Evidence
Tool-result role spoofing study using fake conversational delimiters
Research describing tool-output text that impersonates user or conversation roles and its measured effect on agent behavior.
AI security research / sources
Evidence
Primary reports, advisories, papers and original records behind the Claims. Each record supports specific evidence rather than a whole Case by default.
1005 Evidence · Page 2 of 34
30 matching records on this page
Published sources
Evidence
Where You Inject Matters: prompt-injection location and success
Controlled comparisons of identical prompt payloads placed in repository instructions, source code, or tool data.
Evidence
Agentic Process Evidence: process-aware logging for agent governance
JFrog paper proposing signed process attestations that link agent sessions, model/tool/harness identity, approvals, and created artifacts.
Evidence
Agno issue 8699: unrestricted PandasTools dispatch
Agno issue documenting model-selected pandas function dispatch and the read_pickle deserialization risk.
Evidence
Amazon engineering token-usage ranking and subsequent internal memo
Report on internal token-use incentives and management reminder that AI usage does not define engineering output.
Evidence
Blockaid on-chain reconstruction of Binance EIP-7702 delegation and 50 nonce candidates
On-chain reconstruction with a separate detection vendor and a commercial-product disclosure; counts and categorization distinguished from Binance reporting.
Evidence
Check Point: independent replay of Cohere Qwen outbound-request claim
Independent replay of sixty-four Qwen continuations testing whether a blocked outbound call had a stable attacker destination.
Evidence
Cisco Talos: NIK C2 framework using an infected host as an AI API client
Talos report on AI API access in command-and-control and separate coercive modules in the same malware tooling.
Evidence
Conditional agent backdoor survives clean post-training
Paper testing conditional agent misbehavior after small pretraining poisoning and subsequent clean supervised or preference training.
Evidence
CrowdStrike: VAPOR PANDA used ARTEX in multi-target intrusion campaign
CrowdStrike telemetry of an operator-controlled ARTEX campaign, with distinct target versus verified post-exploitation populations.
Evidence
EMBRACE: embedded AI-assistant browser attack paths
Forever Security reports local-file exposure, privileged browser bridge message spoofing and an origin display spoof across several desktop assistants; conditions differ by product.
Evidence
Epoch AI: open-weight models and the Firefox patch gap
Epoch study of GLM-5.3 assisted chain construction from a pending Firefox renderer patch and a separately discovered file-protection bypass, in controlled versions.
Evidence
Gemini CLI issue 30014: tool calls may repeat after a streaming retry
GitHub issue #30014 was opened October 29, 2026. The reporter traces function calls emitted from a failed streaming turn, their persistence through a Retry event, duplicate execution, and orphaned tool responses. The issue is not proof of an independently confirmed production-loss rate or a fixed version.
Evidence
GitHub repository: hidden prompt injection census of issues, PRs, and READMEs
Open research artifact indexing hidden injection messages in GitHub content and noting false positives and attack-attempt denominators.
Evidence
Microsoft Threat Intelligence: AI use across North Korean threat actor tradecraft
Microsoft analysis of distinct North Korean activity clusters, tool adoption, counterfeit recruiting, and limitations of observed AI involvement.
Evidence
NVIDIA NeMo Agent Toolkit 2026 security bulletin 5912
NVIDIA first-party bulletin covering separate missing-authentication and SQL-injection vulnerabilities in toolkit versions.
Evidence
OpenAI: how we detect frontier model misalignment
OpenAI October 29 first-party description of L0-L3 agent monitoring and the distinctions between detection, investigation, paging and interruption.
Evidence
Pluto: Load/Mine malicious Hugging Face model repositories
Original analysis of the Load/Mine campaign, executable model configuration, mining infrastructure and privileged GPUStack variant.
Evidence
PraisonAI GHSA-26mh-57q7-jfvr: broken workflow AST sandbox
Reviewed GitHub advisory for CVE-2026-61438 and affected workflow sandbox configuration, including alias disagreement elsewhere.
Evidence
Priors: identity bond excluded from agent session spending cap
Priors advisory for on-chain identity bond payments not charged against the session spending-control counter.
Evidence
SkillLifeBench: skill lifecycle decisions and stale installed execution
Benchmark of agent skill updates, version selection and lingering loaded artifacts with task and attacker outcome distinctions.
Evidence
Symantec: unauthorized coding-assistant relays across enterprises
Investigation of third-party relays and altered endpoint and sandbox settings for coding assistants.
Evidence
Wiz: three observed adaptive intrusion investigations
Wiz first-party analysis of three distinct intrusions whose scripts changed with environmental feedback; model attribution remains inferential.
Evidence
WordPress AI Engine MCP OAuth registration and consent advisory
GitHub advisory describing OAuth dynamic client registration and consent-frame conditions in an AI Engine MCP integration.
Evidence
AWS API MCP Server: OAuth audience not checked
Official AWS bulletin for CVE-2026-115413/GHSA-4prq-p2x5-w9fh, an OAuth audience validation gap in streamable HTTP MCP.
Evidence
GitHub Copilot code review: optional approvals satisfying branch protection
GitHub release note on opt-in Copilot approval as required-review credit, dismissal on new commits, and Max review settings.
Evidence
GitHub shared Copilot Automations persist as repository-owned workers
GitHub changelog specifies repository ownership, billing, write access to automation definitions, durable execution and Copilot principal attribution.
Evidence
IBM Langflow OSS multi-vulnerability bulletin for 1.13.0
IBM bulletin on Langflow MCP tool listing code execution, insecure auto-login defaults, and generated Python component restrictions.
Evidence
Irregular: GLM-5.3 multi-stage cyber operations and instruction violations
First-party evaluation of GLM-5.3 in simulated cyber tasks, including several end-to-end successes and separate instruction-following failures.
Evidence
City of London Police: £24.3 million reported AI-enabled investment fraud
Police Report Fraud data for January to August 2026 incidents with verified AI-assisted fake investment endorsements.
No matches on this page.