Evidence

Guidelight - Frontier AI control assessment

HaiND: mini-swe-agent Bubblewrap host-environment inheritance

Original technical report by Nguyen Dinh Hai on mini-swe-agent v2.4.6. Describes the missing --clearenv and --unshare-net settings, no subprocess env override, a synthetic-marker reproduction and its --clearenv negative control. Does not show real credential theft or an end-to-end injected agent run.

Nguyen Dinh Hai (HaiND)

HaiND: zotero-mcp generic webpage metadata SSRF

Original researcher description pinned to zotero-mcp v0.14.1 and commit 0faf1b25. The generic zotero_add_by_url metadata path uses requests.get without URL destination restrictions or redirect checks; writable Zotero backend and a model-selected URL are prerequisites. Researcher limits readback to recognized citation fields and distinguishes the earlier fixed OA-PDF sink.

Nguyen Dinh Hai (HaiND)

Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMs

How long do you store my data?

Anthropic's consumer Privacy Center says deleted conversations are removed from conversation history immediately and from back-end systems within 30 days in the ordinary case. If a prompt is flagged by trust-and-safety classifiers as violating the Usage Policy, Anthropic says it retains inputs and outputs for up to two years and trust-and-safety classification scores for up to seven years. The page also states that prompts and outputs may be retained longer where required by law or necessary to combat Usage Policy violations.

I would like to input sensitive data into my chats with Claude. Who can view my conversations?

Anthropic says employees cannot access conversations in consumer Claude accounts by default. The stated exceptions include user consent through feedback and review needed to enforce the Usage Policy. For policy enforcement, Anthropic says only designated Trust & Safety personnel may access conversation data on a need-to-know basis under access controls.

Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructions

JeecgBoot AI-RAG API reads other users Redis chat variables

Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-086. Specific chat variables, not automatically all Redis keys or conversation histories.

JeecgBoot AI-RAG queryById leaks other users system prompts and plugin bindings

Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-087. Config disclosure not proof underlying knowledge documents/credentials readable.

JFrog advisory JFSA-2026-001694382 on LMCache multiprocess pickle RCE

Ledger - Meet Cerberus AI security harness

Ledger Security Bulletin 023

Ledger Security Bulletin 025

Light Commands: Laser-Based Audio Injection Attacks on Voice-Controllable Systems

LLM output token choices become covert channel for stolen model weights

Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-097. Constructed lab threat, not documented production weight theft.

LobsterAI security report: untrusted _meta.json path controls skill uninstall

Lukas Weichselbaum on PageBreak and three illustrative bug chains

First-person statement from a PageBreak team member. Describes a separately obtained signature that allowed a javascript: URI in an admin-console workflow, cache poisoning on apis.google.com and universal XSS in Tag Assistant. Repeats the 500-plus XSS and hardened-framework subgroup figures. This is a team account, not independent reproduction.

Lukas Weichselbaum

Mandiant AI Risk and Resilience Report 2026 - Case study 1

Primary Google Cloud/Mandiant report documenting an intrusion at an unnamed SaaS provider in which an attacker hijacked an active AI coding-assistant session, introduced poisoned software through the assistant's recommendation path, harvested GitHub OAuth tokens and spread Shai-Hulud across about 100 internal repositories.

Microsoft MXC documentation: Windows-only learning-mode and permissive access semantics

Microsoft repository documentation consulted October 11, 2026. For Windows AppContainer-based process backends, learningModeLogging blocks and records ungranted access while permissiveLearningMode and --audit record and allow it, relaxing the MXC deny-by-default boundary. The documentation describes backend/host compatibility and reports; it does not establish equivalent reporting on Linux or macOS.

Microsoft / mxc repository

Microsoft MXC repository README: policy backends and audit-mode security warning

Microsoft-maintained MXC README consulted October 11, 2026. Describes OS-specific backends and explicitly warns that the --audit option disables sandbox security for the workload under inspection. This is a mutable main-branch document, not a pinned security certification or an exploit finding. An older cached early-preview caveat was not present in the current page and is not used as a current product verdict.

Microsoft / mxc repository

mini-swe-agent v2.4.6: BubblewrapEnvironment implementation

Pinned repository implementation inspected as text. BubblewrapEnvironmentConfig.wrapper_args uses read-only binds and --setenv PATH but does not include --clearenv or --unshare-net; execute runs subprocess.run without a supplied env mapping. The environment is marked experimental.

SWE-agent project

n8n Docs: Risks of community nodes

n8n documentation warning that npm community nodes are unverified code and can create host, data and workflow risk; the documentation also describes verified nodes and administrative controls for community packages.

NIST digital-signature standards and post-quantum alternatives

NIST account of distinct standardized signature families, including lattice-based ML-DSA and hash-based SLH-DSA; relevant to separating a hypothesized future attack from current standardization.

Noam Brown - Agent swarms, alignment, & recursive self-improvement

ObligationBench shows omissions can make agents unsafe despite no forbidden action

Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-096. Benchmark finding, not universal omission prevalence.

ODINI: Escaping Sensitive Data from Faraday-Caged, Air-Gapped Computers via Magnetic Fields

OpenAI - GPT-Red robustness research

OpenAI - model misalignment reporting framework and initial disclosures

OpenAI - Unrolling the Codex agent loop

OpenAI API developer quickstart

Official documentation of ordinary external Responses API usage, including API key creation and an Authorization: Bearer header on POST /v1/responses examples. It does not document, confirm or deny any alleged vulnerable internal endpoint.

OpenAI