DREAD Scoring Calibrated for AI Agent Vulnerability Reports

DREAD scoring for AI agent vulnerability reports must measure the system an attacker can direct through the entry-point flaw. Autonomous actions, tool chains, persistent memory, and downstream agents change what each axis means. The necessary correction is context-specific recalibration.

Why DREAD's original design assumptions break for AI agents

DREAD was designed to score static, code-level vulnerabilities whose damage is bounded by what the flaw can do. Its classical subjects include a buffer overflow, an unpatched library, and an exposed endpoint. An AI agent, by contrast, can read files, execute shell commands, call APIs, query databases, and coordinate workflows across production infrastructure. Parallax, by Joel Fokou in 2026, establishes that a vulnerability in such an agent also exposes what the agent can reach.

That difference also breaks the assumption that exploitation produces a discrete, observable event. Parallax describes “salami slicing,” in which cumulative context shifts an agent's effective constraint boundary without a single exploitable moment. An exploit can thus run across sessions and hide in exchanges that otherwise look ordinary. A score based on just one prompt or response misses how the attack builds over time. Applied without recalibration, DREAD systematically understates agent risk and can push agent findings below equivalent traditional vulnerabilities.

The agentic threat surface that DREAD scores must now account for

The deployed agent's tools, persistent memory, chained decisions, and delegated work define its attack surface. Prompt injection is one entry point, but tool poisoning can compromise what the agent invokes, while memory injection can influence later sessions. Orchestrator hijack widens the scope because the component under attack directs other agents. These are different objects to score, even when each begins with attacker-controlled text. TrendAI State of AI Security documents that high- and critical-severity findings concentrate in agentic AI and MCP server categories, where complexity meets inconsistent security hardening.

Compromised models, manipulated tokenizers, and malicious MCP server extensions can poison reasoning before a user interacts with the system. Parallax documents attacks propagating to 48% of co-running agents during a single prompt injection incident in multi-agent deployments. At the extreme, Guan et al. (2026) show an adaptive worm that uses compromised machines to run open-weight LLMs and change its attacks to fit Linux, Windows, and IoT devices. These mechanisms establish why scoring must cover both propagation and adaptation, rather than treating every exploit as a fixed payload against one isolated target.

Recalibrating Damage: from what the flaw exposes to what the agent can reach

Traditional scoring assesses the data or system the flaw exposes, whereas agentic scoring assesses what an attacker can cause the agent to do with its tools, credentials, and permissions. An XSS finding that carries medium Damage in a traditional setting can warrant a much higher score if it can instruct a copilot to read and exfiltrate an entire connected data store. The higher rating follows from the connected capability. Without that distinction, the entry-point label conceals the consequential action.

An agent with read/write access to a production database, email capability, and access to financial systems illustrates the concentration of authority. One successful injection can reach what would traditionally be three separate high-severity findings. The AIXBT autonomous trading agent illustrates a direct financial consequence. After gaining unauthorised access to its administrative dashboard, an attacker queued malicious prompts that caused it to send 55.50 ETH to a malicious account. Physical consequences also belong within the scope where the tools permit them. Booz Allen's October 2026 OT range test showed frontier models traversing from perimeter breach to physical control-layer action.

Before assigning Damage, enumerate every tool binding and permission the agent holds. Score the most consequential reachable action rather than the immediate effect of the entry-point flaw. This assessment is limited to reachable harm. When an agent delegates work or spawns sub-agents, the most damage it can do includes what all their tools can reach. Downstream-agent propagation is therefore part of Damage and also determines which parties must later be counted under Affected Users.

Recalibrating Reproducibility: why environmental variability is not the same as low reliability

Output variance is not exploit variance. An agent can use different words or give different responses along the way and still do what the attacker wants. Informal testing that treats a changed answer as a failed exploit therefore depresses Reproducibility without measuring reliability. SafeClawArena found a very high attack success rate against production-grade agents, with malicious plugins succeeding across all tested models, so a change in model alone gives no proof of protection.

For MCP and plugin attacks, set Reproducibility near maximum unless there is specific evidence that a platform-level control blocks that class of attack. For indirect injection, assess the spread of seeded content and how often the agent browses externally, since both shape repeated exposure. Memory injection requires a different temporal boundary. Parallax establishes that extended conversation histories make agents more vulnerable to manipulation through cumulative context shifts. Score a memory-based attack at the session where poisoned memory first becomes active.

Adaptive attacks further weaken the traditional requirement to repeat the same path under the same conditions. Guan et al. (2026) demonstrate propagation through strategies tailored to each target. In that case, changing the method is how the attack reproduces. This establishes an upper bound for agent findings.

Recalibrating Exploitability: skill floor, automation, and the attacker's cost structure

Exploitability must reflect how much skill the attacker needs, even when the system under attack is technically complex. Offensive AI can automate reconnaissance, payload crafting, and adaptation, lowering that requirement. Graph of Effort, by Mehra et al. (2025), points out that current scoring frameworks leave out AI-based attack automation. CVSS 4.0's “automatable” supplemental criterion addresses automation generally but was not designed for AI-specific automation. DREAD likewise has no dedicated metric for that contribution, so the assessment must account for it within Exploitability.

CVE-2025-53773 involved hidden prompt injection in pull request descriptions enabling remote code execution with GitHub Copilot and carried CVSS 7.8. EchoLeak involved zero-click prompt injection that silently exfiltrated enterprise data through Microsoft 365 Copilot. For both attacks, the only skill needed was writing natural-language text. Researchers also found that crafted prompts against Devin AI could instruct it to expose server ports, leak access tokens, and install command-and-control malware.

When natural-language prompts alone can attempt the attack, score Exploitability at the high end despite the underlying system's complexity. Where an AI assistant can generate or refine the payload, reduce the assumed attacker skill level by at least one tier. For MCP and plugin vectors shown to succeed universally across LLM backends, score Exploitability at maximum because backend choice provides no protective diversity. Consider Graph of Effort as a supplementary input when offensive AI automation is a realistic path. Guan et al. (2026) demonstrate the extreme economic case, in which stolen compute makes the attacker's marginal cost per new infection zero, but that ceiling should not be imputed to ordinary findings.

Recalibrating Affected Users: counting principals downstream, not just the person who typed the prompt

Affected Users must include every principal the compromised agent can reach. This includes those who receive downstream tool calls, connected data stores, agents linked through an orchestrator, and people who base decisions on agent outputs. Parallax documents, citing prior work, that injection at one pipeline layer can propagate through every subsequent layer. The number of pipeline layers and their shared resources thus extend the affected population beyond those who can see the chat. Orchestrator hijack is especially consequential here because the entry point sits above delegated work.

The AgentCorruption finding against Amazon Bedrock AgentCore in October 2026 makes the scope concrete. Chat access to a single exposed agent was sufficient to obtain credentials covering every agent in the account and region, read their conversations, and plant persistent memories. The affected population was therefore not limited to the entry-point agent's user. Every agent within the credential scope was an affected party. Persistent memory also let that access affect later exchanges, so the harm could last beyond the first conversation.

Map tool bindings and downstream integrations before scoring this axis. Every writable system and connected agent is a potential affected party, while a shared memory store or message queue creates a path to every agent that reads from it. For enterprise copilots connected to email or document management systems, include every person whose data passes through those systems. The Five Eyes joint guidance issued May 1, 2026, by CISA, NSA, and counterparts in the UK, Canada, Australia, and New Zealand stressed that no single safeguard is sufficient. Its cross-boundary concern reinforces the scoring distinction, because the affected population follows a graph of dependencies.

Recalibrating Discoverability: when the attack surface is a public web page or an open dependency registry

Discoverability is usually high because many agent attack surfaces are public by design. Web pages, internet-exposed MCP endpoints, plugin registries, and public packages do not require an attacker to uncover private infrastructure. The Shai-Hulud variant that compromised the tensorlake npm SDK on October 8, 2026, delivered a malicious payload with valid npm provenance through a public package receiving approximately 12,000 downloads per week at the time of compromise. TrendAI State of AI Security also reports AI servers that are exposed to the internet and run outdated software.

Default to high Discoverability for agents that browse externally, call external APIs, install packages, or load registry plugins. Score internet-exposed MCP endpoints and supply-chain vectors through public registries or model repositories at maximum. Name the registry, class of endpoint, or browsing behavior, since calling the system internet-connected leaves those details out. A low score is defensible for an entirely private, air-gapped agent with no external tool calls or dependency updates. That exception rests on the deployment boundary.

Applying the recalibrated axes: a worked scoring workflow for agent vulnerability reports

A consistent workflow establishes agent context before assigning any number. The initial assessment identifies its tools and the most consequential action reachable through each, then establishes whether browsing, API access, package installation, or MCP endpoints make the surface public. Next, find where it sits in the pipeline and which agents and data stores are downstream of it. Establish whether natural-language input suffices and whether offensive AI can generate or iterate the payload. Finally, distinguish actual attack failures from varied LLM outputs.

Applied to the connected-data-store example, this sequence produces a defensible assessment without inventing a numeric score. Damage for the XSS finding follows the reachable exfiltration. Reproducibility depends on whether exfiltration succeeds across varying outputs, while Exploitability depends on the demonstrated input and skill requirements. Affected Users includes the people whose data passes through the connected system. Discoverability depends on the specific public surface established in the report.

The strongest objection is score inflation, because indiscriminate increases would erase the distinction between tool poisoning and a verbose error message. Recalibrating scores to fit the context avoids that result by requiring evidence for each axis on its own. Tool scope cannot by itself prove reliable exploitation, and public reachability cannot establish consequential Damage. The resulting Verified Change Record provides proof that the attack was demonstrated, the fix was minimal, and approved workflows still pass. That record makes the recalibrated DREAD score actionable evidence of the agent's actual risk.