Categories and severity

The AI assessment assigns each risky call one primary category and up to two secondary categories. Each category belongs to one of six domains. The assessment also rates severity and evidence strength. Likely benign calls have no category or severity.

Categories

A category describes the call’s action and potential effects. Investigate the call to establish the agent’s intent and whether the call succeeded.

Domain	Category	What to inspect
Code & software	Dynamic or arbitrary code execution	Code evaluated at runtime and the permissions it runs with
Code & software	External or untrusted payload execution	Downloaded or untrusted content being run
Code & software	Package or dependency change	Dependencies added, removed, or changed, and install scripts
Code & software	Shell escape	A move from a restricted tool or interpreter into a shell
Identity & access	Credential or secret access	Which secret store or credential the call reads
Identity & access	Privilege or permission change	Who gets new permissions, and over what
Identity & access	Account or authentication change	Accounts created or removed, keys added, sign-in settings changed
Data	Sensitive data access	The data read and how much of it
Data	Collection or staging	Data gathered or archived for later use or transfer
Data	External or unauthorized transfer	The destination, the data, and whether the transfer fits the task
Data	Destructive or bulk modification	The records or files affected, and whether you can recover them
System & service	External service or resource change	Changes to repositories, cloud resources, or service settings
System & service	System or service configuration change	Settings that change how the endpoint or a service behaves
System & service	Persistence or startup change	Startup items or scheduled jobs that outlive the session
System & service	Security control or logging impairment	Protection, monitoring, or logs turned off or cleared
System & service	Availability or resource disruption	Services stopped or resources exhausted
Network & remote control	Network or service exposure	New listeners, open ports, or changed firewall rules
Network & remote control	Remote shell, session, or tunnel	The remote host and the access the connection opens
Discovery	System, identity, service, or network enumeration	What the call lists, how widely, and why the task needs it

A permission change on a test resource shares a category with one on your production cloud account. Read the explanation and arguments to understand the scope.

Severity

The assessment rates each call’s potential impact as Low, Medium, High, or Critical. It rates the requested action, so a blocked call can still be critical.

Evidence strength

The assessment rates evidence strength as weak, moderate, or strong. This measures how directly the command, arguments, and session context support its conclusion. Redacted values, truncated commands, and missing context weaken the evidence. High severity with weak evidence means the assessment could not confirm a potentially serious risk.

ATT&CK, ATLAS, and OWASP references

Each category maps to its closest entries in MITRE ATT&CK Enterprise v20.1, MITRE ATLAS v2026.10, the OWASP Top 10 for Agentic Applications 2026, and the OWASP Top 10 for LLM Applications 2026. Kontext uses a fixed mapping for each category, checked against MITRE’s published data on 4 November 2026. The AI assessment does not choose the mapping. Each entry identifies the closest technique if the call were an attack. Many flagged calls perform legitimate work with broad effects, such as a force push. These calls may only loosely match an attack technique. In a finding’s drawer, the Risk panel lists every entry for its primary category, one per line with ID and name, each linked to the framework. The Coverage tab of the Risk page shows findings by framework entry, and the findings API takes a framework filter such as ASI03 or T1059. Slack risk alerts include the first entry of each framework.

Category	ATT&CK	ATLAS	OWASP
Dynamic or arbitrary code execution	Execution: T1059, T1059.004, T1059.006	AML.T0050, AML.T0053	ASI05, LLM10
External or untrusted payload execution	Execution: T1105, T1204.002, T1059	AML.T0011.003, AML.T0011.000	ASI05, ASI02, LLM10
Package or dependency change	Initial Access: T1195.001	AML.T0011.001, AML.T0011.002, AML.T0010.001	ASI04, LLM04
Shell escape	Execution: T1059.004, T1611, T1548	AML.T0105, AML.T0050	ASI05, ASI02
Credential or secret access	Credential Access: T1552.001, T1552.004, T1555.001, T1528	AML.T0098, AML.T0083, AML.T0055	ASI03, LLM02
Privilege or permission change	Privilege Escalation: T1548.003, T1222.002, T1098.003	AML.T0081	ASI03
Account or authentication change	Persistence: T1136, T1098.001, T1098.004, T1556, T1531	AML.T0091.000	ASI03
Sensitive data access	Collection: T1005, T1213.003, T1530	AML.T0037, AML.T0036, AML.T0085.001	ASI02, LLM02
Collection or staging	Collection: T1074.001, T1560, T1119	None. See note 1.	ASI02, LLM02
External or unauthorized transfer	Exfiltration: T1567.001, T1567.002, T1048, T1537, T1700	AML.T0086, AML.T0025	ASI02, LLM02
Destructive or bulk modification	Impact: T1485, T1486, T1565.001, T1490	AML.T0101, AML.T0099	ASI02, ASI08
External service or resource change	Impact: T1578, T1651, T1565	None. See note 2.	ASI02, ASI08, LLM03
System or service configuration change	Persistence: T1543.001, T1543.004, T1484	AML.T0081	ASI02, LLM03
Persistence or startup change	Persistence: T1543.001, T1053.003, T1547.015, T1546.004	AML.T0142, AML.T0103	ASI10, ASI02
Security control or logging impairment	Defense Impairment: T1685, T1685.006, T1686, T1070.003	AML.T0138, AML.T0097, AML.T0092	ASI10, ASI02
Availability or resource disruption	Impact: T1489, T1499, T1496, T1529	AML.T0029, AML.T0034.002	ASI08, LLM06
Network or service exposure	Command and Control: T1133, T1686.001, T1571, T1090	None. See note 3.	ASI02, ASI07
Remote shell, session, or tunnel	Command and Control: T1219, T1219.001, T1572, T1021.004	AML.T0072, AML.T0112.000	ASI02, ASI10
System, identity, service, or network enumeration	Discovery: T1082, T1087, T1046, T1083, T1526	AML.T0084.001, AML.T0075, AML.T0089	ASI02

ATLAS has no staging technique. Kontext maps its collection techniques to sensitive data access.
These calls usually perform legitimate actions with broad effects, such as a force push or a cloud resource change. ATT&CK matches only hostile changes.
ATLAS covers infrastructure an attacker owns. It has no technique for a victim exposing its own service.

Every OWASP entry is either mapped by a category or listed with the reason Kontext can’t see it:

ID	Entry	Kontext
ASI01	Agent Goal Hijack	Not mapped. Kontext sees what a call does, not why the agent made it.
ASI02	Tool Misuse and Exploitation	Mapped
ASI03	Identity and Privilege Abuse	Mapped
ASI04	Agentic Supply Chain Vulnerabilities	Mapped
ASI05	Unexpected Code Execution (RCE)	Mapped
ASI06	Memory & Context Poisoning	Not mapped. Agent memory is not inspected.
ASI07	Insecure Inter-Agent Communication	Mapped
ASI08	Cascading Failures	Mapped
ASI09	Human-Agent Trust Exploitation	Not mapped. It happens in the conversation, not in a tool call.
ASI10	Rogue Agents	Mapped
LLM01	Prompt Injection	Not mapped. Kontext sees what a call does, not why the agent made it.
LLM02	Sensitive Information Disclosure	Mapped
LLM03	Excessive Agency	Mapped
LLM04	Supply Chain	Mapped
LLM05	Data and Model Poisoning	Not mapped. Training and fine-tuning happen outside the endpoint.
LLM06	Unbounded Consumption	Mapped
LLM07	Misinformation	Not mapped. Answer quality is not assessed.
LLM08	Hidden Context Exposure	Not mapped. Model context is not inspected.
LLM09	Vector and Embedding Weaknesses	Not mapped. Retrieval stores are not inspected.
LLM10	Improper Output Handling	Mapped

EU AI Act, NIST, ISO, and SOC 2

These frameworks set obligations for an organization, not techniques for a single call, so Kontext maps them to what the product records and enforces. Each row is evidence you can use toward the obligation. It does not make a system compliant.

Kontext	EU AI Act	NIST	ISO/IEC	SOC 2
Tool call log with user, agent, and decision	Art. 12, Art. 26(6)	SP 800-53 AU-2, AU-12	27001 A.8.15, 42001 A.6.2.8	CC7.2
Risk findings and alerts	Art. 26(5)	SP 800-53 SI-4	27001 A.8.16	CC7.2, CC7.3
Policies in Enforce mode	Art. 14(4)(e)	AI RMF MANAGE 2.4, SP 800-53 AC-6, CM-7
Agent inventory		AI RMF GOVERN 1.6, SP 800-53 CM-8	27001 A.5.9

Most coding agents are not high-risk AI systems under Annex III of the EU AI Act. Articles 12, 14, and 26 apply in full to high-risk systems.

Get started

Understand Kontext

Activity

Policies

Risk

Cost

Deploy and operate

Reference

Categories and severity

Categories

Severity

Evidence strength

ATT&CK, ATLAS, and OWASP references

EU AI Act, NIST, ISO, and SOC 2

​Categories

​Severity

​Evidence strength

​ATT&CK, ATLAS, and OWASP references

​EU AI Act, NIST, ISO, and SOC 2

Categories

Severity

Evidence strength

ATT&CK, ATLAS, and OWASP references

EU AI Act, NIST, ISO, and SOC 2