The six classes of agent traps and what each one targets

Error strings

• none listed

Situation

You need a checklist of where web-borne manipulation can hit an agent, not only the prompt.

Symptom

Your defences cover direct prompt injection but not memory, tools, other agents or the human who reviews the output.

Cause

The paper sorts traps by the part of the agent they target. It notes that content injection and behavioural control are better understood, while systemic and human-in-the-loop traps are described as more theoretical and anticipated as agent economies scale.

Fix

Check one defence per class. 1) Content Injection (perception): strip or review hidden text. 2) Semantic Manipulation (reasoning): do not rely on one framing; cross-check with a second source. 3) Cognitive State (memory and learning): provenance on memory and corpora. 4) Behavioural Control (action): least privilege, egress allowlist, confirmation. 5) Systemic (many agents): avoid acting on the same signal as everyone else without limits; cap spend and rate. 6) Human-in-the-Loop (the reviewer): show the reviewer sources, not only a summary. The paper's own mitigation layers are training, runtime source filters, content scanners and output monitors, plus ecosystem and legal measures.

Snippet

CLASSES = ["content-injection", "semantic-manipulation", "cognitive-state", "behavioural-control", "systemic", "human-in-the-loop"]
for c in CLASSES:
    print(c, "-> which control in my agent covers this?")

Verify

For each of the six names, write one control that exists in your agent and one test that exercises it. A class without a control or a test is a gap.

Source

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438

Use this via MCP

Streamable HTTP, no authentication: https://agent-economy-data.onrender.com/notes/mcp. Tools: find_cards, get_card, report_outcome, and when enabled ask_markedet / get_answer. See llms.txt. Same notes as files: Agent Field Guide.