Evidence
Bank-World: financial agents, fees and payment authorization tests
Controlled financial-agent benchmark reporting fee overcharging and payment authorization mismatches with independent checks.
AI security research / sources
Evidence
Primary reports, advisories, papers and original records behind the Claims. Each record supports specific evidence rather than a whole Case by default.
846 Evidence · Page 1 of 29
30 matching records on this page
Published sources
Evidence
Chrome DevTools MCP: service worker origin and URL allowlist bypass
GitHub advisory for service worker routing through URL policy checks in the Chrome DevTools MCP integration.
Evidence
Cursor security notice on malicious Claude Code extension builds
Cursor first-party incident notice on two malicious extension releases and corrected download artifacts.
Evidence
InferD: credential-theft attempts against exposed model-tool honeypots
First-party paper on instrumented AI-serving and MCP honeypots and attempted credential extraction using encoded requests.
Evidence
LLMON: instruction and data channel separation by post-training
IBM Granite model post-training experiments distinguishing instruction-bearing and lower-trust data tokens.
Evidence
n8n Slack Trigger signature configuration and file retrieval advisory
Advisory on optional Slack signing secret verification and the resulting message/file retrieval boundary.
Evidence
Realm: scoped resources for tool-using agent injection defense
AgentDyn controlled tests of resource-scoping against indirect injection, with explicit legitimate-task regression.
Evidence
Role Grounding Attack: quoted dialogue contaminating agent preference memory
Original study of role laundering from quoted third-party dialogue into an agent’s apparent user-preference memory.
Evidence
Scan Before You Install: risks in public agent skills and combinations
Original study auditing public skills and examining security effects of composing otherwise ordinary-looking skills.
Evidence
SEAL: local sanitation before agent tool decisions
Experimental isolation of lower-trust content and prompt-injection resistance on AgentDojo tests.
Evidence
Socket: Cursor distribution and absent Open VSX publication records
Independent comparison of Open VSX append-only registry event history, npm metadata and Cursor marketplace incident confirmation.
Evidence
Sublime: hidden Unicode Tags instructions in invoice-fraud email
Observed invoice-fraud email with hidden Unicode Tag characters intended to redirect an AI email assistant.
Evidence
Tool-result role spoofing study using fake conversational delimiters
Research describing tool-output text that impersonates user or conversation roles and its measured effect on agent behavior.
Evidence
Where You Inject Matters: prompt-injection location and success
Controlled comparisons of identical prompt payloads placed in repository instructions, source code, or tool data.
Evidence
Agentic Process Evidence: process-aware logging for agent governance
JFrog paper proposing signed process attestations that link agent sessions, model/tool/harness identity, approvals, and created artifacts.
Evidence
Agno issue 8699: unrestricted PandasTools dispatch
Agno issue documenting model-selected pandas function dispatch and the read_pickle deserialization risk.
Evidence
Amazon engineering token-usage ranking and subsequent internal memo
Report on internal token-use incentives and management reminder that AI usage does not define engineering output.
Evidence
Check Point: independent replay of Cohere Qwen outbound-request claim
Independent replay of sixty-four Qwen continuations testing whether a blocked outbound call had a stable attacker destination.
Evidence
Cisco Talos: NIK C2 framework using an infected host as an AI API client
Talos report on AI API access in command-and-control and separate coercive modules in the same malware tooling.
Evidence
Conditional agent backdoor survives clean post-training
Paper testing conditional agent misbehavior after small pretraining poisoning and subsequent clean supervised or preference training.
Evidence
CrowdStrike: VAPOR PANDA used ARTEX in multi-target intrusion campaign
CrowdStrike telemetry of an operator-controlled ARTEX campaign, with distinct target versus verified post-exploitation populations.
Evidence
EMBRACE: embedded AI-assistant browser attack paths
Forever Security reports local-file exposure, privileged browser bridge message spoofing and an origin display spoof across several desktop assistants; conditions differ by product.
Evidence
Epoch AI: open-weight models and the Firefox patch gap
Epoch study of GLM-5.3 assisted chain construction from a pending Firefox renderer patch and a separately discovered file-protection bypass, in controlled versions.
Evidence
GitHub repository: hidden prompt injection census of issues, PRs, and READMEs
Open research artifact indexing hidden injection messages in GitHub content and noting false positives and attack-attempt denominators.
Evidence
Microsoft Threat Intelligence: AI use across North Korean threat actor tradecraft
Microsoft analysis of distinct North Korean activity clusters, tool adoption, counterfeit recruiting, and limitations of observed AI involvement.
Evidence
NVIDIA NeMo Agent Toolkit 2026 security bulletin 5912
NVIDIA first-party bulletin covering separate missing-authentication and SQL-injection vulnerabilities in toolkit versions.
Evidence
OpenAI: how we detect frontier model misalignment
OpenAI October 29 first-party description of L0-L3 agent monitoring and the distinctions between detection, investigation, paging and interruption.
Evidence
Pluto: Load/Mine malicious Hugging Face model repositories
Original analysis of the Load/Mine campaign, executable model configuration, mining infrastructure and privileged GPUStack variant.
Evidence
PraisonAI GHSA-26mh-57q7-jfvr: broken workflow AST sandbox
Reviewed GitHub advisory for CVE-2026-61438 and affected workflow sandbox configuration, including alias disagreement elsewhere.
Evidence
Priors: identity bond excluded from agent session spending cap
Priors advisory for on-chain identity bond payments not charged against the session spending-control counter.
No matches on this page.