Agent Trust Boundary Violations: A New Vulnerability Class in AI Agent Infrastructure

We define Agent Trust Boundary Violation (ATBV) as a class of vulnerabilities in AI/ML agent infrastructure where the system treats data crossing a trust boundary — model outputs, tool results, serialized artifacts, or inter-agent messages — as trusted code or configuration, without validation proportional to the privilege of the operation performed. This class is distinct from prompt injection (which targets model reasoning) in that ATBV exploits the infrastructure layer connecting agents to execution environments, not the model itself. Based on empirical analysis of 62 distinct vulnerabilities discovered across 40+ AI/ML frameworks (2026), we propose a taxonomy of 6 sub-classes, demonstrate that existing CWE categories (CWE-94, CWE-502, CWE-918, CWE-306) capture individual instances but fail to express the shared trust-boundary pattern, and argue for a dedicated CWE node. The taxonomy is grounded in 62 confirmed, responsibly-disclosed vulnerabilities across frameworks with more than 200,000 combined GitHub stars. Keywords: AI security, agent infrastructure, trust boundary, vulnerability taxonomy, CWE, MCP, LLM agents.