The combined technical and behavioural exposure created when an AI system can be influenced through prompts, tools, memory and context. It captures risks that do not exist in classic software testing because the system can be socially manipulated as well as technically exploited.
How psycho-technical attack surface emerges
Psycho-technical attack surface is the point where model behaviour, user influence, and system control intersect. It appears when prompts, tool calls, memory, and context can be steered in ways that change what the system believes, what it retrieves, or what it does next.
This is broader than classic application testing because the attacker may not need to break code at all. They may instead shape the system’s inputs, instructions, or surrounding context so that the model or agent behaves unsafely while still appearing to operate normally.
Why it is different from ordinary software exposure
Classic software attack surface is usually about reachable functions, exposed services, and vulnerable code paths. Psycho-technical attack surface adds a behavioural layer, because the same interface can be safe in one context and dangerous in another if the system follows untrusted instructions too readily.
That makes trust boundaries harder to define. A prompt, retrieved document, message, memory record, or tool response may all become part of the attack surface when the model treats them as instructions, evidence, or permission to act.
Where the exposure concentrates
The highest-risk areas are usually the places where the system can absorb outside influence and then act on it: prompt handling, retrieval pipelines, memory stores, tool routing, and response generation. The more autonomy the system has, the more those pathways can influence downstream actions.
This also means the surface is often distributed across multiple components rather than confined to one endpoint. A weak control in any one layer can let an adversary move from manipulation to action, especially when the system can chain tools or reuse prior context.
- Prompt channels can be used to override or confuse intended instructions.
- Memory can preserve poisoned assumptions across sessions or tasks.
- Tools can turn a manipulated decision into an external side effect.
- Context can smuggle in irrelevant or malicious directives that appear authoritative.
Why defenders need a behavioural lens
Defending this attack surface requires more than input validation. Teams need to understand how the system interprets instructions, how it prioritises conflicting signals, and where it may over-trust content that should only be treated as data. Agentic AI Security Guide is useful here because it frames the layered controls around inputs, memory, tools, orchestration, and identity.
For practitioners, the key point is that the security boundary is partly psychological, not just technical. A system can be technically intact and still be exploitable if it can be persuaded to reinterpret its own goals, trust untrusted context, or misuse its tools.
- OWASP Agentic Applications Top 10 maps the main failure modes where influence becomes compromise.
- MITRE ATLAS adversarial AI threat matrix helps model prompt injection, memory poisoning, and tool misuse as attack techniques.
- NIST AI Risk Management Framework supports governance of AI risks that arise from autonomy and misuse of context.
Risk and Threat Considerations
Psycho-technical attack surface is dangerous because it can turn ordinary interaction into a compromise path. When the system accepts untrusted instructions, retrieved content, or tool outputs as if they were safe guidance, attackers can steer decisions, trigger sensitive actions, or create persistence through poisoned context.
Failure mechanism: The system over-trusts one or more influence channels, such as prompts, memory, or tool outputs, and then uses that influenced content to reason, decide, or act.
Impact: The result can be data leakage, unauthorised actions, degraded decision quality, or a broader compromise chain that is hard to spot because it looks like normal system behaviour.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Covers agent misuse of authority and manipulated decisions through identity and privilege |
| ASI02 — Tool Misuse | Directly addresses abuse of tools as part of agent manipulation | |
| ASI06 — Memory & Context Poisoning | Matches the term’s core exposure through poisoned memory and context | |
| Recommendation — Constrain agent authority and require explicit approval for privileged actions. Restrict tool access and validate tool invocation intent before execution. Isolate and sanitize stored context before it can influence future decisions. | ||
| NIST AI RMF | Govern | Supports organisational governance over AI risks created by influenceable systems |
| Recommendation — Establish accountability for AI influence paths and review them as managed risk. | ||
| MITRE ATLAS | Adversarial Machine Learning Techniques | Covers adversarial techniques such as prompt injection and context manipulation |
| Recommendation — Map observed influence patterns to adversarial AI techniques and hunt for abuse. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Applies because hostile prompts and context are input-driven attack vectors |
| AU-6 — Audit Record Review, Analysis, and Reporting | Helps detect suspicious influence, tool use, and post-action review needs | |
| Recommendation — Validate and constrain untrusted inputs before they can affect model behaviour. Review logs for abnormal prompt influence, tool use, and context changes. | ||
Practitioner Guidance
Why practitioners should care: This term describes a security boundary that is easy to underestimate. If you only review code and endpoints, you can miss the real place where the system is being manipulated.
What to watch for: Pay attention to systems that combine external inputs, retained memory, and tool execution, especially when they can act with limited human oversight. Those are the places where small influence can produce outsized operational effects.