Lineaje analyzed 26 real-world AI attacks, mapping each across its 10-stage AI Kill Chain. The findings reveal a striking concentration around two critical stages:
Different attacks. Different techniques. Different targets. But a recurring pattern emerges where AI reasoning and the ability to act intersect.
The critical question isn't just whether an AI agent can be manipulated. It's whether that manipulation can become an authorized action.
An AI agent doesn't need to execute malicious code to create risk.
It can encounter attacker-controlled content in a document, webpage, repository, tool response, or external system. That content can influence how the agent interprets its task, what it decides to do next, and which tools it invokes.
The danger escalates when manipulated reasoning crosses into execution.
Consider the distinction:
The attack doesn't necessarily require a compromised tool. The tool may be functioning exactly as designed.
The problem is who—or what—is directing its use.
This is where Lineaje moves from threat intelligence to enforceable security. UnifAI inserts Autonomous Intercepts into AI workflows at build time, establishing policy enforcement points across model calls, MCP interactions, and tool invocations.
At runtime, these intercepts connect to the UnifAI Guardrail Server, which evaluates interactions against active security and governance policies before execution continues. Depending on the policy, UnifAI can allow, block, require human approval, redact sensitive data, or restrict tool and model access.
The goal isn't simply to recognize a malicious instruction. It's to prevent that instruction from becoming an unauthorized action.
The overlap between reasoning-time execution and tool exploitation is particularly revealing. Across the 26 attacks, at least 22 involved both stages. This doesn't mean every attack followed an identical sequence, or that a single control could have stopped them all.
It does, however, identify a recurring security challenge: AI agents can turn untrusted information into decisions and actions using legitimate enterprise capabilities. Traditional security controls may verify that a tool is authorized, a user is authenticated, or an application is functioning correctly. But authorization alone doesn't establish that an agent's intended action is safe.
An agent might have permission to read a customer record, access a repository, send a message, or execute a workflow. The security question is whether that specific action, in that specific context, should be allowed. That's where interception becomes essential.
An effective defense needs more than visibility into what an agent did after the fact. It needs enforceable boundaries throughout the AI Kill Chain, particularly when reasoning leads to tool use or other consequential actions.
That means:
The most effective interception doesn't begin when an attack is detected. It begins when the agent is built. UnifAI brings build-time security and runtime enforcement together.
At build time, UnifAI discovers AI assets, derives applicable security policies, and inserts Autonomous Intercepts into agent workflows.
At runtime, the UnifAI Guardrail Server evaluates agent interactions and enforces those policies before actions proceed.
Together, they establish security boundaries across the AI Kill Chain, helping organizations prevent manipulated reasoning from becoming unauthorized execution.
Because detecting the wrong play isn't enough. You need the ability to stop it.
Source: Javed Hasan, Co-founder and CEO, Lineaje, 26 AI Attacks Later: Are Your AI Agents Secure?. Analysis based on 26 Lineaje AI Threat Analysis Reports (April 27–October 8, 2026). The 22-of-26 overlap is a mathematically derived minimum from the stage totals and should be validated against the individual attack mappings.
