Agent Security and Red Team Pattern Library

As agents gain tools, memory, and the ability to read untrusted content, they gain an attack surface — and the attacks have known shapes, scattered across papers, disclosures, and other people's incidents. Most teams harden against the two they've heard of and miss the ten they haven't. This is the catalog. It is a defensive reference — a field manual for hardening agents you build or operate, describing attacks so you can recognize and close them, not an offensive toolkit and not a source of weaponized payloads. It maps every surface where untrusted input reaches an agent, then walks six attack families in depth: prompt injection (direct, indirect, hidden-channel, deferred, multi-modal), tool abuse (unauthorized invocation, argument manipulation, tool chaining, confused deputy, destructive triggering), data exfiltration (system-prompt disclosure, cross-tenant bleed, outbound-argument and rendered-content channels, memory and aggregation), memory and context attacks (poisoning, cross-session and cross-user persistence, saturation, compaction tampering), multi-agent attacks (injection propagation, delegation abuse, confused deputy, orchestrator compromise, result poisoning), and RAG and retrieval attacks (corpus poisoning, ranking abuse, citation laundering, index attacks, retrieval-driven exfiltration). Every pattern is written the same way — the surface it hits, how it works conceptually, the detection signal, the concrete defense, and a blast-radius severity — so it reads as a catalog you can scan, not an essay. It closes with a defense-pattern catalog of twelve mitigations, each mapped back to the attacks it closes and ordered by leverage, and a threat-model worksheet with a fully worked hardening pass on a coding-assistant agent. The download is ten files in total. It is a defensive reference and design aid for systems you own or are authorized to test — it does not attack third-party systems, execute exploits, access your agent, or guarantee security, and it describes attacks conceptually for defense rather than shipping exploitation steps. Security is not a one-time state: passing every pattern here is a strong baseline, not a certificate. Works with Claude Code, Cursor, Codex CLI, Gemini CLI, and any SKILL.md agent.