Who does the agent act for?
An agent that acts unattended turns one injected instruction into commands, file writes and calls made as that person.
Holistic AI EndLayer / AI attack surface
AI attack surface.
AI attack surface.
The routes an attacker would take.
EndLayer draws your devices as the ground an attacker would cross: the people the machines act for, the endpoints, the agents acting with their authority, the MCP servers and models those agents draw on, and what lies outside your control. Twenty attack patterns and twelve campaigns, each modelled on a published incident, are matched against it, and each names the one response that breaks it.
Five perimeters, from the people outward
01 / The terrain
P0 · CitadelThe people the machines act for
P1 · GarrisonDevices and repositories
P2 · Front lineApps, agents and editors
P3 · Supply linesModels and local MCP servers
P4 · Hostile groundRemote servers and AI websites
03 / A campaign, traced
● Critical
Poisoned project hijacks an agent
- Chain
- Project → autonomous agent → credentialed server → remote server
- Chokepoint
- The autonomous agent
- Response
- Revoke: it still runs, it reaches nothing
- References
- OWASP LLM01 · LLM06
Rule that closes the route
Govern unattended actions.
Illustrative campaignTrace → Play → Break
New routes inYour AI gives an attacker
Your AI gives an attacker
routes you never drew.
What is an AI attack surface?
Every AI agent on a laptop acts with somebody's authority. It reads repositories, loads MCP servers that hold credentials, runs skills it was handed and talks to services outside your control. Each of those links is a step an attacker can take, and the steps join up across machines.
The AI attack surface is that set of routes: what an attacker would have to cross to go from untrusted content to your data or your production systems, and how much of the fleet each route reaches.
What did it load?
Skills, plugins and MCP packages arrive from marketplaces and repositories, and run with the agent's reach.
Where is the way out?
Remote servers and AI websites are channels off the device. Sensitive data that was let through shows which ones are used.
Organised by exposure
The perimeters.
The graph is organised by how exposed a thing is, not by what kind of thing it is. The same kind of item lands on different perimeters depending on where it reaches.
PerimeterWhat stands in itWhy it matters
P0 Citadel
Identities: the people the machines act for.
An agent that acts unattended borrows its owner's access. The citadel is what every campaign is ultimately after.
P1 Garrison
The endpoints and the code on them: devices and repositories.
A poisoned repository or a compromised device is where most campaigns start.
P2 Front line
AI acting with the user's authority: apps, agents and editors.
The chokepoint of most campaigns. Revoke an agent's access and everything after it breaks.
P3 Supply lines
What that AI draws on: models, their makers and MCP servers that run locally.
Credentialed local servers and registry packages are how a trusted tool becomes the attacker's.
P4 Hostile ground
Outside the organisation's control: remote MCP servers, AI websites and data that tried to leave.
Where data goes once it is out, and where instructions come in from.
MethodologyA chain found,
A chain found,
not drawn.
Nothing on the page is invented. Every node is something a device reported, every link a relation the agent observed, and the catalogue only asks questions of them.
- 01 / Graph
The graph is the evidence.
Installed tools, MCP servers, skills, projects, models, AI sites and data protection events, folded so one node stands for every machine that carries it.
The 21 signals ↗ - 02 / Attacks
Twenty patterns.
Each attack asks which nodes, linked how, make the move possible. Severity rises one step when an attack reaches a quarter of the fleet or more.
- 03 / Campaigns
Twelve chains.
Each campaign is a sequence of stages the search must find end to end on your graph. With no complete chain it reads not observed, however plausible it sounds.
- 04 / Break
One response at the chokepoint.
Each campaign names the stage where one response breaks everything after it: revoke the agent, kill-switch the tool or block the site. The what-if shows what that one action costs.
Apply your rules ↗
Every entry links the policy rule that closes the route, such as Govern unattended actions, Block the MCP servers, Permit only known MCP hosts and Block sensitive data in prompts, and the page to review what exposes it.
MCP security ↗Seen in the wildCampaigns modelled
Campaigns modelled
on real incidents.
Six of the twelve. The chokepoint is highlighted; a dashed stage is the attacker's optional move.
CampaignThe chainModelled on
Critical · Execution
Poisoned project hijacks an agent
- project
- autonomous agent
- credentialed server
- remote server
Hidden instructions in a rules file that coding agents followed, and a public issue that made an agent publish private repositories.
Critical · Exfiltration
Copy-paste exfiltration through the browser
- device
- data let through
- AI site
Engineers pasting source code and meeting notes into a public chatbot for help, in three incidents in twenty days.
- user-installed skill
- agent
- credentialed server
- remote server
Over a thousand malicious skills uploaded to an agent marketplace that harvested API keys and opened reverse shells.
- credentialed local server
- app
- device
- AI site
A look-alike MCP server package that copied every email it sent to the attacker.
- autonomous agent
- credentialed server
- project
A coding agent that ran destructive commands against a production database during a code freeze.
- device
- coding CLI
- credentialed server
- project
- AI site
Malicious package releases that drove the machine's own AI command-line tools to hunt for secrets and publish them.
A vocabulary you already use
Mapped to the frameworks.
Each entry cites the frameworks that apply to it and no more, so a security team can place it alongside the rest of its threat model.
The risk class.
LLM01 prompt injection, LLM02 sensitive information disclosure, LLM03 supply chain and LLM06 excessive agency.
OWASP ↗The move the AI makes.
Indirect prompt injection, plugin compromise and AI supply chain compromise.
MITRE ATLAS ↗The move attackers always made.
Command execution, unsecured credentials, valid accounts, exfiltration over web service and data destruction. The catalogue is ordered by ATT&CK's tactics.
MITRE ATT&CK ↗Exposure, not an alert.
An entry says what an attack would take and how much of the fleet it reaches. It does not claim anybody tried it.
Structure, not content.
It does not see network traffic or read prompts. A data protection event is a detector's verdict, never the text, and a skill or server is known by what it is, not by what its instructions say.
The shape, not the bug.
Where a real incident needed a flaw in one product version, the catalogue models the shape that made it possible, because the shape outlives the patch.
Five practical answers
Before you start.
What it is, what it reads, how it ranks and what you can do about it.
Is the AI attack surface a penetration test or red teaming?
No. EndLayer does not attack anything. It reads what your enrolled devices report and asks which known attack patterns that configuration makes possible, and how much of the fleet each one reaches.
Where does the attack surface data come from?
From what the Layer 1 Agent already reports: installed AI tools, MCP servers, skills, the projects sessions worked in, the models they called, AI websites visited and data protection events. The catalogue never adds a node or a link of its own.
How is severity decided?
Each attack has a base severity: data already leaving is critical, an unsanctioned foothold is medium. An attack exposed on a quarter of the fleet or more goes up one step, because the same hole on every machine is a worse hole.
What can we do about a campaign once it is found?
Each campaign names its chokepoint and the response that breaks it: revoke an app's or agent's access, trip a kill switch on a tool, or block a site in the browser. The what-if shows what that one action affects, and the entry links the policy rule that closes the route.
Which incidents are the campaigns modelled on?
Published incidents and research, including the Samsung source code leak, EchoLeak, the Supabase MCP lethal trifecta, postmark-mcp, s1ngularity, ClawHavoc and the Replit production deletion. Each entry lists the cases it is drawn from.
EndLayer
Give AI room to work.And clear boundaries.
See the Guardian Agent Platform on your own fleet. Find every AI tool, understand what it reaches and costs, and apply the controls your team needs.
One connected layer of control
Devices · Cloud · ApplicationsSurface / Monitor / Govern