The ways AI assistants, agents, and models get fooled, in plain language, and what DOR does about each one.
What an agent is told, and who is allowed to tell it.
AI-I.1
A person types instructions meant to override an agent's rules or extract what it should not share.
DOR moves authority out of the text and into where it came from, so only instructions from a verified person or system count.
AI-I.2
Instructions hidden in an email, web page, file, or calendar invite are read by an agent as part of its task.
DOR separates instructions from data by where they came from, so content an agent reads never gains authority.
AI-I.3
A request can claim to come from an executive, a customer, or a known internal system.
DOR proves who sent it before the agent acts.
AI-I.4
In a chain of agents, an instruction can be invented or changed between handoffs.
DOR verifies every handoff and carries the original sender's proof with it.
The documents, search results, and data an agent reads and learns from.
AI-K.1
A planted or altered document in a knowledge base or search result can steer an agent's answers.
DOR proves where each source came from before it enters the agent's context.
AI-K.2
Bad examples added to training or fine-tuning data can change a model's behavior.
DOR ties every contribution to its origin before it is accepted.
AI-K.3
Generated images, voices, or video can enter an AI pipeline as if they were captured.
DOR checks whether content came from its claimed source and is unaltered, with no original needed.
AI-K.4
Inputs to vision and sensing models can be altered between the sensor and the model.
DOR proves the model's input is the sensor's own.
Payments, messages, code, and changes an agent makes in the world.
AI-A.1
An agent can be talked into approving, buying, paying, or deleting.
DOR holds any consequential action that cannot trace its authority to a verified person.
AI-A.2
A manipulated agent can send internal data out through messages, links, or image requests.
DOR holds outbound actions that trace back to content rather than to a verified instruction.
AI-A.3
Coding and operations agents can change or delete live systems.
DOR requires verified authority and a recorded reason for every change.
AI-A.4
Keys and tokens taken from an agent let an attacker act as that agent.
DOR verifies the agent itself, beyond the credential it presents.
The model, the tools around it, and the updates that change both.
AI-M.1
A model can be replaced or changed after approval.
DOR confirms the model running is the approved one and ties every output to it.
AI-M.2
A tampered release of an AI tool or library can spread to every company that installs it.
DOR verifies each update before installation and confirms what is running afterward.
AI-M.3
A model can carry a hidden trigger that changes its behavior on cue.
DOR binds every model to its full history, so the cause can be traced and the model held.
What an AI produced, from what, and who approved it.
AI-R.1
An AI decision is questioned and no one can show what produced it.
DOR ties every output to its inputs, model, and instructions, so it can be reviewed and reproduced.
AI-R.2
Records of what an AI did can be edited or deleted after the fact.
DOR's record of what each agent received and did cannot be edited or deleted.
AI-R.3
Labels saying content was made by AI can be removed or forged.
DOR makes the origin of an AI output a verified fact instead of a label.
No entries match. Try another word, or choose All.
AI
Bring your list of agents and the tools they can reach, or just the question your security team keeps asking. DOR will show you exactly where it fits.
