AG09 describes vulnerabilities that arise because humans and AI agents exist in a trust relationship, and that relationship can be exploited. The attack surface is the gap between how much trust a human places in an agent's output and how much trust that output warrants in a specific situation.

AG09 applies when:

• An attacker crafts their approach to receive a favorable AI verdict, then relies on human deference to that verdict to avoid manual scrutiny.
• An attacker uses an agent as a relay to deliver social engineering content to a human with the agent's credibility attached.
• An agent's design creates miscalibrated trust (over-trust or under-trust) that impairs the human's ability to provide effective oversight.
• Urgency framing, false confidence, or alert fatigue from an agent suppresses human deliberation at critical decision points.

Not: The agent making an error independently of human trust. If an agent produces a wrong answer and no human is involved in the decision, that is an agent quality or reliability problem — not an AG09 trust exploitation scenario. AG09 requires the human's miscalibrated trust to be part of the harm mechanism.

Not: General AI safety concerns about misalignment. AG09 is about the human-agent interaction as an attack surface in a security context. It is not about the broad question of whether AI systems have misaligned goals.

Not: The initial manipulation of the agent's output. How an attacker causes the agent to produce a favorable verdict (prompt injection, training data poisoning) is covered elsewhere. AG09 begins at the moment when the agent's output reaches a human who will act on it.

Not: All automation bias occurrences. Automation bias is a cognitive phenomenon that exists across all automated systems. AG09 is specifically about automation bias and related dynamics being deliberately exploited as a security attack vector, or being present as a structural vulnerability in an agentic system design.