Standards, risks and languages
This page lists what AI Agent Lens covers. The standards and threat areas come from the control map the product ships with, so they are exactly what your Posture and Compliance pages use. Generated from control map v11.0.1 (13762c23bfa4).
A listed standard, threat area or language means we have rules and mappings for it. It does not mean every instance is caught: rules are tuned for precision, and the limits are stated below.
Compliance standards
Each AgentShield decision and Comply finding carries a threat category, and the control map maps that category to controls in these standards. How it fits together shows one end to end.
| Standard | Version | Controls | Threat categories mapped |
|---|---|---|---|
| EU AI Act 2024 (AI-Relevant Articles) | 2024 | 8 | 1,011 |
| ISO/IEC 27001:2022 Annex A (AI-Relevant Controls) | 2022 | 21 | 1,018 |
| ISO/IEC 42001:2023 Annex A (AI Management System — AI Agent Runtime Controls) | 2023 | 41 | 932 |
| MITRE ATLAS v2.0 — Adversarial Threat Landscape for AI Systems | 2.0 | 83 | 677 |
| OWASP Agentic AI - Threats and Mitigations | 1.0 (February 2025) | 15 | 306 |
| OWASP Top 10 for Agentic Applications 2026 | 2026 (first release, 2025-12-09) | 10 | 324 |
| OWASP Top 10 for LLM Applications 2026 | 2026 | 10 | 1,016 |
| SOC 2 Type II Trust Service Criteria (AI-Relevant) | 2017-rev2022 | 13 | 1,017 |
We map the AI-relevant controls of each standard, the ones agent activity can evidence, not the whole standard. GDPR and HIPAA are also shown on the Posture page, through a fixed table of rules rather than the control map.
Threat areas
9 threat areas, 142 groups and 1,026 threat categories. AgentShield checks for them in what agents do; Comply checks for them in your code and configuration.
| Threat area | Groups | Threat categories |
|---|---|---|
| Unauthorized Code Execution | 10 | 291 |
| Credential & Secret Exposure | 43 | 195 |
| Data Exfiltration | 15 | 109 |
| Supply Chain Compromise | 15 | 106 |
| Persistence & Defense Evasion | 22 | 93 |
| Privilege Escalation | 15 | 82 |
| Reconnaissance & Discovery | 11 | 55 |
| Governance Risk | 2 | 50 |
| Destructive Operations | 9 | 45 |
Expand a threat area to see its groups:
Unauthorized Code Execution (10 groups)
- AI Content Integrity
- AI Model Usage
- AI Resource Abuse
- Agent Capability Abuse
- Agentic Attack Surface
- Dynamic Library Injection
- Interpreter Encoding Evasion
- LOLBin / Living-Off-the-Land Binary Execution
- Remote Code Execution
- Shell Built-in Abuse for Code Injection
Credential & Secret Exposure (43 groups)
- AI API Credentials
- API Key Access
- API Keys
- Build Tool Secrets
- Clipboard
- Cloud Credentials
- Cloud Instance Metadata Service (IMDS)
- Code Generation Exposure
- Command History Access
- Config File Access
- Container Configuration
- Credential Config Redirection
- Credential File Access via Symlink
- Credential File Access via URI Scheme
- Credential Store
- Cryptocurrency Wallets & Keys
- Cryptographic Keys
- Database Access
- Database Credentials
- Developer SaaS Credential Theft
- Environment Variable Exposure
- History Mining
- Infrastructure-as-Code Secrets
- Input Capture & Keylogging
- Local Artifact & Cache Exposure
- Local File Protocol Abuse
- MFA Bypass
- OAuth Tokens
- Package Registry Credentials
- Password Database Access
- Password Manager
- Personal Notes & Productivity App Data
- Private Key Access
- Process Credential Access
- Retrieval Corpus Exposure
- SCM Tool Credential Files
- Secret Environment Exposure
- Secrets Management
- Session Token Theft
- Shell Abuse for Credential Capture
- Shell History Database Access
- Specialized Credential Access
- Version Control
Data Exfiltration (15 groups)
- AI Data Flows
- Covert Channel Exfiltration
- Cross-Server Context Leak
- Encoded Exfiltration
- Encoded Network Exfiltration
- File Archiving for Exfiltration
- Inference Side-Channel
- LLM Data Flow
- Network Egress
- Network Exfiltration via Config Tampering
- Public Data Publication
- Steganographic Data Hiding
- System Log Extraction
- Terminal Escape Sequence Abuse
- Version Control Egress
Supply Chain Compromise (15 groups)
- Artifact Integrity Subversion
- Artifact Poisoning via Cloud Storage
- Build Pipeline
- Build System Command Injection
- CI/CD Pipeline Poisoning
- CI/CD Pipeline Tampering
- Code Injection via Agent-Written Code
- Config Tampering
- Dependency Confusion
- IDE Extension Supply Chain
- Model Poisoning
- Package Install
- Package Publish
- Path Hijacking
- Typosquatting & Impersonation
Persistence & Defense Evasion (22 groups)
- Agent Configuration Persistence
- Anti-Forensics
- Binary Rewriting
- CI/CD Pipeline Tampering
- Covert Communication Channels
- Cron Job Persistence
- Database Backdoor
- Defense Evasion
- Event Triggered Execution
- Fileless Execution
- Git Configuration Code Execution
- LD_PRELOAD Hijacking
- Lateral Movement
- Log Tampering
- Scheduled Tasks
- Service Management
- Shell Configuration Tampering
- Shell Hooks and Keyboard Binding Abuse
- Shell Initialization Hijacking
- Shell Startup Backdoor
- Shell Variable & Environment Abuse
- Transient Systemd Persistence
Privilege Escalation (15 groups)
- Agent Containment Bypass
- Authentication Tampering
- Cloud Privilege Escalation
- Command Execution
- Container Escape
- D-Bus Privilege Escalation
- File Permissions
- Filesystem Permission Bypass
- Kernel Exploit & Low-Level Escalation
- Kernel Memory Access
- Mount Abuse
- OAuth Access Escalation
- Shared Library Hijacking
- Terminal Session Hijacking
- Windows Privilege Escalation
Reconnaissance & Discovery (11 groups)
- Credential Discovery
- Database Enumeration
- Environment Discovery
- Filesystem Reconnaissance
- Filesystem Surveillance
- LLM Introspection
- Network Discovery
- OSINT & Passive Enumeration
- System Discovery
- System Enumeration
- Web Application Reconnaissance
Governance Risk (2 groups)
- AI Governance Gap
- Human Oversight Failure
Destructive Operations (9 groups)
- Cloud Infrastructure Destruction
- Database Destruction
- Disk & Partition Operations
- Filesystem Destruction
- Permission Weakening
- Resource Exhaustion
- System Management
- Uncontrolled Resource Commitment
- Version Control Destruction
Agents AgentShield works with
Claude Code, GitHub Copilot CLI, OpenAI Codex CLI, Gemini CLI, Cursor, Windsurf, OpenClaw, and MCP clients such as Claude Desktop through the MCP proxy. What each agent's hook lets AgentShield see differs; see the coverage table.
Languages Comply scans
5,574 rules in all.
| Language | Rules |
|---|---|
| Python | 2,367 |
| TypeScript | 1,728 |
| JavaScript | 1,682 |
| Go | 855 |
| Generic | 275 |
| Java | 210 |
| C# | 163 |
| Ruby | 159 |
| JSON | 33 |
| Rust | 14 |
| HCL | 13 |
| YAML | 9 |
| Bash | 2 |
"Generic" rules match text patterns in any file type.
AI SDKs and frameworks Comply recognises
226 SDK and framework packages, in Python, JavaScript and TypeScript, Go, Java, C#, Ruby and Rust, as of 2026-10-13. They feed the AI bill of materials, and the risky-code rules know their APIs. Among them:
- Model providers and APIs: OpenAI, Anthropic, Google Gen AI and Gemini, Vertex AI, Azure OpenAI, Amazon Bedrock, Mistral, Cohere, Groq, DeepSeek, xAI, Together AI, Fireworks, Perplexity, Replicate, Hugging Face, IBM watsonx, Alibaba DashScope, Zhipu AI, Moonshot, Baidu Qianfan, Cerebras, SambaNova, AI21, Voyage AI, Jina, LiteLLM.
- Agent frameworks: LangChain, LangChain4j and LangChainGo, LangGraph, LlamaIndex, CrewAI, AutoGen, Semantic Kernel, OpenAI Agents SDK, Google ADK, Pydantic AI, smolagents, DSPy, Haystack, Agno, Mastra, Vercel AI SDK, Strands, Letta, CAMEL, MetaGPT, PraisonAI, Atomic Agents, Griptape, Spring AI, Microsoft.Extensions.AI, Azure AI Agents, Llama Stack, Browser Use, Open Interpreter, ElizaOS, VoltAgent.
- MCP and tool platforms: MCP SDK, FastMCP, fast-agent, Composio, E2B, Firecrawl, Stagehand, Modal.
- Vector stores: Chroma, Pinecone, Qdrant, Weaviate, Milvus, FAISS, LanceDB.
- Observability, evaluation and guardrails: LangSmith, Langfuse, Helicone, Arize Phoenix, Braintrust, Weights & Biases, MLflow, Opik, Ragas, DeepEval, TruLens, PromptLayer, Traceloop, OpenLIT, Guardrails AI, NeMo Guardrails, LLM Guard, Presidio.
- Local and self-hosted inference: Ollama, llama.cpp, vLLM, SGLang, LM Studio, MLX, Transformers, ExLlamaV2.
Agent configuration Comply reads
22 configuration formats, as of 2026-10-13:
- MCP server configuration (
.mcp.json, Cursor, Claude Desktop and similar) - Claude Code agents, settings and hooks
CLAUDE.mdAGENTS.md- Agent skills (
SKILL.md) and the scripts they bundle - Plugin manifests
- GitHub Copilot agents and instructions
- Cursor rules and hooks
- Cline rules
- Devin rules
- Junie rules
- Kiro agents
- Amazon Q agents
- Roo modes
- Aider configuration
- CrewAI agent definitions
- LangGraph configuration
- Amazon Bedrock agents (CloudFormation)
What these lists mean
- Rules exist; coverage is not total. A threat area with many categories is not caught in every form. A rule written for one idiom can miss the same bug written another way, and we measure that rather than assume it away.
- Precision first. Comply's actionable findings are tuned so that a finding is worth acting on, at the cost of some misses.
- Mappings are our claim, not an auditor's verdict. Each one carries a written rationale; your auditor decides what they accept.