Attack library
Ten ways AI agents get talked out of money.
People get refunds, discounts, settlements, better prices and better terms out of AI agents with ten families of tactics, from fake manager approval and invented policies to instructions hidden in a ticket. Each family below explains how the attack works, why agents fall for it and the controls that stop it.
Last updated
| Code | Family | What the attacker does | Techniques |
|---|---|---|---|
| T1 | Negotiation pressure | Anchors, fake rival quotes, false deadlines and nibbling that push an agent past its price or terms floor. | Extreme anchor · Fake competing offer · False deadline and walk-away bluff · Reciprocal concession ladder · Nibbling and stacking |
| T2 | Social engineering | Fake approvals, staff impersonation, misquoted policy, sympathy and threats that talk an agent into paying. | Fake prior approval · Staff or executive impersonation · Policy misquote · Sympathy and urgency · Polite threats |
| T3 | Multi-turn escalation | Small, innocent-looking steps across one chat that add up to a concession no single message would get. | Crescendo · Commit then escalate · Request splitting · Rule rewriting · Rephrase after refusal |
| T4 | Indirect prompt injection | Instructions hidden in tickets, attachments, web pages or tool output that the agent obeys as yours. | Hidden text in attachments · Poisoned product page · Pasted “evidence” · Fake system or internal note · Tool-output poisoning |
| T5 | Information extraction | Probing for an agent’s floor, approval limits and private rules so the attacker can ask for the maximum. | Hypothetical threshold questions · Concession probing · Reason menu · Social comparison · Instruction extraction |
| T6 | Human fraud patterns | Item-not-received claims, wardrobing, empty boxes, edited evidence and repeat claims aimed at AI agents. | Item not received · Wardrobing and self-inflicted damage · Empty box and weight mismatch · Edited evidence · Refund-as-a-service |
| T7 | Mandate and identity abuse | Mismatched or replayed mandates and impersonated owners that get an agent to pay or change an account. | Mandate mismatch · Claimed approval · Approval replay · Owner impersonation · Advance-fee deal |
| T8 | Memory and multi-session attacks | False history planted in agent memory or notes, or trust built over sessions, then used for a large ask. | Note planting · False history · Long con · Account cycling · Shared memory poisoning |
| T9 | Multi-agent collusion | Coordinated accounts or agents, and pricing agents reacting to each other, that beat limits set per party. | Split claims · Probe then hand off · Manipulative seller agents · Tacit price coordination · Feedback loops |
| T10 | Stalling and denial | Endless haggling, loops and tool-budget exhaustion that push an agent into conceding or an unsafe fallback. | Attrition · Loop induction · Malformed confirmations · Timeout baiting · Promises instead of payment |
Early access
Run these against your own agent.
Countermove will test your agent against every family here and report the dollars it gives away. Join early access to hear when it opens.