# AgentProv

> Every agent breach is a chain-of-custody failure. AgentProv is the model that names the eight links, the data that shows which ones break, and the tools that check them.

AgentProv tags every incident in a public catalog of AI agent attacks against eight provenance layers. Each layer answers one question about where an agent action came from; an incident's primary layer is the one whose failure made it possible. Incidents where agent tooling was not the attack surface are counted outside the model, never dropped.

## The eight layers

- L1 Credential: Should this run hold this key at all?
- L2 Instruction: Who actually said "do this"?
- L3 Tool: Is this tool what its description claims?
- L4 Code / Package: Where did this code come from?
- L5 Config: Who wrote the file that runs on open?
- L6 Identity / Run: Which agent, run, or tenant is this?
- L7 Build / Approval: Was this approved as what it claims to be?
- L8 Output / Destination: Where is this data going, and who chose that?

## Headline numbers

- Incidents in the catalog: 385 (2024 through 2026-10-27), 325 in 2026.
- Tagged: 385; in-model: 270; outside the model: 115.
- Top primary layer: L6 Identity / Run, 38.1% of in-model incidents.

## Pages

- [The Model](https://agentprov.com/model): the eight layers, definitions, taxonomy patterns, and related work. Markdown: https://agentprov.com/model.md
- [Stats](https://agentprov.com/stats): every chart, each embeddable, with data tables.
- [Incidents](https://agentprov.com/incidents): all 385 incidents with their layer tags.
- [Methodology](https://agentprov.com/methodology): inclusion criteria and the tagging rules. Markdown: https://agentprov.com/methodology.md

## Data

- [incidents.csv](https://agentprov.com/data/incidents.csv): The parser output: one row per catalog incident.
- [incidents.json](https://agentprov.com/data/incidents.json): One object per incident with layer tags merged in.
- [tags.yaml](https://agentprov.com/data/tags.yaml): The hand-assigned layer tags, with a one-line reason per row.
- [stats.json](https://agentprov.com/data/stats.json): The aggregates behind every chart on the site.
- [Incident feed](https://agentprov.com/feed.xml): RSS, newest first.

## Optional

- [llms-full.txt](https://agentprov.com/llms-full.txt): the full model, methodology, and stats tables in one file.
- [Source catalog](https://github.com/webpro255/awesome-ai-agent-attacks)

## Citation

Grice, D. (2026). The AgentProv Provenance Model. https://agentprov.com/model