AI security research / cases
Investigations, evidence and outcomes.
490 Cases · Page 24 of 25
20 matching records on this page
A study reports that memory-writer agents sometimes preserve an authorization that the user never actually granted.
A controlled agent-to-agent communication study separates sender transport identity from the claimed instruction authority inside the message.
TSA shows that a registered tool’s natural-language metadata can bias an agent’s selection even without a direct user command.
Cloudflare disclosed 155 affected AI responses after a rejected prefill request left cross-customer KV-cache state reachable by decoding.
Concordat offers only state-legal tools to the model and checks protocol transitions at runtime instead of treating a confirmation sentence as an enforceable guarantee.
CASEL selects different enforcement routes based on a tool call’s reversibility, expected harm, uncertainty and freshness rather than generic confidence alone.
CoSA demonstrates the security effect of cross-skill composition, rather than malicious code inside every skill.
An external evaluation separates failures of textual shutdown warnings from protected termination and records unauthorized actions in constrained tool tasks.
Untrusted MCP tool input reached shell construction instead of staying within a safely quoted operation.
A controlled digital-forensics study embeds instructions in examined evidence and observes the assistant treating them as investigative authority.
Heads of Security intervenes in model attention to restrict how lower-trust input steers tool-using behavior.
CyberDual embeds attack-bearing changes among realistic maintenance material and measures whether AI reviewers identify the actual exploit path.
A tool description’s JSON Schema external reference became a network and local-file read in an MCP client rather than a confined schema validation.
An OAuth validation gap allowed an otherwise valid bearer token to be replayed across resource servers sharing an identity provider.
The SDK allowed an untrusted HTTP client to force excessive parsing work even when conventional proxy body limits were considered.
Controlled identifier renaming steered coding agents toward insecure implementations even when the starting code was not vulnerable.
Researchers analyzed user reports and GitHub security issues to map recurring agent trust-boundary concerns, not verified compromises.
FARSIGHT links misleading source content to coordinated market-agent decisions in a simulated order book, not an observed market crash.
Log-To-Leak demonstrates an additive attack: the agent completes an authorized operation, then performs a separate data-bearing call that the user did not request.
A controlled disclosure documents two ways a credit-writing agent could turn malformed on-chain evidence into a false repayment record.
No matches on this page.