---
title: "AI agent security glossary: 25 terms with their defining source"
canonical: https://pharosone.ai/knowledge/glossary
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"AI agent security glossary: 25 terms with their defining source\". PharosOne, 2026-10-23. https://pharosone.ai/knowledge/glossary"
---

# AI agent security glossary: 25 terms with their defining source

> Prompt injection, MCP, AIUC-1, attack success rate, runtime guard and 20 more terms, each with a link to the standard or paper that defines it.

URL: https://pharosone.ai/knowledge/glossary · Category: Glossary · Published: 2026-10-22 · Updated: 2026-10-23 · Author: PharosOne Research · Reviewed by: PharosOne editorial

*PharosOne sells pentests, AI agent security testing and the runtime guard Pharos Radar, and wrote this article.*

**In short.** Twenty-five terms, alphabetical, 40 to 80 words each. Every entry names the standard, paper or specification that defines it and links to the article in this library where the term does the most work. Product terms carry PharosOne's own definition and price where one applies. Standards terms point to the [standards crosswalk](/research/ai-standards-crosswalk), which compares what each one asks of AI agents.

## Key facts

- Updated: 22 October 2026.
- Who it is for: anyone reading this library who wants one place to check a term.
- Sources: OWASP, MITRE ATLAS, the MCP specification, NIST, AICPA, EUR-Lex, ISO and AIUC-1, plus the papers that coined the terms.
- Next step: if a term is missing, write to audit@pharosone.ai.

## A to C.

**AI agent.** A system in which a language model decides its own steps and tool calls to reach a goal, as opposed to a workflow whose steps are fixed in code. Anthropic's distinction: agents are "systems where LLMs dynamically direct their own processes and tool usage" ([Anthropic, December 2024](https://www.anthropic.com/engineering/building-effective-agents)). PharosOne tests and watches agents rather than bare models.

**AIUC-1.** A certification standard for AI agents maintained by the Artificial Intelligence Underwriting Company, with six domains: data and privacy, security, safety, reliability, accountability and society. Certificates are issued by accredited auditors, are valid for one year and include quarterly retests. PharosOne's reports and Pharos Radar findings map to its controls ([aiuc-1.com](https://aiuc-1.com/); [standards crosswalk](/research/ai-standards-crosswalk#aiuc-1)).

**Attack success rate.** The share of attack trials in which the agent did what the attacker wanted, judged by effect rather than by a keyword in the output. AgentDojo scores prompt-injection security this way ([Debenedetti et al., 2024](https://arxiv.org/abs/2406.13352)). The Pharos probe engine reports it per probe with a Wilson interval ([probe engine](/research/the-probe-engine-how-we-measure-agent-security)); the [AI agent security assessment](/knowledge/ai-agent-security-assessment) prints it per attack class with the number of attempts behind it.

**Attempt versus execution.** An attempt is an injected instruction that reached the agent; an execution is the agent acting on it. Pharos Radar reports the first as a warning and the second as the alarm. Input classifiers such as Microsoft's Prompt Shields report whether an attack was detected in a prompt or document, which covers the attempt side only ([Microsoft](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection); [Attempt versus execution](/knowledge/attempt-versus-execution)).

**Confidence interval (Wilson).** An interval for a proportion that stays well-behaved at small samples and near zero, recommended over the textbook Wald interval by Brown, Cai and DasGupta after Wilson's 1927 method ([Statistical Science, 2001](https://projecteuclid.org/journals/statistical-science/volume-16/issue-2/Interval-Estimation-for-a-Binomial-Proportion/10.1214/ss/1009213286.full)). The Pharos probe engine reports attack success rates with a 95% Wilson interval, so zero hits in a few trials is never read as zero risk.

## D to J.

**DORA.** The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applying to EU financial entities since 17 January 2025. Articles 24 to 27 require a digital operational resilience testing programme, including threat-led penetration testing for the largest entities. Article 24(6) asks for appropriate tests at least yearly on systems supporting critical or important functions. PharosOne's human pentest is mapped to Articles 24 and 25 ([EUR-Lex](https://eur-lex.europa.eu/eli/reg/2022/2554/oj); [standards crosswalk](/research/ai-standards-crosswalk#soc-2-and-dora)).

**EU AI Act.** Regulation (EU) 2024/1689, in force since 1 August 2024 with obligations phased in from February 2025; Article 50 transparency applies from 2 August 2026 and high-risk duties from 2 December 2027 (Annex III) or 2 August 2028 (Annex I products). Article 9 requires risk management with testing and Article 15 accuracy, robustness and cybersecurity for high-risk systems ([EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj); [European Commission](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act); [standards crosswalk](/research/ai-standards-crosswalk#eu-ai-act)).

**Evidence span.** The exact passage in a conversation or tool call that a Pharos Radar flag points to: the injected instruction for an attempt, the acting reply or tool call for an execution. Every finding in the cabinet carries one, so an auditor or a SOC analyst reads the proof itself rather than a summary ([Pharos Radar](/knowledge/pharos-radar)).

**Guardrail.** A control around a model that constrains input, output or actions: a classifier on the prompt, a filter on the reply, a confirmation step before a tool runs. OWASP lists input and output filtering among seven mitigations for prompt injection, and Google ships five layers around Gemini ([OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/); [Google, 2025](https://blog.google/security/mitigating-prompt-injection-attacks/)).

**Indirect prompt injection.** A prompt injection in which the instruction arrives inside content the model processes, such as a web page, a document, an email or a tool result, rather than from the user. The term is from Greshake et al. (2023); MITRE ATLAS tracks it as AML.T0051.001 ([arXiv](https://arxiv.org/abs/2302.12173); [MITRE ATLAS](https://d3fend.mitre.org/offensive-technique/attack/AML.T0051.001/); [Indirect prompt injection](/knowledge/indirect-prompt-injection)).

**ISO 42001.** ISO/IEC 42001:2023, the first management-system standard for AI, specifying how an organisation establishes, operates and improves an AI management system. It certifies the organisation's management system; a pentest of an agent is one input to it, for example to Annex A control A.6.2.4 on verification and validation ([ISO](https://www.iso.org/standard/81230.html); [standards crosswalk](/research/ai-standards-crosswalk#iso-iec-42001)).

**Jailbreak.** A direct prompt injection in which the user's own input makes the model set aside its safety rules. OWASP: jailbreaking is "a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely" ([OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)). The operator is the victim; in an indirect injection the user is.

**Judge model.** A language model used to decide whether a trial succeeded, instead of a keyword match. Zheng et al. showed that LLM judges approximate human preference at scale ([NeurIPS 2023](https://arxiv.org/abs/2306.05685)). PharosOne's engine lets a judge overwrite the keyword oracle's verdict, because refusals often repeat the attacker's words ([judged-scoring study](/research/variation-policies-and-llm-judged-scoring-study)).

## M to O.

**MCP.** The Model Context Protocol, an open protocol in which a server advertises tools, resources and prompts and a client lets a model call them. Tools are "model-controlled"; the specification requires clients to treat tool annotations as untrusted unless the server is trusted, and recommends a human able to deny each call ([MCP specification 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/server/tools)).

**Memory poisoning.** Writing attacker-chosen content into a store the agent reads back later: a conversation memory, a RAG index, or a context file. OWASP lists it as ASI06 in the Agentic Top 10. AgentPoison reached over 80% attack success by poisoning under 0.1% of a RAG agent's memory ([Chen et al., 2024](https://arxiv.org/abs/2407.12784); [Poisoned tool descriptions and memory](/knowledge/poisoned-tool-descriptions-and-memory)).

**NIST AI RMF.** The NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023), a voluntary framework with four functions: Govern, Map, Measure and Manage. Subcategory MEASURE 2.7 asks that AI system security and resilience are evaluated and documented, which is where an adversarial test of an agent fits. NIST is revising version 1.0 ([NIST](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf); [standards crosswalk](/research/ai-standards-crosswalk#nist-ai-rmf)).

**OWASP Agentic Top 10.** The OWASP GenAI Security Project's list of the ten most critical risks for agentic applications, published 9 December 2025 and numbered ASI01 Agent Goal Hijack to ASI10 Rogue Agents. PharosOne tags its probes and findings with the ASI id where one applies ([genai.owasp.org](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/); [standards crosswalk](/research/ai-standards-crosswalk#owasp-agentic-top-10)).

**OWASP LLM Top 10.** The OWASP GenAI Security Project's list of the ten most critical risks for LLM applications. The 2025 edition opens with LLM01 Prompt Injection and includes LLM05 Improper Output Handling. Pharos Radar cross-references every finding to it ([genai.owasp.org](https://genai.owasp.org/llm-top-10/)).

## P to T.

**Pentest.** A penetration test: a time-boxed, authorised attack on a defined scope, ending in a report and usually a retest. In a human pentest engineers lead the attack; in an AI-run pentest AI agents run it and an engineer reviews the findings. The Penetration Testing Execution Standard sets seven phases from pre-engagement to reporting, and OWASP's Web Security Testing Guide supplies the web test catalogue ([PTES](http://www.pentest-standard.org/); [OWASP WSTG](https://owasp.org/www-project-web-security-testing-guide/stable/)). PharosOne's human pentest starts at €9,500 and its AI-run assessment costs €3,900 ([human pentest](/knowledge/human-pentest); [AI agent security assessment](/knowledge/ai-agent-security-assessment)).

**Prompt injection.** A vulnerability that "occurs when user prompts alter the LLM's behavior or output in unintended ways" ([OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)). Simon Willison named it in September 2022 after Riley Goodside's GPT-3 examples; the root cause mirrors SQL injection, since instructions and data share one string ([Willison, 2022](https://simonwillison.net/2022/Sep/12/prompt-injection/)).

**Red team.** NIST: "a structured testing effort to find flaws and vulnerabilities in an AI system, often in a controlled environment" ([NIST CSRC glossary](https://csrc.nist.gov/glossary/term/artificial_intelligence_red_teaming)). In PharosOne's offer a red team pursues one objective across the organisation over 6 to 8 weeks, about 25 operator days, from €38,000; a pentest tests a scope.

**Retest.** A second test of the findings from a pentest after the fixes, producing a closure letter an auditor can read. PCI DSS 11.4.4 requires one after exploitable findings are corrected. PharosOne includes one retest within 90 days in every pentest, and a second round costs 15% of the project ([human pentest](/knowledge/human-pentest)).

**Runtime guard.** A control that watches a running agent and can hold a reply or stop a tool call. Pharos Radar is one: a yes-or-no flag per reply and per tool call, returned in the same call with per-turn integration, or applied from the next turn with the one-line wrapper. As of October 2026, 36 of 100 AI security vendors reviewed by PharosOne list runtime guardrails as a core capability ([AI security market 2026](/knowledge/ai-security-market-2026); [Pharos Radar](/knowledge/pharos-radar)).

**SOC 2 CC4.1.** The monitoring criterion in the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022: the entity performs ongoing and separate evaluations to ascertain whether controls are present and functioning. Its points of focus name penetration testing among the evaluation types without requiring one; a dated pentest is common SOC 2 evidence in practice ([AICPA](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022); [standards crosswalk](/research/ai-standards-crosswalk#soc-2-and-dora)).

**Tool poisoning.** Hiding instructions for the model in a tool's description or schema, so the agent is steered before any tool is called. Invariant Labs, April 2025: "malicious instructions are embedded within MCP tool descriptions that are invisible to users but visible to AI models" ([Invariant Labs](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)). Variants include rug pulls and shadowing ([Poisoned tool descriptions and memory](/knowledge/poisoned-tool-descriptions-and-memory)).

## FAQ

### Why does PharosOne use a Wilson interval instead of a plain percentage?

A plain percentage from a small sample hides its uncertainty. The Wilson interval stays well-behaved at small samples and near zero, so zero hits in a few trials is reported as an upper bound rather than as zero risk.

### What is the difference between a pentest and a red team?

A pentest tests a defined scope and ends in a report and a retest. A red team pursues one objective across the organisation over 6 to 8 weeks, from €38,000, and measures what a determined attacker reaches.

### Which standards define the terms here?

OWASP's LLM Top 10 and Agentic Top 10, MITRE ATLAS, the MCP specification, NIST, AICPA's Trust Services Criteria, EU regulations on EUR-Lex, ISO/IEC 42001 and AIUC-1. Each entry links to the one that defines it, and the standards are compared clause by clause in the standards crosswalk.

## Sources

1. [Building effective agents](https://www.anthropic.com/engineering/building-effective-agents). Anthropic, 2024-12-19.
2. [AIUC-1. The standard for AI agent security, safety and reliability](https://aiuc-1.com/). Artificial Intelligence Underwriting Company, 2026.
3. [AgentDojo. A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents](https://arxiv.org/abs/2406.13352). Debenedetti et al. arXiv 2406.13352, 2024-06-19.
4. [Interval Estimation for a Binomial Proportion](https://projecteuclid.org/journals/statistical-science/volume-16/issue-2/Interval-Estimation-for-a-Binomial-Proportion/10.1214/ss/1009213286.full). Brown, Cai, DasGupta. Statistical Science 16(2), 101–133, 2001.
5. [Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj). EUR-Lex, 2022-12-14.
6. [Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). EUR-Lex, 2024-06-13.
7. [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). OWASP GenAI Security Project, 2025.
8. [OWASP Top 10 for LLM Applications 2025](https://genai.owasp.org/llm-top-10/). OWASP GenAI Security Project, 2025.
9. [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). OWASP GenAI Security Project, 2025-12-09.
10. [Not what you've signed up for. Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://arxiv.org/abs/2302.12173). Greshake et al. arXiv 2302.12173, 2023-02-23.
11. [AML.T0051.001 LLM Prompt Injection. Indirect](https://d3fend.mitre.org/offensive-technique/attack/AML.T0051.001/). MITRE ATLAS (served through MITRE D3FEND), 2025.
12. [ISO/IEC 42001:2023 Information technology. Artificial intelligence. Management system](https://www.iso.org/standard/81230.html). ISO, 2023-12.
13. [Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf). NIST, 2023-01-26.
14. [AI Act implementation timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act). European Commission, AI Act Service Desk, 2026.
15. [Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena](https://arxiv.org/abs/2306.05685). Zheng et al. NeurIPS 2023 Datasets and Benchmarks. arXiv 2306.05685, 2023-06-09.
16. [Tools. Model Context Protocol specification 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/server/tools). Model Context Protocol, 2025-11-25.
17. [AgentPoison. Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases](https://arxiv.org/abs/2407.12784). Chen et al. arXiv 2407.12784, 2024-07-17.
18. [The Penetration Testing Execution Standard](http://www.pentest-standard.org/). PTES, 2014.
19. [OWASP Web Security Testing Guide, stable](https://owasp.org/www-project-web-security-testing-guide/stable/). OWASP, 2024.
20. [Prompt injection attacks against GPT-3](https://simonwillison.net/2022/Sep/12/prompt-injection/). Simon Willison, 2022-09-12.
21. [Artificial intelligence red-teaming](https://csrc.nist.gov/glossary/term/artificial_intelligence_red_teaming). NIST Computer Security Resource Center glossary, from NIST SP 800-218A, 2024.
22. [2017 Trust Services Criteria, with revised points of focus 2022](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022). AICPA & CIMA, 2022.
23. [MCP Security Notification. Tool Poisoning Attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks). Invariant Labs, 2025-04-01.
24. [Mitigating prompt injection attacks with a layered defense strategy](https://blog.google/security/mitigating-prompt-injection-attacks/). Google GenAI Security Team, 2025-06-13.
25. [Prompt Shields in Azure AI Content Safety](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection). Microsoft Learn, 2026-08-28.

Source: PharosOne, "AI agent security glossary: 25 terms with their defining source", https://pharosone.ai/knowledge/glossary, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt