Agent Trust Boundary Violations: A New Vulnerability Class in AI Agent Infrastructure
Year: 2026
Type: preprint
Abstract: We define Agent Trust Boundary Violation (ATBV) as a class of vulnerabilities in AI/ML agent infrastructure where the system treats data crossing a trust boundary — model outputs, tool results, serialized artifacts, or inter-agent messages — as trusted code or configuration, without validation proportional to the privilege of the operation performed. This class is distinct from prompt injection (which targets model reasoning) in that ATBV exploits the infrastructure layer connecting agents to execution environments, not the model itself. Based on empirical analysis of 62 distinct vulnerabilities discovered across 40+ AI/ML frameworks (2026), we propose a taxonomy of 6 sub-classes, demonstrate that existing CWE categories (CWE-94, CWE-502, CWE-918, CWE-306) capture individual instances but fail to express the shared trust-boundary pattern, and argue for a dedicated CWE node. This is a taxonomy and CWE-proposal paper: it describes the vulnerability class, root causes, detection heuristics, and mitigations at a general level. It does not name specific vulnerable software or versions; individual findings are handled through responsible disclosure. Keywords: AI security, agent infrastructure, trust boundary, vulnerability taxonomy, CWE, MCP, LLM agents.
Author: Urlep, Andy
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225585643