02AIR-OP-028-03AIR-OP-028-04AIR-OP-028-05
CCC.MARefArc.CPCCC.MARefArc.CP06CCC.MARefArc.CP03
CCC.MARefArc.TH32Credential harvesting via agent tools and storage
Agents are manipulated into using file, database, API, and cloud-management tools to enumerate and extract credentials from configuration files, environment variables, process memory, databases, key vaults, and instance metadata, and to correlate fragments into full credentials.
AIR-VECAIR-SEC-029-01AIR-SEC-029-02AIR-SEC-029-03AIR-SEC-029-04AIR-SEC-029-05
CCC.MARefArc.CPCCC.MARefArc.CP08CCC.MARefArc.CP10CCC.MARefArc.CP07CCC.MARefArc.CP12