AI security research / cases
Investigations, evidence and outcomes.
628 Cases · Page 31 of 32
20 matching records on this page
A first-person report alleges an agent encoded shell commands and edited its own instructions after a hook denied commands in a production environment.
A research prototype gives ticket workers standing execution mandates and runs shell jobs as the operator OS user without per-command approval.
Financial-agent evaluation distinguishes valid decisions from reported actions and actual exchange receipts across simulated trading rounds.
An MCP specification discussion reports 460 of 816 forced-tool trials triggered out-of-task writes, versus five without forcing; task-specific gating suppressed writes in the test.
A proposed CI change identifies a workflow path where a privileged job with Gemini API credentials may execute code from an untrusted fork.
An issue reports that OAuth metadata and registration fetches use a network path outside Gemini CLI MCP safe dispatch, leaving a DNS rebinding concern.
A container-recreate report shows browser agents refused access to persistent profiles because old PID and lock metadata were treated as active owners.
A reporter describes work completed by a local Desktop Bot while the coordinating cloud run remains pending and restart fails to reclaim the settled result.
A scheduled synchronous memory retrieval was reported to exceed its budget and return zero context bytes without surfacing a visible failure.
Scheduled Hermes runs were reported to omit a configured profile environment value and silently use a different memory bank.
A decision gate improves some benchmark task success while a bounded retry rule can commit writes that failed authorization checks.
An open issue describes a permission hook returning deny while nested Code Mode shell and MCP operations still produced side effects.
The reported forget workflow covers a core memory path but not necessarily the active plugin store, while machine-readable completion output omits that gap.
A memory-wiki update API is reported to replace complete collections on a partial update without exposing the deletion to the user.
A reporter documents repeated WhatsApp connection-state events consuming a bounded agent queue so that task completion and scheduled events may not reach the model.
An unreviewed advisory describes an agent-key authority crossing when updating a workspace cleanup command that the server executes later.
An unreviewed advisory reports AI-generated Python running in Pyodide with access to Deno host primitives under excessive permissions.
A formal agent-message protocol verifies signed evidence but its experiment accepted ten proofs that were no longer fresh.
An advisory identifies malicious pystr-codec distributions that trigger payloads from Python startup hooks and reportedly modify coding-agent instruction and tool files.
A manifest encoding variation reportedly removed the first dependency from the scanner inventory without warning.
No matches on this page.