AI security research / sources
Primary reports, advisories, papers and original records behind the Claims. Each record supports specific evidence rather than a whole Case by default.
1005 Evidence · Page 31 of 34
30 matching records on this page
SGLang team technical report on asynchronous RDMA cache-slot reuse following cancellation, with deterministic two-H200 reproduction and deferred-release patch. It separately describes Cloudflare rejection-path remediation.
Public minimal reproduction uses a configured dumper filter to execute Python in the inference scheduler process.
Reported cache identity confusion can cause image B to reuse prefix-cache entries belonging to image A in selected native request paths.
A signed RAG knowledge package can contain intact source text but attacker-manipulated embeddings. Numerical-tolerance checks between quantized vectors and full precision permitted materially different retrieval order. The study reports altered top-ranked search results in a controlled FAISS corpus and answer degradation in a local small-model test. A valid package signature did not prove the vectors matched the trusted embedding process. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Maintainer-published Web3 Software Engineering Lab dataset card describing more than 90,000 Ethereum and BSC contracts in a MySQL data dump, token intent labels, security-vulnerability labels, and label definitions. Fee, Reflection, Reward, Rebase and Mint encode token features or controls; their presence cannot alone establish fraud. ContractLens reports selecting a filtered, BSC-only 32,141-contract subset of an earlier smart-contract intent corpus. The card is evidence for label meanings and dataset availability, not an independent reproduction of ContractLens or validation of every annotation.
Reported evidence for An internal detector reported an unsafe agent process-termination operation while avoiding false alarms on authorized red-team sessions. Research intake: DB-RADAR-CP7-CP7A-043.
First-party investigation of attacker-workspace artifacts, scripts, model access and separate victim or demand assertions.
The Soei authors inspected 45 coding-agent sessions containing 102,233 events and 20,577 tool executions, reporting missing last-edit verification and missing intervening proof for many completed todos.
Systematization comparing claimed trading risk modules with source code in seven agent implementations.
Official documentation distinguishing public-key addresses backed by Ed25519 keypairs from program-derived addresses without corresponding private keys.
The public SolBehave repository provides benchmark code and reproduction guidance for Solidity function regeneration, fuzzing and replay. Statements about availability of the full experimental data should be checked against actual downloadable artifacts, as repository text may be inconsistent.
The SolBehave paper tests 250 reproducible Ethereum contracts and seven open-weight models using compilation, differential fuzzing, historical replay and DCR-guided synthetic sequences. The 31.4% rate is no detected divergence under bounded fuzzing, not a mathematical equivalence proof.
Sophos threat intelligence observes malicious Cursor agent workflows alongside ordinary human-supplied intruder access.
Primary Korean Financial Services Commission Oct 14 statement on 16 firms, ~100k records and checklist findings.
Reuters report on the AEPD notification, including the reported attack sequence, limited human intervention, unidentified organization and model, and the regulator's statement that the filing remained under review.
Prompt-injected or tool-derived text can try to redirect an agent action to a different recipient while preserving a plausible task narrative. SPILLWAY binds recipient selection to verified provenance instead of model prose. The paper reports eliminating attacker-targeted redirects in its selected benchmark tests, not a universal claim that every tool exfiltration path is closed. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Tool description spoofing experiments where attacker-modified metadata changes model tool selection. The study uses constructed benchmark registries; metadata registration is an attack prerequisite.
StepSecurity connects an automated package alert to human verification of a malicious SubQuery archive and release workflow, distinguishing artifact substitution from detector output.
Reported evidence for Microsoft attributes deceptive corporate identities and cloud tenants to the Storm-3119 ecosystem; campaign traffic is not a count of compromised organizations. Research intake: DB-RADAR-CP7-CP7A-001.
Official Strands Agents SDK security advisory CVE-2026-115419, A2A server shared conversation state across distinct users and context_id values; patched in Python 1.43.0 and TypeScript 1.5.0.
Maintainer advisory describing model-controlled masking false leading to host environment variable exposure.
Strands FileSessionManager advisory for world-writable default session storage and predictable symlink-following temporary files, potentially altering files and replayed memory; patched in 1.48.0.
Study of chemical-safety behavior under scientific agent harnesses
Signed agent requirement or policy manifests protect the bytes after signature, but a hostile input that changes what an operator selects before signing can place an unauthorized instruction inside a formally valid signed artifact. The controlled study emphasizes an admission and review boundary before cryptographic sealing. Signing itself cannot establish that the authorized human intended the content. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Study of steganographic prompt instructions across multimodal tool conversion
Official documentation explaining database row policies, authenticated and unauthenticated roles, and operation-specific checks. It supplies architectural context for the Lovable disclosure, not evidence of a compromise of Supabase infrastructure.
No matches on this page.