The adversary controls lower-trust text within a disk image or forensic artifact. An LLM assistant encounters it through an authorized forensic MCP tool and may then change its classification, write an integrity report or request unrelated network activity. The paper demonstrates a forged artifact note changing the assistant’s answer in a controlled…
Inspect the ClaimsCase · DiggingBeagle record
Forensic evidence notes could steer an AI investigator’s conclusion and tool use
A controlled digital-forensics study embeds instructions in examined evidence and observes the assistant treating them as investigative authority.
Scope
The study is a laboratory proof of concept, not evidence that a real investigation was falsified or that the tool sandbox was escaped.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The authors embed attack instructions in forensic evidence fed through an Autopsy MCP setup and observe answer contamination or already-authorized file/network tool effects. The lab does not show altered real-world evidence custody or escaping the tool sandbox. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-014-A · CLM-CP22-014-B · Prompt Injection Through Forensic Evidence: Taxonomy and Proof of Concept
At a glance
Prevalence across other forensic tools and the effect of independently authenticated evidence annotations are untested.
Limits and uncertaintyFull account
The adversary controls lower-trust text within a disk image or forensic artifact. An LLM assistant encounters it through an authorized forensic MCP tool and may then change its classification, write an integrity report or request unrelated network activity.
The paper demonstrates a forged artifact note changing the assistant’s answer in a controlled rhino-versus-triceratops investigation. Additional test pathways include an altered report or integrity-file write and an outbound callback using already permitted MCP tools. Primary evidence.
The study is a laboratory proof of concept, not evidence that a real investigation was falsified or that the tool sandbox was escaped.
Treat acquired evidence as data; require signed case-integrity logs and authorize file mutation or network calls independently from instructions embedded in artifacts.
Claims & evidence
CLM-CP22-014-AThe paper demonstrates a forged artifact note changing the assistant’s answer in a controlled rhino-versus-triceratops investigation.supported
Basis: reported finding
- supportsPrompt Injection Through Forensic Evidence: Taxonomy and Proof of Conceptprimary disclosure
Section 6.2.1 Experiment 1: Persuasion; Appendix A.1
CLM-CP22-014-BAdditional test pathways include an altered report or integrity-file write and an outbound callback using already permitted MCP tools.supported
Basis: reported finding
- supportsPrompt Injection Through Forensic Evidence: Taxonomy and Proof of Conceptprimary disclosure
Section 6.2.2 and 6.2.3: Local disk writes and Network callback
Controls and mitigations
- Treat acquired evidence as data; require signed case-integrity logs and authorize file mutation or network calls independently from instructions embedded in artifacts.
Unknowns and contradictions
- Prevalence across other forensic tools and the effect of independently authenticated evidence annotations are untested.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199