> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Categories and severity

> The risk categories, severities, and evidence levels the AI assessment uses, and how each category maps to ATT&CK, ATLAS, and OWASP.

The AI assessment assigns each risky call one primary category and up to two secondary categories. Each category belongs to one of six domains. The assessment also rates severity and evidence strength. Likely benign calls have no category or severity.

## Categories

A category describes the call's action and potential effects. [Investigate the call](/risk/overview#investigate-a-finding) to establish the agent's intent and whether the call succeeded.

| Domain                   | Category                                          | What to inspect                                                   |
| ------------------------ | ------------------------------------------------- | ----------------------------------------------------------------- |
| Code & software          | Dynamic or arbitrary code execution               | Code evaluated at runtime and the permissions it runs with        |
| Code & software          | External or untrusted payload execution           | Downloaded or untrusted content being run                         |
| Code & software          | Package or dependency change                      | Dependencies added, removed, or changed, and install scripts      |
| Code & software          | Shell escape                                      | A move from a restricted tool or interpreter into a shell         |
| Identity & access        | Credential or secret access                       | Which secret store or credential the call reads                   |
| Identity & access        | Privilege or permission change                    | Who gets new permissions, and over what                           |
| Identity & access        | Account or authentication change                  | Accounts created or removed, keys added, sign-in settings changed |
| Data                     | Sensitive data access                             | The data read and how much of it                                  |
| Data                     | Collection or staging                             | Data gathered or archived for later use or transfer               |
| Data                     | External or unauthorized transfer                 | The destination, the data, and whether the transfer fits the task |
| Data                     | Destructive or bulk modification                  | The records or files affected, and whether you can recover them   |
| System & service         | External service or resource change               | Changes to repositories, cloud resources, or service settings     |
| System & service         | System or service configuration change            | Settings that change how the endpoint or a service behaves        |
| System & service         | Persistence or startup change                     | Startup items or scheduled jobs that outlive the session          |
| System & service         | Security control or logging impairment            | Protection, monitoring, or logs turned off or cleared             |
| System & service         | Availability or resource disruption               | Services stopped or resources exhausted                           |
| Network & remote control | Network or service exposure                       | New listeners, open ports, or changed firewall rules              |
| Network & remote control | Remote shell, session, or tunnel                  | The remote host and the access the connection opens               |
| Discovery                | System, identity, service, or network enumeration | What the call lists, how widely, and why the task needs it        |

A permission change on a test resource shares a category with one on your production cloud account. Read the explanation and arguments to understand the scope.

## Severity

The assessment rates each call's potential impact as **Low**, **Medium**, **High**, or **Critical**. It rates the requested action, so a blocked call can still be critical.

## Evidence strength

The assessment rates evidence strength as weak, moderate, or strong. This measures how directly the command, arguments, and session context support its conclusion. Redacted values, truncated commands, and missing context weaken the evidence. High severity with weak evidence means the assessment could not confirm a potentially serious risk.

## ATT\&CK, ATLAS, and OWASP references

Each category maps to its closest entries in [MITRE ATT\&CK](https://attack.mitre.org/) Enterprise v19.2, [MITRE ATLAS](https://atlas.mitre.org/) v5.6.0, the [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), and the [OWASP Top 10 for LLM Applications 2025](https://genai.owasp.org/llm-top-10/). Kontext uses a fixed mapping for each category, checked on 22 September 2026. The AI assessment does not choose the mapping.

Each entry identifies the closest technique if the call were an attack. Many flagged calls perform legitimate work with broad effects, such as a force push. These calls may only loosely match an attack technique.

The **Risk** tab of the tool call drawer lists the entries for a finding's primary category under **Framework references**, each linked to the framework. [Slack risk alerts](/risk/alerts) include the first ATT\&CK, ATLAS, and OWASP agentic entry.

| Category                                          | ATT\&CK                                                   | ATLAS                                       | OWASP               |
| ------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------- | ------------------- |
| Dynamic or arbitrary code execution               | Execution: T1059, T1059.004, T1059.006                    | AML.T0050, AML.T0053                        | ASI05, LLM05        |
| External or untrusted payload execution           | Execution: T1105, T1204.002, T1059                        | AML.T0011.003, AML.T0011.000                | ASI05, ASI02, LLM05 |
| Package or dependency change                      | Initial Access: T1195.001                                 | AML.T0011.001, AML.T0011.002, AML.T0010.001 | ASI04, LLM03        |
| Shell escape                                      | Execution: T1059.004, T1611, T1548                        | AML.T0105, AML.T0050                        | ASI05, ASI02        |
| Credential or secret access                       | Credential Access: T1552.001, T1552.004, T1555.001, T1528 | AML.T0098, AML.T0083, AML.T0055             | ASI03, LLM02        |
| Privilege or permission change                    | Privilege Escalation: T1548.003, T1222.002, T1098.003     | AML.T0081                                   | ASI03               |
| Account or authentication change                  | Persistence: T1136, T1098.001, T1098.004, T1556, T1531    | AML.T0091.000                               | ASI03               |
| Sensitive data access                             | Collection: T1005, T1213.003, T1530                       | AML.T0037, AML.T0036, AML.T0085.001         | ASI02, LLM02        |
| Collection or staging                             | Collection: T1074.001, T1560, T1119                       | None. See note 1.                           | ASI02, LLM02        |
| External or unauthorized transfer                 | Exfiltration: T1567.001, T1567.002, T1048, T1537          | AML.T0086, AML.T0057, AML.T0025             | ASI02, LLM02        |
| Destructive or bulk modification                  | Impact: T1485, T1486, T1565.001, T1490                    | AML.T0101, AML.T0099                        | ASI02, ASI08        |
| External service or resource change               | Impact: T1578, T1651, T1565                               | None. See note 2.                           | ASI02, ASI08, LLM06 |
| System or service configuration change            | Persistence: T1543.001, T1543.004, T1484                  | AML.T0081                                   | ASI02, LLM06        |
| Persistence or startup change                     | Persistence: T1543.001, T1053.003, T1547.015, T1546.004   | AML.T0103                                   | ASI10, ASI02        |
| Security control or logging impairment            | Defense Evasion: T1685, T1685.006, T1686, T1070.003       | AML.T0097, AML.T0092                        | ASI10, ASI02        |
| Availability or resource disruption               | Impact: T1489, T1499, T1496, T1529                        | AML.T0029, AML.T0034.002                    | ASI08, LLM10        |
| Network or service exposure                       | Command and Control: T1133, T1686.001, T1571, T1090       | None. See note 3.                           | ASI02, ASI07        |
| Remote shell, session, or tunnel                  | Command and Control: T1219, T1219.001, T1572, T1021.004   | AML.T0072, AML.T0112.000                    | ASI02, ASI10        |
| System, identity, service, or network enumeration | Discovery: T1082, T1087, T1046, T1083, T1526              | AML.T0084.001, AML.T0075, AML.T0089         | ASI02               |

1. ATLAS has no staging technique. Kontext maps its collection techniques to sensitive data access.
2. These calls usually perform legitimate actions with broad effects, such as a force push or a cloud resource change. ATT\&CK matches only hostile changes.
3. ATLAS covers infrastructure an attacker owns. It has no technique for a victim exposing its own service.

Kontext uses these OWASP entries:

| ID    | Entry                                |
| ----- | ------------------------------------ |
| ASI01 | Agent Goal Hijack                    |
| ASI02 | Tool Misuse and Exploitation         |
| ASI03 | Identity and Privilege Abuse         |
| ASI04 | Agentic Supply Chain Vulnerabilities |
| ASI05 | Unexpected Code Execution (RCE)      |
| ASI07 | Insecure Inter-Agent Communication   |
| ASI08 | Cascading Failures                   |
| ASI10 | Rogue Agents                         |
| LLM01 | Prompt Injection                     |
| LLM02 | Sensitive Information Disclosure     |
| LLM03 | Supply Chain                         |
| LLM05 | Improper Output Handling             |
| LLM06 | Excessive Agency                     |
| LLM10 | Unbounded Consumption                |

### Cause references for Merlin flags

When [Merlin](/risk/detection#merlin) flags a call that does not fit the user's request, Kontext adds a **Cause · Merlin flag** row under **Framework references**. This row describes why the agent may have tried the call. The ATLAS references are AML.T0051.001 for indirect prompt injection and AML.T0051.002 for triggered prompt injection. The OWASP references are ASI01 and LLM01.