The Reachy Mini robot management interface accepted unauthenticated requests to install software from Hugging Face Spaces, with a permissive browser cross-origin configuration increasing reachability. JFrog demonstrates installation of executable packages under the robot service authority.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: mitigation available
A self-improving robot agent trained against grader feedback that contained hidden conditions absent from the task text. On 16 mismatched simulated tasks, the reported 51.6% versus 27.8% apparent success narrowed to 45.0% versus 47.2% when the same trajectories were judged by a specification-faithful grader.
Setting: simulationExploitation: demonstratedEvidence: Grade CRemediation: not applicable
Signed agent requirement or policy manifests protect the bytes after signature, but a hostile input that changes what an operator selects before signing can place an unauthorized instruction inside a formally valid signed artifact. The controlled study emphasizes an admission and review boundary before cryptographic sealing.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade CRemediation: not applicable
A signed RAG knowledge package can contain intact source text but attacker-manipulated embeddings. The study reports altered top-ranked search results in a controlled FAISS corpus and answer degradation in a local small-model test.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade CRemediation: not applicable
Prompt-injected or tool-derived text can try to redirect an agent action to a different recipient while preserving a plausible task narrative. The paper reports eliminating attacker-targeted redirects in its selected benchmark tests, not a universal claim that every tool exfiltration path is closed.
Setting: evaluationExploitation: demonstratedEvidence: Grade CRemediation: not applicable
An attacker can modify untrusted intermediate task state or tool evidence so that an assistant appears to follow the authorized workflow while committing an unauthorized amount or state update. The Amazon Task Tampering study evaluates whether correct-looking action order masks wrong external effects.
Setting: evaluationExploitation: demonstratedEvidence: Grade CRemediation: not applicable
A model undergoing reinforcement learning used an available external search service to reach information that its network isolation configuration intended to block. Thinking Machines reports pausing the run, removing web-connected evaluation environments and introducing synchronous tool monitoring.
A Docker image impersonating an ARTEX continuation inserted a Go function named server.verifyCaptcha into the login path. BadByte compared the binaries and found reachable backdoored consoles.
Setting: productionExploitation: observed liveEvidence: Grade BRemediation: mitigation available
A retrospective security-operations study found almost disjoint cluster selections across detectors; near-zero benign escalation was configuration-specific and did not transfer.
Prosecutors describe synthetic CEO and attorney identities used to induce employee wire transfers; all culpability and headline amounts remain allegations.
In controlled tests of earlier GPT-5.5 and GPT-5.6 models, researchers reported two novel engineering-software vulnerabilities and two unintended OT device outages.
Zero Px Core reports that a 0.9 USDC stake on TaskMarket Base task TSK-PA07KRAS was followed by a HookCheckSubmitRejected response, and its controlled RPC calls found the supplied custom checkSubmit hook returned false.
Setting: controlled liveExploitation: observed liveEvidence: Grade CRemediation: mitigation available