> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beyondguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Threat Model: Threats BeyondGuard Detects and Blocks

> A complete reference of the AI threats BeyondGuard detects and neutralizes across your prompts, agents, tools, data, and model outputs.

AI introduces a new class of security threats that traditional tools are structurally unable to detect. A firewall cannot tell whether a user message contains a prompt injection. A DLP scanner cannot determine whether a retrieved document was tampered with to manipulate model reasoning. A SIEM cannot follow an agent's plan and recognize when it has deviated from its authorized scope. These threats live inside the semantic content of AI interactions — in the meaning of text, the intent behind instructions, and the behavior of autonomous systems — not in the packet-level or signature-level patterns that conventional security tools inspect. BeyondGuard is built specifically to detect and neutralize this new threat class across every layer of your AI stack.

## Threat Categories

The table below covers every threat class BeyondGuard detects, the layer of the AI value chain where it appears, and its severity under standard risk scoring.

| Threat                         | Layer                | Description                                                                                   | Severity |
| ------------------------------ | -------------------- | --------------------------------------------------------------------------------------------- | -------- |
| **Prompt Injection**           | Application / Prompt | Malicious instructions embedded in user input to hijack model behavior                        | High     |
| **Jailbreak**                  | Prompt               | Attempts to bypass model safety guardrails through adversarial prompting                      | High     |
| **System Prompt Leakage**      | Model                | Extraction of confidential system instructions from the model                                 | High     |
| **Scope Violation**            | Application          | Model operates outside defined business logic or role boundaries                              | Medium   |
| **RAG Poisoning**              | Data                 | Malicious content injected into the retrieval corpus to manipulate model responses            | High     |
| **Memory Poisoning**           | Agent                | Attacker corrupts the agent's persistent memory to influence future behavior                  | High     |
| **Plan Deviation**             | Agent                | Agent takes actions inconsistent with its defined plan or user intent                         | High     |
| **Infinite Loop**              | Agent                | Agent enters a loop state consuming resources without completing its task                     | Medium   |
| **Tool Poisoning**             | MCP / Tool           | Malicious tool definitions or MCP servers that manipulate agent behavior                      | High     |
| **Parameter Injection**        | MCP / Tool           | Unexpected parameter values passed to tools to trigger unintended behavior                    | Medium   |
| **Schema Violation**           | MCP / Tool           | Tool calls or responses that violate expected schemas, potentially hiding malicious payloads  | Medium   |
| **Data Leakage / PII**         | Output               | Sensitive or personal data included in model output                                           | High     |
| **IP Violation**               | Output               | Model outputs that reproduce copyrighted content                                              | Medium   |
| **Toxic Output**               | Output               | Harmful, offensive, or inappropriate content in model responses                               | High     |
| **Dangerous Code**             | Model                | Model generates executable code with malicious or dangerous behavior                          | High     |
| **Multi-modal Attacks**        | Prompt               | Malicious instructions embedded in images, audio, or documents provided to multi-modal models | High     |
| **Model Supply Chain Attacks** | Model                | Compromised model weights, fine-tuning datasets, or third-party integrations                  | High     |
| **Shadow AI**                  | Application          | Unsanctioned AI tools or models operating outside organizational controls                     | Medium   |

## OWASP LLM Top 10 Mapping

BeyondGuard maps its detections directly to the OWASP LLM Top 10, the industry-standard reference for AI application security risks. Every threat category in the table above corresponds to one or more OWASP LLM entries, which means your BeyondGuard coverage report can serve directly as evidence of control alignment in audits, vendor assessments, and regulatory submissions. BeyondGuard also maintains coverage mappings for the EU AI Act's risk management requirements, giving compliance teams a single source of truth across both frameworks. For the full mapping reference, see [OWASP LLM Top 10 Coverage](/resources/owasp-llm-top10).

<Warning>
  No single tool eliminates all AI risk. The threats in this model evolve continuously — new jailbreak techniques emerge, novel injection vectors appear in multi-modal inputs, and agent architectures introduce attack surfaces that did not exist when earlier frameworks were written. Defense in depth across every layer of the AI value chain, combined with a structured progression through the [maturity model](/concepts/maturity-levels), is the only sustainable approach to AI security.
</Warning>