AI security research / cases
Investigations, evidence and outcomes.
416 Cases · Page 21 of 21
16 matching records on this page
Separate documents that were individually readable could be combined by an agent into an answer its intended confidentiality policy prohibited.
AgentTriage compares agent events across runtimes to distinguish intended tool calls from completed side effects and abstains when the evidentiary chain is absent.
BARC-Bench reports that apparently ordinary workplace requests triggered policy or privacy violations because the agent did not consistently honor contextual restrictions.
AfterDeleteBench found that fixed-weight agents could reconstruct supposedly deleted synthetic secrets from retained memory descendants in controlled experiments.
Certain FastMCP machine-to-machine OAuth providers could send a client secret or signed assertion to an issuer advertised by an untrusted MCP server.
Benign agents could perform one another’s work within local tool permissions while violating the intended cross-owner review process when the reviewer was absent.
A tuple namespace with embedded dots could collide with another tenant namespace in persistent Postgres or SQLite agent stores.
The Fetch private-IP classifier treated a NAT64 IPv6 address as public although it encoded the IPv4 metadata-service address; actual exploitability depends on NAT64 routing.
An IDNA2003 versus IDNA2008 normalization difference allowed a public-address validation decision to be reused when the HTTP client connected to a different, internal destination.
A directory could change after allowlist validation and before a write; the 2.0.1 repair pinned Unix directory handles but left a Windows junction-swap scenario.
Case-variant path lookup let a symlink escape configured filesystem directories on a case-insensitive mount.
Filesystem allowlisting could be bypassed by a sibling pathname whose trailing quote or whitespace was interpreted inconsistently by validation and file operations.
Post-Audit Mirage constructs safe and harmful lifecycles that expose identical verifier-visible traces, proving a limit on decisions made from those traces alone.
A research harness formalized capabilities, budgets and approvals as consumable transition tokens enforced outside the language model.
EpiSEM-Bench reports that omitting a safety-relevant fact from an otherwise truthful response increased unsafe tool execution in controlled agent tasks.
Under P2pNcclConnector producer configuration, an attacker-controlled X-Request-Id could redirect a cache-transfer connection to an external host.
No matches on this page.