Evidence

Sophos: AI used in Aur0ra ransomware testing and execution

Sophos threat intelligence observes malicious Cursor agent workflows alongside ordinary human-supplied intruder access.

Source-planned deception against ARTEX exploitation agents

South Korean FSC: emergency financial-sector cyber-response meeting October 14

Primary Korean Financial Services Commission Oct 14 statement on 16 firms, ~100k records and checklist findings.

Spanish data watchdog publicises first AI agent-linked data breach report

Reuters report on the AEPD notification, including the reported attack sequence, limited human intervention, unidentified organization and model, and the regulator's statement that the filing remained under review.

SPILLWAY: Recipient provenance checks for agent tool calls

Prompt-injected or tool-derived text can try to redirect an agent action to a different recipient while preserving a plausible task narrative. SPILLWAY binds recipient selection to verified provenance instead of model prose. The paper reports eliminating attacker-targeted redirects in its selected benchmark tests, not a universal claim that every tool exfiltration path is closed. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.

Spoofing the Toolbox: Optimizing Tool Descriptions to Deceive LLM Agents

Tool description spoofing experiments where attacker-modified metadata changes model tool selection. The study uses constructed benchmark registries; metadata registration is an attack prerequisite.

StealthyPoison: Manipulating LLM Agent Behavior through Procedural Poisoning of Third-Party Skills

Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. arXiv2611.12155: poisoned SKILL.md changes critical formula/constant/logic rather than jailbreak instructions, plus appends plausible retrieval examples. 566 skills, 26,262 competing listings, 5,985 pairs. With forced delivery ~31-33% output incorrect on several models; full registry top1 30.0% and end-to-end Qwen9.8%, Claude Code Opus4.8 49.4% retrieval,10.1% complete ASR, medical38.3%. Static scanners 0-0.7%; semantic judge45.8%.

StepSecurity: SubQuery 5.8.3 package investigation

StepSecurity connects an automated package alert to human verification of a malicious SubQuery archive and release workflow, distinguishing artifact substitution from detector output.

Storm-3119 synthetic organizations and criminal phishing infrastructure marketplace — original research or disclosure

Reported evidence for Microsoft attributes deceptive corporate identities and cloud tenants to the Storm-3119 ecosystem; campaign traffic is not a count of compromised organizations. Research intake: DB-RADAR-CP7-CP7A-001.

Strands Agents SDK advisory: A2A context_id session data disclosure

Official Strands Agents SDK security advisory CVE-2026-115419, A2A server shared conversation state across distinct users and context_id values; patched in Python 1.43.0 and TypeScript 1.5.0.

Strands Agents Tools environment masking bypass advisory

Maintainer advisory describing model-controlled masking false leading to host environment variable exposure.

Strands FileSessionManager symlink and file integrity advisory

Strands FileSessionManager advisory for world-writable default session storage and predictable symlink-following temporary files, potentially altering files and replayed memory; patched in 1.48.0.

Study of chemical-safety behavior under scientific agent harnesses

Study of chemical-safety behavior under scientific agent harnesses

Study of presign authorization contamination in agent requirements

Signed agent requirement or policy manifests protect the bytes after signature, but a hostile input that changes what an operator selects before signing can place an unauthorized instruction inside a formally valid signed artifact. The controlled study emphasizes an admission and review boundary before cryptographic sealing. Signing itself cannot establish that the authorized human intended the content. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.

Study of steganographic prompt instructions across multimodal tool conversion

Study of steganographic prompt instructions across multimodal tool conversion

Supabase documentation: Row Level Security

Official documentation explaining database row policies, authenticated and unauthenticated roles, and operation-specific checks. It supplies architectural context for the Lovable disclosure, not evidence of a compromise of Supabase infrastructure.

SURA 10-image trusted probes suppress federated-learning backdoors unless attacker knows exact repair set

Original SURA paper screens federated client updates with small clean probe sets and tests an adversary knowing that very set. One adaptive setting raises backdoor attack success to 94.91%, highlighting reference-set secrecy and limited transfer to other architectures.

SWE-DeceptionBench: Benchmarking Deceptive Behaviors of LLMs Across the Software Development Lifecycle

Symantec: offensive Skynet configuration captured by AI honeypot

Sysdig - JADEPUFFER agentic ransomware

Sysdig - JADEPUFFER evolves to target AI/ML assets

Tabularis SQLite MCP describe_table command SQL injection advisory

Maintainer advisory demonstrating stacked SQL risk in a nominally read-only metadata tool.

Talos blocks 2,400 simulated industrial attacker agents while deceiving them through mirrored Modbus controller

Original Talos twin-controller proposal routes hostile Modbus writes to a mirror while a separate policy protects the simulated controller. The 2,400 agent runs and zero protected writes describe one designed testbed with one attacker model, not a real operational technology deployment.

TaskMarket 30-task custom-hook forensic scan and contract disassembly

Researcher-posted 30-task sample, 16 reported matching custom-hook runtimes and locally described RPC calls; raw on-chain results not independently reproduced in this Proposal.

TaskMarket official task hook specification

Taskmarket explains hook-based claim and submission checks and the effect of a rejected task transition.

TechCrunch - Anthropic multi-agent turf-war experiment

TechCrunch - Microsoft open-source projects compromised to steal AI developer credentials

Terence Tao: Math 2.0 (Caltech lecture slides)

Original 27-page slide deck from the October 2026 Caltech lecture. Page 9 discusses mathematical problem-solving as a proxy for long-term aims; page 20 uses a clearly hypothetical AI-designed treatment to illustrate potential divergence between formal checks, an evaluation outcome, and human understanding.

Terence Tao

The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never Named

Oct 10 original study of browser-agent consent and webhook actions, 73 ungated and 70 gated attack tests.

The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation

The VELA study tests 44 known web application flaws and reports that forty were realizable in a scripted baseline; coding agents could exercise all forty at least once in the evaluated conditions.