# Prompt/Result Coverage Matrix

This generated matrix shows coverage by Pattern x Source family x Control family.
Use it to find which sanitized prompt/result examples exercise a defensive control, source family, or reusable attack pattern.

## Summary

- Usage examples: `200`
- Mapped examples: `200`
- Unmapped examples: `0`
- Populated cells: `157`
- Patterns: `42`
- Source families: `11`
- Control families: `10`

## Source-Family Summary

| Source family | Examples | Patterns | Agentic RAG answers |
|---|---:|---:|---:|
| `application_security` | 2 | 1 | 2 |
| `benchmark` | 12 | 3 | 5 |
| `defense` | 5 | 3 | 4 |
| `governance` | 3 | 2 | 2 |
| `incident_report` | 95 | 42 | 28 |
| `memory` | 19 | 5 | 14 |
| `multi_agent` | 3 | 1 | 2 |
| `protocol` | 7 | 2 | 5 |
| `red_team` | 31 | 5 | 13 |
| `survey` | 22 | 4 | 11 |
| `tool_use` | 1 | 1 | 1 |

## Control-Family Summary

| Control family | Examples | Patterns | Agentic RAG answers |
|---|---:|---:|---:|
| `content_sanitization` | 13 | 7 | 10 |
| `human_approval` | 33 | 26 | 24 |
| `instruction_isolation` | 35 | 15 | 27 |
| `least_privilege_scope` | 4 | 4 | 4 |
| `memory_governance` | 16 | 10 | 15 |
| `monitoring_logging` | 9 | 3 | 8 |
| `output_exfiltration_control` | 16 | 18 | 13 |
| `policy_enforcement` | 43 | 20 | 28 |
| `retrieval_integrity` | 5 | 3 | 5 |
| `tool_authorization` | 26 | 14 | 20 |

## Matrix Cells

| Pattern | Source family | Control family | Count | Agentic RAG answers | Operator use cases | Examples |
|---|---|---|---:|---|---|---|
| `second-order-agent-injection` | `memory` | `memory_governance` | 7 | `adaptive-realworld-blackbox-multiagent-redteam`, `agent-security-survey-taxonomy-evidence`, `memory-rag-tool-mcp-web-exfiltration`, `monitoring-runtime-declarative-defenses`, `privilege-memory-rag-runtime-controls` | `use-adaptive-realworld-blackbox-multiagent-redteam`, `use-agent-security-survey-taxonomy-evidence`, `use-memory-rag-tool-mcp-web-exfiltration`, `use-monitoring-runtime-declarative-defenses`, `use-privilege-memory-rag-runtime-controls` | `ex-agent-backdoor-threats`, `ex-autonomous-agent-review-context`, `ex-chatgpt-memory-history-boundary`, `ex-multiagent-communication-redteam`, `ex-owasp-agent-memory-guard`, `ex-practical-memory-injection`, `ex-sequential-contextual-harm-monitoring` |
| `second-order-agent-injection` | `survey` | `policy_enforcement` | 7 | `agent-infrastructure-identity-policy`, `agent-security-benchmark-eval-corpora`, `agent-security-survey-taxonomy-evidence`, `design-ifc-prompt-flow-defenses`, `formal-mobile-adaptive-guardrails` | `use-agent-infrastructure-identity-policy`, `use-agent-security-benchmark-eval-corpora`, `use-agent-security-survey-taxonomy-evidence`, `use-design-ifc-prompt-flow-defenses`, `use-formal-mobile-adaptive-guardrails` | `ex-agent-infrastructure-control-plane`, `ex-agentic-ai-taxonomy-instruction-boundary`, `ex-cyberseceval-agent-security-suite`, `ex-fids-information-flow-control`, `ex-formal-agent-behavior-spec`, `ex-formal-security-guarantees-agent`, `ex-ras-eval-real-world-agent-security` |
| `mcp-cve-command-bypass` | `incident_report` | `tool_authorization` | 5 | `mcp-command-stored-prompt-boundaries`, `mcp-sampling-private-repo-cve-boundaries` | `use-mcp-command-stored-prompt-boundaries`, `use-mcp-sampling-private-repo-cve-boundaries` | `ex-agent-command-bypass-record`, `ex-gemini-mcp-tool-cve-boundary`, `ex-mcp-stdio-command-classification`, `ex-mcp-vulnerable-catalog-case-selection`, `ex-nginx-ui-mcp-auth-boundary` |
| `mcp-tool-description-poisoning` | `incident_report` | `tool_authorization` | 5 | `mcp-registry-toolchain-skill-marketplace`, `mcp-repository-project-context`, `mcp-sampling-private-repo-cve-boundaries`, `mcp-schema-skill-supply-chain` | `use-mcp-registry-toolchain-skill-marketplace`, `use-mcp-repository-project-context`, `use-mcp-sampling-private-repo-cve-boundaries`, `use-mcp-schema-skill-supply-chain` | `ex-gemini-mcp-tool-cve-boundary`, `ex-github-mcp-data-heist`, `ex-github-mcp-private-repo-context`, `ex-mcp-line-jumping-discovery`, `ex-mcp-vulnerable-catalog-case-selection` |
| `second-order-agent-injection` | `survey` | `monitoring_logging` | 5 | `agent-infrastructure-identity-policy`, `agent-security-survey-taxonomy-evidence`, `defense-governance-release-controls`, `privilege-memory-rag-runtime-controls` | `use-agent-infrastructure-identity-policy`, `use-agent-security-survey-taxonomy-evidence`, `use-defense-governance-release-controls`, `use-privilege-memory-rag-runtime-controls` | `ex-agent-evaluation-survey-provenance`, `ex-agent-visibility-measures`, `ex-agentspec-runtime-enforcement`, `ex-openai-agentic-governance-practices`, `ex-security-of-ai-agents-survey-controls` |
| `web-idpi-hidden-content` | `red_team` | `content_sanitization` | 5 | `adaptive-realworld-blackbox-multiagent-redteam`, `agent-security-benchmark-eval-corpora`, `detector-automatic-goal-guided-prompt-risks` | `use-adaptive-realworld-blackbox-multiagent-redteam`, `use-agent-security-benchmark-eval-corpora`, `use-detector-automatic-goal-guided-prompt-risks` | `ex-agentvigil-black-box-redteam`, `ex-automatic-universal-prompt-injection`, `ex-formalizing-prompt-injection-benchmark`, `ex-goal-guided-generative-injection`, `ex-llm-integrated-app-prompt-boundary` |
| `web-idpi-hidden-content` | `red_team` | `policy_enforcement` | 5 | `agent-security-benchmark-eval-corpora`, `defense-governance-release-controls`, `monitoring-runtime-declarative-defenses`, `web-redteam-multiagent-guardrail-benchmarks` | `use-agent-security-benchmark-eval-corpora`, `use-defense-governance-release-controls`, `use-monitoring-runtime-declarative-defenses`, `use-web-redteam-multiagent-guardrail-benchmarks` | `ex-critical-defense-evaluation`, `ex-gentel-safe-shielding-framework`, `ex-melon-provable-idpi-defense`, `ex-tensor-trust-instruction-game`, `ex-wasp-web-agent-security-benchmark` |
| `second-order-agent-injection` | `red_team` | `policy_enforcement` | 4 | `adaptive-realworld-blackbox-multiagent-redteam`, `agent-security-benchmark-eval-corpora`, `systems-sandbox-computer-use-threat-models` | `use-adaptive-realworld-blackbox-multiagent-redteam`, `use-agent-security-benchmark-eval-corpora`, `use-systems-sandbox-computer-use-threat-models` | `ex-agentdojo-dynamic-attack-defense`, `ex-agentic-systems-theory-boundary`, `ex-byzantine-embodied-agent-poisoning`, `ex-prompt-infection-agent-to-agent` |
| `second-order-agent-injection` | `survey` | `instruction_isolation` | 4 | `formal-mobile-adaptive-guardrails`, `privacy-multiagent-audit-observability` | `use-formal-mobile-adaptive-guardrails`, `use-privacy-multiagent-audit-observability` | `ex-agrail-lifelong-guardrail`, `ex-airgapagent-privacy-boundary`, `ex-formal-llm-controllable-agent`, `ex-safe-wild-agent-testing` |
| `web-idpi-hidden-content` | `incident_report` | `instruction_isolation` | 4 | `agentic-browser-phishing-summary-content`, `browser-web-rendered-content`, `mobile-url-ide-subagent-context`, `web-multimodal-idpi-prevalence` | `use-agentic-browser-phishing-summary-content`, `use-browser-web-rendered-content`, `use-mobile-url-ide-subagent-context`, `use-web-multimodal-idpi-prevalence` | `ex-antigravity-browser-subagent`, `ex-comet-webpage-summary-hijack`, `ex-multimodal-hidden-instruction-document`, `ex-web-idpi-public-page` |
| `ai-browser-phishing-delegation` | `incident_report` | `human_approval` | 3 | `agentic-browser-connected-local-services`, `agentic-browser-phishing-summary-content`, `cursor-comet-browser-agent-audit-boundaries` | `use-agentic-browser-connected-local-services`, `use-agentic-browser-phishing-summary-content`, `use-cursor-comet-browser-agent-audit-boundaries` | `ex-browser-phishing-delegation`, `ex-comet-guardio-fake-shopping`, `ex-comet-phishing-document-delegation` |
| `chatgpt-memory-persistence` | `incident_report` | `memory_governance` | 3 | `copilot-chatgpt-connector-persistence`, `email-url-connector-exfiltration-controls`, `mobile-url-ide-subagent-context` | `use-copilot-chatgpt-connector-persistence`, `use-email-url-connector-exfiltration-controls`, `use-mobile-url-ide-subagent-context` | `ex-gemini-notification-memory-poisoning`, `ex-zombieagent-memory-persistence`, `ex-zombieagent-propagation-connected-content` |
| `ci-agent-overpermission` | `incident_report` | `instruction_isolation` | 3 | `ci-cd-agent-permission-boundaries`, `ci-coding-agent-issue-metadata`, `github-ci-codespaces-agent-control` | `use-ci-cd-agent-permission-boundaries`, `use-ci-coding-agent-issue-metadata`, `use-github-ci-codespaces-agent-control` | `ex-gemini-cli-action-comment-control`, `ex-github-issue-title-ci-agent`, `ex-promptpwnd-ci-metadata` |
| `ci-agent-overpermission` | `incident_report` | `output_exfiltration_control` | 3 | `ci-cd-agent-permission-boundaries`, `ci-coding-agent-issue-metadata`, `github-ci-codespaces-agent-control` | `use-ci-cd-agent-permission-boundaries`, `use-ci-coding-agent-issue-metadata`, `use-github-ci-codespaces-agent-control` | `ex-claude-code-action-secrets-exposure`, `ex-copilot-agent-comment-control`, `ex-github-comment-review-agent` |
| `copilot-studio-email-agent` | `incident_report` | `human_approval` | 3 | `email-triggered-enterprise-agents`, `enterprise-agent-service-tool-boundaries`, `enterprise-cross-document-workspace-boundaries` | `use-email-triggered-enterprise-agents`, `use-enterprise-agent-service-tool-boundaries`, `use-enterprise-cross-document-workspace-boundaries` | `ex-agentflayer-copilot-studio-platform`, `ex-copilot-studio-email-agent`, `ex-salesforce-einstein-enterprise-boundary` |
| `email-summary-injection` | `incident_report` | `policy_enforcement` | 3 | `connected-enterprise-assistant-content`, `email-url-connector-exfiltration-controls`, `mail-collaboration-private-context` | `use-connected-enterprise-assistant-content`, `use-email-url-connector-exfiltration-controls`, `use-mail-collaboration-private-context` | `ex-copilot-email-summary-autophish`, `ex-email-summary-phishing`, `ex-proofpoint-email-assistant-idpi` |
| `github-comments-control-plane` | `incident_report` | `output_exfiltration_control` | 3 | `ci-cd-agent-permission-boundaries`, `ci-coding-agent-issue-metadata`, `github-ci-codespaces-agent-control` | `use-ci-cd-agent-permission-boundaries`, `use-ci-coding-agent-issue-metadata`, `use-github-ci-codespaces-agent-control` | `ex-claude-code-action-secrets-exposure`, `ex-copilot-agent-comment-control`, `ex-github-comment-review-agent` |
| `mcp-tool-description-poisoning` | `protocol` | `instruction_isolation` | 3 | `agent-infrastructure-identity-policy`, `protocol-tool-threat-model-boundaries` | `use-agent-infrastructure-identity-policy`, `use-protocol-tool-threat-model-boundaries` | `ex-agent-interoperability-protocol-metadata`, `ex-agent-network-protocol-identity`, `ex-mcp-landscape-security-threats` |
| `salesforce-agentforce-exfiltration` | `incident_report` | `human_approval` | 3 | `crm-calendar-record-content`, `enterprise-agent-service-tool-boundaries`, `enterprise-cross-document-workspace-boundaries` | `use-crm-calendar-record-content`, `use-enterprise-agent-service-tool-boundaries`, `use-enterprise-cross-document-workspace-boundaries` | `ex-agentforce-crm-indirect-prompt`, `ex-forcedleak-agentforce-crm-record`, `ex-forcedleak-agentforce-tool-chain` |
| `second-order-agent-injection` | `memory` | `retrieval_integrity` | 3 | `memory-rag-tool-mcp-web-exfiltration`, `privilege-memory-rag-runtime-controls`, `web-memory-redteam-delayed-context` | `use-memory-rag-tool-mcp-web-exfiltration`, `use-privilege-memory-rag-runtime-controls`, `use-web-memory-redteam-delayed-context` | `ex-agentpoison-memory-knowledge-base`, `ex-controlnet-rag-firewall`, `ex-poisonedrag-knowledge-corruption` |
| `second-order-agent-injection` | `red_team` | `content_sanitization` | 3 | `agent-security-survey-taxonomy-evidence`, `web-memory-redteam-delayed-context`, `web-redteam-multiagent-guardrail-benchmarks` | `use-agent-security-survey-taxonomy-evidence`, `use-web-memory-redteam-delayed-context`, `use-web-redteam-multiagent-guardrail-benchmarks` | `ex-agent-security-bench-formalized-attacks`, `ex-ai-agents-under-threat-risk-map`, `ex-udora-reasoning-hijack` |
| `second-order-agent-injection` | `survey` | `tool_authorization` | 3 | `agent-benchmark-tool-email-boundaries`, `privilege-memory-rag-runtime-controls`, `protocol-tool-threat-model-boundaries` | `use-agent-benchmark-tool-email-boundaries`, `use-privilege-memory-rag-runtime-controls`, `use-protocol-tool-threat-model-boundaries` | `ex-agentbench-general-agent-eval`, `ex-agentic-ai-threat-model-framework`, `ex-progent-programmable-privilege-control` |
| `skill-manifest-prompt-injection` | `incident_report` | `policy_enforcement` | 3 | `agent-skill-provenance-runtime-review`, `mcp-schema-skill-supply-chain`, `mcp-tool-metadata-poisoning` | `use-agent-skill-provenance-runtime-review`, `use-mcp-schema-skill-supply-chain`, `use-mcp-tool-metadata-poisoning` | `ex-delayed-skill-update-weaponization`, `ex-malicious-skill-dynamic-context`, `ex-toxic-skills-supply-chain` |
| `skill-runtime-fetch` | `incident_report` | `policy_enforcement` | 3 | `mcp-registry-toolchain-skill-marketplace`, `mcp-schema-skill-supply-chain`, `mcp-tool-metadata-poisoning` | `use-mcp-schema-skill-supply-chain`, `use-mcp-tool-metadata-poisoning` | `ex-clawhavoc-coordinated-skill-campaign`, `ex-malicious-skill-dynamic-context`, `ex-toxic-skills-supply-chain` |
| `trusted-image-proxy-exfil` | `incident_report` | `output_exfiltration_control` | 3 | `browser-web-rendered-content`, `claude-google-prompt-loading-output-boundaries`, `enterprise-cross-document-workspace-boundaries` | `use-browser-web-rendered-content`, `use-claude-google-prompt-loading-output-boundaries`, `use-enterprise-cross-document-workspace-boundaries` | `ex-google-ai-studio-data-exfiltration`, `ex-hidden-pr-markdown-image-channel`, `ex-slack-ai-link-rendering-side-channel` |
| `web-idpi-hidden-content` | `benchmark` | `instruction_isolation` | 3 | `web-agent-benchmark-browser-boundaries`, `web-memory-redteam-delayed-context` | `use-web-agent-benchmark-browser-boundaries`, `use-web-memory-redteam-delayed-context` | `ex-visualwebarena-visual-text-boundary`, `ex-web-agent-illusion-progress`, `ex-webarena-web-agent-task-context` |
| `web-idpi-hidden-content` | `incident_report` | `human_approval` | 3 | `agentic-browser-connected-local-services`, `agentic-browser-phishing-summary-content`, `web-multimodal-idpi-prevalence` | `use-agentic-browser-connected-local-services`, `use-agentic-browser-phishing-summary-content`, `use-web-multimodal-idpi-prevalence` | `ex-brave-local-agent-tab-context`, `ex-browser-phishing-delegation`, `ex-comet-phishing-document-delegation` |
| `web-idpi-hidden-content` | `red_team` | `monitoring_logging` | 3 | `adaptive-realworld-blackbox-multiagent-redteam`, `detector-automatic-goal-guided-prompt-risks`, `web-redteam-multiagent-guardrail-benchmarks` | `use-adaptive-realworld-blackbox-multiagent-redteam`, `use-detector-automatic-goal-guided-prompt-risks`, `use-web-redteam-multiagent-guardrail-benchmarks` | `ex-adaptive-idpi-defense-breaks`, `ex-llm-detector-failure-mode`, `ex-redteamcua-hybrid-web-os` |
| `zero-click-email-exfiltration` | `incident_report` | `instruction_isolation` | 3 | `copilot-chatgpt-connector-persistence`, `enterprise-search-agent-to-agent-exfiltration`, `mail-collaboration-private-context` | `use-copilot-chatgpt-connector-persistence`, `use-enterprise-search-agent-to-agent-exfiltration`, `use-mail-collaboration-private-context` | `ex-agentflayer-chatgpt-drive-connector`, `ex-chatgpt-email-zero-click`, `ex-shadowleak-deep-research-mailbox` |
| `agentic-browser-cometjacking` | `incident_report` | `instruction_isolation` | 2 | `agentic-browser-connected-local-services`, `agentic-browser-phishing-summary-content` | `use-agentic-browser-connected-local-services`, `use-agentic-browser-phishing-summary-content` | `ex-comet-webpage-summary-hijack`, `ex-cometjacking-calendar-connected-service` |
| `agentic-browser-local-file-exfiltration` | `incident_report` | `policy_enforcement` | 2 | `agentic-browser-connected-local-services`, `web-agent-benchmark-browser-boundaries` | `use-agentic-browser-connected-local-services`, `use-web-agent-benchmark-browser-boundaries` | `ex-agentic-browser-audit-cluster`, `ex-pleasefix-comet-local-file` |
| `ai-ide-browser-subagent` | `benchmark` | `human_approval` | 2 | `agent-benchmark-tool-email-boundaries`, `computer-use-mobile-os-boundaries` | `use-agent-benchmark-tool-email-boundaries`, `use-computer-use-mobile-os-boundaries` | `ex-androidworld-mobile-app-context`, `ex-mobilesafetybench-device-control` |
| `ai-ide-browser-subagent` | `benchmark` | `policy_enforcement` | 2 | `computer-use-mobile-os-boundaries` | `use-computer-use-mobile-os-boundaries` | `ex-os-harm-computer-use-safety`, `ex-riosworld-risk-computer-use` |
| `ai-ide-browser-subagent` | `incident_report` | `instruction_isolation` | 2 | `cursor-comet-browser-agent-audit-boundaries`, `mobile-url-ide-subagent-context` | `use-cursor-comet-browser-agent-audit-boundaries`, `use-mobile-url-ide-subagent-context` | `ex-agentflayer-cursor-enterprise-agent`, `ex-antigravity-browser-subagent` |
| `ai-ide-browser-subagent` | `memory` | `memory_governance` | 2 | `agent-benchmark-tool-email-boundaries`, `systems-sandbox-computer-use-threat-models` | `use-agent-benchmark-tool-email-boundaries`, `use-systems-sandbox-computer-use-threat-models` | `ex-aios-agent-os-policy-boundary`, `ex-cua-storm-threat-mapping` |
| `claude-url-prefill-injection` | `incident_report` | `human_approval` | 2 | `claude-google-prompt-loading-output-boundaries`, `mobile-url-ide-subagent-context` | `use-claude-google-prompt-loading-output-boundaries`, `use-mobile-url-ide-subagent-context` | `ex-claudy-day-files-context`, `ex-claudy-day-url-prefill` |
| `connector-poisoned-document` | `incident_report` | `human_approval` | 2 | `copilot-chatgpt-connector-persistence`, `enterprise-cross-document-workspace-boundaries` | `use-copilot-chatgpt-connector-persistence`, `use-enterprise-cross-document-workspace-boundaries` | `ex-forcedleak-agentforce-crm-record`, `ex-straiker-drive-email-trigger` |
| `cross-document-exfiltration` | `incident_report` | `human_approval` | 2 | `agentic-browser-connected-local-services`, `enterprise-cross-document-workspace-boundaries` | `use-agentic-browser-connected-local-services`, `use-enterprise-cross-document-workspace-boundaries` | `ex-cometjacking-gmail-connected-service`, `ex-salesforce-einstein-enterprise-boundary` |
| `cross-document-exfiltration` | `incident_report` | `least_privilege_scope` | 2 | `enterprise-cross-document-workspace-boundaries`, `mail-collaboration-private-context` | `use-enterprise-cross-document-workspace-boundaries`, `use-mail-collaboration-private-context` | `ex-notebooklm-cross-document-boundary`, `ex-slack-ai-private-channel` |
| `cross-document-exfiltration` | `incident_report` | `output_exfiltration_control` | 2 | `enterprise-agent-service-tool-boundaries`, `enterprise-search-agent-to-agent-exfiltration` | `use-enterprise-agent-service-tool-boundaries`, `use-enterprise-search-agent-to-agent-exfiltration` | `ex-notion-agent-web-search-exfiltration`, `ex-servicenow-agent-discovery-data-exfiltration` |
| `github-comments-control-plane` | `incident_report` | `instruction_isolation` | 2 | `ci-cd-agent-permission-boundaries`, `github-ci-codespaces-agent-control` | `use-ci-cd-agent-permission-boundaries`, `use-github-ci-codespaces-agent-control` | `ex-gemini-cli-action-comment-control`, `ex-promptpwnd-ci-metadata` |
| `hidden-markdown-pr-injection` | `incident_report` | `output_exfiltration_control` | 2 | `browser-web-rendered-content`, `mcp-repository-project-context` | `use-browser-web-rendered-content`, `use-mcp-repository-project-context` | `ex-claude-code-project-config`, `ex-hidden-pr-markdown-image-channel` |
| `mcp-credential-exfiltration` | `incident_report` | `output_exfiltration_control` | 2 | `mcp-repository-project-context`, `privilege-memory-rag-runtime-controls` | `use-mcp-repository-project-context`, `use-privilege-memory-rag-runtime-controls` | `ex-amp-agent-credential-boundary`, `ex-claude-code-project-config` |
| `mcp-credential-exfiltration` | `incident_report` | `tool_authorization` | 2 | `mcp-registry-toolchain-skill-marketplace`, `mcp-repository-project-context` | `use-mcp-registry-toolchain-skill-marketplace`, `use-mcp-repository-project-context` | `ex-github-mcp-data-heist`, `ex-github-mcp-private-repo-context` |
| `mcp-stdio-command-execution` | `incident_report` | `human_approval` | 2 | `mcp-command-stored-prompt-boundaries`, `mcp-registry-toolchain-skill-marketplace` | `use-mcp-command-stored-prompt-boundaries`, `use-mcp-registry-toolchain-skill-marketplace` | `ex-mcp-prompt-hijacking-cve`, `ex-mcp-remote-untrusted-server` |
| `mcp-tool-description-poisoning` | `incident_report` | `human_approval` | 2 | `mcp-registry-toolchain-skill-marketplace`, `mcp-sampling-private-repo-cve-boundaries` | `use-mcp-registry-toolchain-skill-marketplace`, `use-mcp-sampling-private-repo-cve-boundaries` | `ex-github-mcp-private-repo-leak-risk`, `ex-mcp-prompt-hijacking-cve` |
| `mcp-tool-description-poisoning` | `protocol` | `tool_authorization` | 2 | `mcp-tool-metadata-poisoning`, `protocol-tool-threat-model-boundaries` | `use-mcp-tool-metadata-poisoning`, `use-protocol-tool-threat-model-boundaries` | `ex-mcp-tool-description-poisoning`, `ex-protocol-exploits-agent-workflow` |
| `notification-prompt-injection` | `incident_report` | `human_approval` | 2 | `mobile-url-ide-subagent-context` | `use-mobile-url-ide-subagent-context` | `ex-gemini-notification-hijack`, `ex-gemini-notification-smart-home-action` |
| `second-order-agent-injection` | `incident_report` | `instruction_isolation` | 2 | `enterprise-agent-service-tool-boundaries`, `mcp-command-stored-prompt-boundaries` | `use-enterprise-agent-service-tool-boundaries`, `use-mcp-command-stored-prompt-boundaries` | `ex-servicenow-second-order-a2a`, `ex-sqlite-mcp-stored-prompt` |
| `second-order-agent-injection` | `multi_agent` | `policy_enforcement` | 2 | `privacy-multiagent-audit-observability` | `use-privacy-multiagent-audit-observability` | `ex-guardian-multi-agent-temporal`, `ex-sentinelagent-graph-anomaly` |
| `skill-manifest-prompt-injection` | `incident_report` | `human_approval` | 2 | `agent-skill-provenance-runtime-review` | `use-agent-skill-provenance-runtime-review` | `ex-anthropic-namespace-skill-provenance`, `ex-skillspector-package-risk-triage` |
| `web-idpi-hidden-content` | `benchmark` | `policy_enforcement` | 2 | `agent-benchmark-tool-email-boundaries`, `web-agent-benchmark-browser-boundaries` | `use-agent-benchmark-tool-email-boundaries`, `use-web-agent-benchmark-browser-boundaries` | `ex-llmail-inject-email-dataset`, `ex-webvoyager-end-to-end-web-navigation` |
| `web-idpi-hidden-content` | `defense` | `policy_enforcement` | 2 | `defense-governance-release-controls`, `monitoring-runtime-declarative-defenses` | `use-defense-governance-release-controls`, `use-monitoring-runtime-declarative-defenses` | `ex-gemini-indirect-prompt-defense-lessons`, `ex-rtbas-prompt-privacy-defense` |
| `web-idpi-hidden-content` | `incident_report` | `content_sanitization` | 2 | `cursor-comet-browser-agent-audit-boundaries`, `web-multimodal-idpi-prevalence` | `use-cursor-comet-browser-agent-audit-boundaries`, `use-web-multimodal-idpi-prevalence` | `ex-comet-trailofbits-technique-cluster`, `ex-web-idpi-ad-review-content` |
| `web-idpi-hidden-content` | `red_team` | `human_approval` | 2 | `adaptive-realworld-blackbox-multiagent-redteam`, `sequential-visual-operator-memory-controls` | `use-adaptive-realworld-blackbox-multiagent-redteam`, `use-sequential-visual-operator-memory-controls` | `ex-chatgpt-operator-defense`, `ex-real-world-llm-app-compromise` |
| `zero-click-email-exfiltration` | `incident_report` | `human_approval` | 2 | `copilot-chatgpt-connector-persistence`, `email-triggered-enterprise-agents` | `use-copilot-chatgpt-connector-persistence`, `use-email-triggered-enterprise-agents` | `ex-copilot-studio-email-agent`, `ex-straiker-drive-email-trigger` |
| `agent-web-search-exfiltration` | `incident_report` | `output_exfiltration_control` | 1 | `enterprise-search-agent-to-agent-exfiltration` | `use-enterprise-search-agent-to-agent-exfiltration` | `ex-notion-agent-web-search-exfiltration` |
| `agentic-browser-cometjacking` | `incident_report` | `content_sanitization` | 1 | `cursor-comet-browser-agent-audit-boundaries` | `use-cursor-comet-browser-agent-audit-boundaries` | `ex-comet-trailofbits-technique-cluster` |
| `agentic-browser-cometjacking` | `incident_report` | `human_approval` | 1 | `agentic-browser-connected-local-services` | `use-agentic-browser-connected-local-services` | `ex-cometjacking-gmail-connected-service` |
| `agentic-browser-cometjacking` | `incident_report` | `memory_governance` | 1 | `cursor-comet-browser-agent-audit-boundaries` | `use-cursor-comet-browser-agent-audit-boundaries` | `ex-cometjacking-connected-services-memory` |
| `agentic-browser-cometjacking` | `incident_report` | `policy_enforcement` | 1 | `web-agent-benchmark-browser-boundaries` | `use-web-agent-benchmark-browser-boundaries` | `ex-agentic-browser-audit-cluster` |
| `agentic-browser-local-file-exfiltration` | `incident_report` | `human_approval` | 1 | `agentic-browser-connected-local-services` | `use-agentic-browser-connected-local-services` | `ex-pleasefix-comet-password-manager` |
| `ai-browser-phishing-delegation` | `incident_report` | `policy_enforcement` | 1 | `web-agent-benchmark-browser-boundaries` | `use-web-agent-benchmark-browser-boundaries` | `ex-agentic-browser-audit-cluster` |
| `ai-ide-browser-subagent` | `benchmark` | `instruction_isolation` | 1 | `formal-mobile-adaptive-guardrails` | `use-formal-mobile-adaptive-guardrails` | `ex-mobile-gui-action-verification` |
| `ai-ide-browser-subagent` | `benchmark` | `monitoring_logging` | 1 | `computer-use-mobile-os-boundaries` | `use-computer-use-mobile-os-boundaries` | `ex-windows-agent-arena-os-observation` |
| `ai-ide-browser-subagent` | `governance` | `policy_enforcement` | 1 | `agent-infrastructure-identity-policy` | `use-agent-infrastructure-identity-policy` | `ex-contextual-agent-security-policy` |
| `ai-ide-browser-subagent` | `governance` | `tool_authorization` | 1 | `agent-infrastructure-identity-policy` | `use-agent-infrastructure-identity-policy` | `ex-composio-agent-identity` |
| `ai-ide-browser-subagent` | `incident_report` | `human_approval` | 1 | `mcp-command-stored-prompt-boundaries` | `use-mcp-command-stored-prompt-boundaries` | `ex-claude-code-hook-startup-rce` |
| `ai-ide-browser-subagent` | `incident_report` | `tool_authorization` | 1 | `cursor-comet-browser-agent-audit-boundaries` | `use-cursor-comet-browser-agent-audit-boundaries` | `ex-claude-code-inverseprompt-pr-context` |
| `ai-ide-browser-subagent` | `memory` | `least_privilege_scope` | 1 | `computer-use-mobile-os-boundaries` | `use-computer-use-mobile-os-boundaries` | `ex-osworld-open-ended-computer-use` |
| `ai-ide-browser-subagent` | `red_team` | `content_sanitization` | 1 | `detector-automatic-goal-guided-prompt-risks` | `use-detector-automatic-goal-guided-prompt-risks` | `ex-hackaprompt-competition-systemic-risk` |
| `calendar-invite-injection` | `incident_report` | `human_approval` | 1 | `mobile-url-ide-subagent-context` | `use-mobile-url-ide-subagent-context` | `ex-gemini-notification-smart-home-action` |
| `calendar-invite-injection` | `incident_report` | `policy_enforcement` | 1 | `crm-calendar-record-content` | `use-crm-calendar-record-content` | `ex-calendar-invite-workspace-agent` |
| `calendar-invite-injection` | `red_team` | `human_approval` | 1 | `email-url-connector-exfiltration-controls` | `use-email-url-connector-exfiltration-controls` | `ex-gemini-promptware-calendar-invitation` |
| `ci-agent-overpermission` | `incident_report` | `human_approval` | 1 | `ci-cd-agent-permission-boundaries` | `use-ci-cd-agent-permission-boundaries` | `ex-claude-code-action-permission-bypass` |
| `claude-url-prefill-injection` | `incident_report` | `content_sanitization` | 1 | `claude-google-prompt-loading-output-boundaries` | `use-claude-google-prompt-loading-output-boundaries` | `ex-claudy-day-open-redirect-delivery` |
| `connector-poisoned-document` | `incident_report` | `instruction_isolation` | 1 | `copilot-chatgpt-connector-persistence` | `use-copilot-chatgpt-connector-persistence` | `ex-agentflayer-chatgpt-drive-connector` |
| `connector-poisoned-document` | `incident_report` | `memory_governance` | 1 | `email-url-connector-exfiltration-controls` | `use-email-url-connector-exfiltration-controls` | `ex-zombieagent-propagation-connected-content` |
| `connector-poisoned-document` | `incident_report` | `output_exfiltration_control` | 1 | `claude-google-prompt-loading-output-boundaries` | `use-claude-google-prompt-loading-output-boundaries` | `ex-claude-cowork-file-exfiltration` |
| `connector-poisoned-document` | `incident_report` | `policy_enforcement` | 1 | `enterprise-cross-document-workspace-boundaries` | `use-enterprise-cross-document-workspace-boundaries` | `ex-google-suite-cross-document-retrieval` |
| `connector-poisoned-document` | `incident_report` | `retrieval_integrity` | 1 | `connected-enterprise-assistant-content` | `use-connected-enterprise-assistant-content` | `ex-poisoned-document-connector` |
| `connector-poisoned-document` | `protocol` | `tool_authorization` | 1 | `claude-google-prompt-loading-output-boundaries` | `use-claude-google-prompt-loading-output-boundaries` | `ex-langchain-load-prompt-traversal` |
| `copilot-studio-email-agent` | `incident_report` | `output_exfiltration_control` | 1 | `email-url-connector-exfiltration-controls` | `use-email-url-connector-exfiltration-controls` | `ex-copilot-studio-aijacking-exfiltration` |
| `cross-document-exfiltration` | `incident_report` | `memory_governance` | 1 | `cursor-comet-browser-agent-audit-boundaries` | `use-cursor-comet-browser-agent-audit-boundaries` | `ex-cometjacking-connected-services-memory` |
| `cross-document-exfiltration` | `incident_report` | `policy_enforcement` | 1 | `enterprise-cross-document-workspace-boundaries` | `use-enterprise-cross-document-workspace-boundaries` | `ex-google-suite-cross-document-retrieval` |
| `delayed-skill-weaponization` | `incident_report` | `policy_enforcement` | 1 | `agent-skill-provenance-runtime-review` | `use-agent-skill-provenance-runtime-review` | `ex-delayed-skill-update-weaponization` |
| `email-summary-injection` | `incident_report` | `instruction_isolation` | 1 | `mail-collaboration-private-context` | `use-mail-collaboration-private-context` | `ex-chatgpt-email-zero-click` |
| `email-summary-injection` | `incident_report` | `output_exfiltration_control` | 1 | `email-url-connector-exfiltration-controls` | `use-email-url-connector-exfiltration-controls` | `ex-copilot-studio-aijacking-exfiltration` |
| `email-summary-injection` | `memory` | `instruction_isolation` | 1 | `connected-enterprise-assistant-content` | `use-connected-enterprise-assistant-content` | `ex-enterprise-copilot-zero-click-email` |
| `enterprise-search-exfiltration` | `incident_report` | `human_approval` | 1 | `copilot-chatgpt-connector-persistence` | `use-copilot-chatgpt-connector-persistence` | `ex-copilot-cowork-file-action` |
| `enterprise-search-exfiltration` | `incident_report` | `output_exfiltration_control` | 1 | `enterprise-search-agent-to-agent-exfiltration` | `use-enterprise-search-agent-to-agent-exfiltration` | `ex-m365-copilot-searchleak` |
| `enterprise-search-exfiltration` | `incident_report` | `policy_enforcement` | 1 | `copilot-chatgpt-connector-persistence` | `use-copilot-chatgpt-connector-persistence` | `ex-copilot-reprompt-query-link` |
| `github-comments-control-plane` | `incident_report` | `human_approval` | 1 | `ci-cd-agent-permission-boundaries` | `use-ci-cd-agent-permission-boundaries` | `ex-claude-code-action-permission-bypass` |
| `github-comments-control-plane` | `incident_report` | `tool_authorization` | 1 | `agent-skill-provenance-runtime-review` | `use-agent-skill-provenance-runtime-review` | `ex-comment-control-multi-agent-ci` |
| `github-issue-title-injection` | `incident_report` | `instruction_isolation` | 1 | `ci-coding-agent-issue-metadata` | `use-ci-coding-agent-issue-metadata` | `ex-github-issue-title-ci-agent` |
| `hidden-markdown-pr-injection` | `incident_report` | `instruction_isolation` | 1 | `cursor-comet-browser-agent-audit-boundaries` | `use-cursor-comet-browser-agent-audit-boundaries` | `ex-agentflayer-cursor-enterprise-agent` |
| `hidden-markdown-pr-injection` | `incident_report` | `tool_authorization` | 1 | `cursor-comet-browser-agent-audit-boundaries` | `use-cursor-comet-browser-agent-audit-boundaries` | `ex-claude-code-inverseprompt-pr-context` |
| `mcp-credential-exfiltration` | `incident_report` | `memory_governance` | 1 | `mcp-registry-toolchain-skill-marketplace` | `use-mcp-registry-toolchain-skill-marketplace` | `ex-git-mcp-filesystem-chain` |
| `mcp-cve-command-bypass` | `incident_report` | `human_approval` | 1 | `mcp-command-stored-prompt-boundaries` | `use-mcp-command-stored-prompt-boundaries` | `ex-claude-code-hook-startup-rce` |
| `mcp-full-schema-poisoning` | `incident_report` | `tool_authorization` | 1 | `mcp-schema-skill-supply-chain` | `use-mcp-schema-skill-supply-chain` | `ex-mcp-full-schema-poisoning` |
| `mcp-line-jumping` | `incident_report` | `tool_authorization` | 1 | `mcp-schema-skill-supply-chain` | `use-mcp-schema-skill-supply-chain` | `ex-mcp-line-jumping-discovery` |
| `mcp-sampling-reverse-prompt` | `incident_report` | `policy_enforcement` | 1 | `mcp-sampling-private-repo-cve-boundaries` | `use-mcp-sampling-private-repo-cve-boundaries` | `ex-mcp-sampling-reverse-prompt` |
| `mcp-stdio-command-execution` | `incident_report` | `memory_governance` | 1 | `mcp-registry-toolchain-skill-marketplace` | `use-mcp-registry-toolchain-skill-marketplace` | `ex-git-mcp-filesystem-chain` |
| `mcp-stdio-command-execution` | `incident_report` | `policy_enforcement` | 1 | `mcp-registry-toolchain-skill-marketplace` | `use-mcp-registry-toolchain-skill-marketplace` | `ex-mcp-registry-poisoning-ide-chain` |
| `mcp-stdio-command-execution` | `incident_report` | `tool_authorization` | 1 | `mcp-command-stored-prompt-boundaries` | `use-mcp-command-stored-prompt-boundaries` | `ex-mcp-stdio-command-classification` |
| `mcp-stored-prompt-injection` | `incident_report` | `instruction_isolation` | 1 | `mcp-command-stored-prompt-boundaries` | `use-mcp-command-stored-prompt-boundaries` | `ex-sqlite-mcp-stored-prompt` |
| `mcp-tool-description-poisoning` | `benchmark` | `instruction_isolation` | 1 | `agent-benchmark-tool-email-boundaries` | `use-agent-benchmark-tool-email-boundaries` | `ex-injecagent-tool-integrated-idpi` |
| `mcp-tool-description-poisoning` | `incident_report` | `policy_enforcement` | 1 | `mcp-registry-toolchain-skill-marketplace` | `use-mcp-registry-toolchain-skill-marketplace` | `ex-mcp-registry-poisoning-ide-chain` |
| `mcp-tool-description-poisoning` | `protocol` | `human_approval` | 1 | `memory-rag-tool-mcp-web-exfiltration` | `use-memory-rag-tool-mcp-web-exfiltration` | `ex-curxecute-cursor-mcp-autostart` |
| `mcp-tool-description-poisoning` | `red_team` | `instruction_isolation` | 1 | `sequential-visual-operator-memory-controls` | `use-sequential-visual-operator-memory-controls` | `ex-visual-tool-misuse` |
| `mcp-tool-description-poisoning` | `red_team` | `tool_authorization` | 1 | `memory-rag-tool-mcp-web-exfiltration` | `use-memory-rag-tool-mcp-web-exfiltration` | `ex-tool-selection-prompt-injection` |
| `mcp-tool-description-poisoning` | `tool_use` | `instruction_isolation` | 1 | `protocol-tool-threat-model-boundaries` | `use-protocol-tool-threat-model-boundaries` | `ex-imprompter-improper-tool-use` |
| `multimodal-hidden-instruction` | `incident_report` | `instruction_isolation` | 1 | `web-multimodal-idpi-prevalence` | `use-web-multimodal-idpi-prevalence` | `ex-multimodal-hidden-instruction-document` |
| `notification-prompt-injection` | `incident_report` | `memory_governance` | 1 | `mobile-url-ide-subagent-context` | `use-mobile-url-ide-subagent-context` | `ex-gemini-notification-memory-poisoning` |
| `passive-codespaces-context-poisoning` | `incident_report` | `human_approval` | 1 | `github-ci-codespaces-agent-control` | `use-github-ci-codespaces-agent-control` | `ex-roguepilot-codespaces-passive-context` |
| `second-order-agent-injection` | `memory` | `instruction_isolation` | 1 | `web-memory-redteam-delayed-context` | `use-web-memory-redteam-delayed-context` | `ex-workarena-knowledge-work-agent` |
| `second-order-agent-injection` | `memory` | `policy_enforcement` | 1 | `sequential-visual-operator-memory-controls` | `use-sequential-visual-operator-memory-controls` | `ex-sifo-sequential-instruction-following` |
| `second-order-agent-injection` | `memory` | `tool_authorization` | 1 | `web-redteam-multiagent-guardrail-benchmarks` | `use-web-redteam-multiagent-guardrail-benchmarks` | `ex-guardagent-knowledge-enabled-guardrail` |
| `second-order-agent-injection` | `multi_agent` | `instruction_isolation` | 1 | `web-redteam-multiagent-guardrail-benchmarks` | `use-web-redteam-multiagent-guardrail-benchmarks` | `ex-prompt-infection-multi-agent-propagation` |
| `second-order-agent-injection` | `red_team` | `instruction_isolation` | 1 | `systems-sandbox-computer-use-threat-models` | `use-systems-sandbox-computer-use-threat-models` | `ex-lm-emulated-sandbox-risk` |
| `second-order-agent-injection` | `red_team` | `memory_governance` | 1 | `systems-sandbox-computer-use-threat-models` | `use-systems-sandbox-computer-use-threat-models` | `ex-language-agent-attack-map` |
| `second-order-agent-injection` | `red_team` | `tool_authorization` | 1 | `sequential-visual-operator-memory-controls` | `use-sequential-visual-operator-memory-controls` | `ex-evil-geniuses-agent-safety` |
| `second-order-agent-injection` | `survey` | `human_approval` | 1 | `privacy-multiagent-audit-observability` | `use-privacy-multiagent-audit-observability` | `ex-agentauditor-human-level-eval` |
| `servicenow-agent-discovery-injection` | `incident_report` | `output_exfiltration_control` | 1 | `enterprise-agent-service-tool-boundaries` | `use-enterprise-agent-service-tool-boundaries` | `ex-servicenow-agent-discovery-data-exfiltration` |
| `servicenow-agent-discovery-injection` | `incident_report` | `policy_enforcement` | 1 | `enterprise-search-agent-to-agent-exfiltration` | `use-enterprise-search-agent-to-agent-exfiltration` | `ex-servicenow-agent-discovery-privilege` |
| `servicenow-agent-discovery-injection` | `incident_report` | `tool_authorization` | 1 | `enterprise-agent-service-tool-boundaries` | `use-enterprise-agent-service-tool-boundaries` | `ex-servicenow-agent-discovery-action-chain` |
| `skill-manifest-prompt-injection` | `incident_report` | `content_sanitization` | 1 | `mcp-registry-toolchain-skill-marketplace` | `use-mcp-registry-toolchain-skill-marketplace` | `ex-openclaw-marketplace-malicious-skill` |
| `skill-manifest-prompt-injection` | `incident_report` | `output_exfiltration_control` | 1 | `agent-skill-provenance-runtime-review` | `use-agent-skill-provenance-runtime-review` | `ex-skill-codebase-exfiltration-review` |
| `skill-manifest-prompt-injection` | `survey` | `policy_enforcement` | 1 | `mcp-registry-toolchain-skill-marketplace` |  | `ex-openclaw-skill-teardown-hidden-behavior` |
| `skill-marketplace-malware` | `incident_report` | `content_sanitization` | 1 | `mcp-registry-toolchain-skill-marketplace` | `use-mcp-registry-toolchain-skill-marketplace` | `ex-openclaw-marketplace-malicious-skill` |
| `skill-marketplace-malware` | `incident_report` | `policy_enforcement` | 1 | `mcp-registry-toolchain-skill-marketplace` |  | `ex-clawhavoc-coordinated-skill-campaign` |
| `skill-marketplace-malware` | `survey` | `policy_enforcement` | 1 | `mcp-registry-toolchain-skill-marketplace` |  | `ex-openclaw-skill-teardown-hidden-behavior` |
| `skill-namespace-squatting` | `incident_report` | `human_approval` | 1 | `agent-skill-provenance-runtime-review` | `use-agent-skill-provenance-runtime-review` | `ex-anthropic-namespace-skill-provenance` |
| `skill-runtime-fetch` | `incident_report` | `human_approval` | 1 | `agent-skill-provenance-runtime-review` | `use-agent-skill-provenance-runtime-review` | `ex-skillspector-package-risk-triage` |
| `skill-runtime-fetch` | `incident_report` | `output_exfiltration_control` | 1 | `agent-skill-provenance-runtime-review` | `use-agent-skill-provenance-runtime-review` | `ex-skill-codebase-exfiltration-review` |
| `slack-ai-private-channel-exfiltration` | `incident_report` | `least_privilege_scope` | 1 | `mail-collaboration-private-context` | `use-mail-collaboration-private-context` | `ex-slack-ai-private-channel` |
| `slack-ai-private-channel-exfiltration` | `incident_report` | `output_exfiltration_control` | 1 | `enterprise-cross-document-workspace-boundaries` | `use-enterprise-cross-document-workspace-boundaries` | `ex-slack-ai-link-rendering-side-channel` |
| `trusted-image-proxy-exfil` | `defense` | `output_exfiltration_control` | 1 | `email-url-connector-exfiltration-controls` | `use-email-url-connector-exfiltration-controls` | `ex-openai-agent-url-exfil-mitigation` |
| `url-query-prompt-injection` | `incident_report` | `human_approval` | 1 | `mobile-url-ide-subagent-context` | `use-mobile-url-ide-subagent-context` | `ex-claudy-day-url-prefill` |
| `url-query-prompt-injection` | `incident_report` | `output_exfiltration_control` | 1 | `claude-google-prompt-loading-output-boundaries` | `use-claude-google-prompt-loading-output-boundaries` | `ex-google-ai-studio-data-exfiltration` |
| `url-query-prompt-injection` | `incident_report` | `policy_enforcement` | 1 | `copilot-chatgpt-connector-persistence` | `use-copilot-chatgpt-connector-persistence` | `ex-copilot-reprompt-query-link` |
| `url-query-prompt-injection` | `incident_report` | `tool_authorization` | 1 | `browser-web-rendered-content` | `use-browser-web-rendered-content` | `ex-cometjacking-url-parameter` |
| `web-idpi-hidden-content` | `application_security` | `instruction_isolation` | 1 | `monitoring-runtime-declarative-defenses` | `use-monitoring-runtime-declarative-defenses` | `ex-pdl-declarative-prompt-boundary` |
| `web-idpi-hidden-content` | `application_security` | `policy_enforcement` | 1 | `design-ifc-prompt-flow-defenses` | `use-design-ifc-prompt-flow-defenses` | `ex-llm-agent-design-patterns` |
| `web-idpi-hidden-content` | `defense` | `instruction_isolation` | 1 | `design-ifc-prompt-flow-defenses` | `use-design-ifc-prompt-flow-defenses` | `ex-camel-design-instruction-quarantine` |
| `web-idpi-hidden-content` | `defense` | `tool_authorization` | 1 | `monitoring-runtime-declarative-defenses` | `use-monitoring-runtime-declarative-defenses` | `ex-agentarmor-runtime-trace` |
| `web-idpi-hidden-content` | `governance` | `tool_authorization` | 1 | `design-ifc-prompt-flow-defenses` | `use-design-ifc-prompt-flow-defenses` | `ex-prompt-flow-integrity-boundary` |
| `web-idpi-hidden-content` | `incident_report` | `output_exfiltration_control` | 1 | `enterprise-search-agent-to-agent-exfiltration` | `use-enterprise-search-agent-to-agent-exfiltration` | `ex-notion-agent-web-search-exfiltration` |
| `web-idpi-hidden-content` | `memory` | `memory_governance` | 1 | `web-agent-benchmark-browser-boundaries` | `use-web-agent-benchmark-browser-boundaries` | `ex-weblinx-dialogue-navigation-context` |
| `web-idpi-hidden-content` | `red_team` | `output_exfiltration_control` | 1 | `memory-rag-tool-mcp-web-exfiltration` | `use-memory-rag-tool-mcp-web-exfiltration` | `ex-exfiltration-attack-blog-route` |
| `web-idpi-hidden-content` | `red_team` | `tool_authorization` | 1 | `design-ifc-prompt-flow-defenses` | `use-design-ifc-prompt-flow-defenses` | `ex-system-level-ifc-idpi` |
| `web-idpi-hidden-content` | `survey` | `least_privilege_scope` | 1 | `defense-governance-release-controls` | `use-defense-governance-release-controls` | `ex-custom-gpt-prompt-injection-risk` |
| `web-scale-idpi-indicators` | `incident_report` | `human_approval` | 1 | `web-multimodal-idpi-prevalence` | `use-web-multimodal-idpi-prevalence` | `ex-brave-local-agent-tab-context` |
| `web-scale-idpi-indicators` | `incident_report` | `retrieval_integrity` | 1 | `web-multimodal-idpi-prevalence` | `use-web-multimodal-idpi-prevalence` | `ex-forcepoint-web-idpi-indicators` |
| `web-scale-idpi-indicators` | `memory` | `instruction_isolation` | 1 | `web-multimodal-idpi-prevalence` | `use-web-multimodal-idpi-prevalence` | `ex-empirical-web-idpi-prevalence` |
| `zero-click-email-exfiltration` | `defense` | `output_exfiltration_control` | 1 | `email-url-connector-exfiltration-controls` | `use-email-url-connector-exfiltration-controls` | `ex-openai-agent-url-exfil-mitigation` |
| `zero-click-email-exfiltration` | `incident_report` | `output_exfiltration_control` | 1 | `claude-google-prompt-loading-output-boundaries` | `use-claude-google-prompt-loading-output-boundaries` | `ex-claude-cowork-file-exfiltration` |

## Runtime API

- Matrix: `/api/prompt-result-coverage-matrix`