AITBM AI Security Use Cases

Deadbugz: GitHub PRs Delivered a Delayed, Shape-Shifting Malicious MCP Server

Wed, 12 Aug 2026 00:00:00 +0000

MCP onboarding cannot be a one-time trust decision: clients must bind descriptor and prompt semantics, detect drift, and re-authorize every consequential action against current user intent.

Stolen Thoughts: Opaque Reasoning Blocks Could Be Replayed to Recover Secrets

Wed, 12 Aug 2026 00:00:00 +0000

Opaque state is not safe state: reasoning artifacts need confidentiality, principal/session binding, bounded retention, and an output gate before they enter logs or client-visible trajectories.

LangSmith Tracing Header Injection Turned Observability Metadata into a Data Route

Wed, 05 Aug 2026 00:00:00 +0000

Observability metadata is routing authority when it can select an exporter; trace context must be schema-restricted, destination-pinned, and minimized before export.

SGLang's ZMQ and Pickle Paths Show Why Internal AI Messages Need a Trust Boundary

Wed, 05 Aug 2026 00:00:00 +0000

An internal AI message bus is still an untrusted code boundary: peer identity, segmentation, and safe serialization must hold before bytes reach a deserializer.

Pydantic AI Shows How Message History Can Become Server-Side Fetch Authority

Wed, 05 Aug 2026 00:00:00 +0000

Serialized conversation history is active authority when deserialization triggers I/O; replay paths require the same destination policy as an explicit network tool call.

MCFA Turns Agent Memory into a Delayed Control-Flow Input

Wed, 05 Aug 2026 00:00:00 +0000

Long-term memory is persistent control input: every write needs provenance and promotion policy, and every recall must be re-authorized against the current task before it can influence tools.

Poisoned GGUF Chat Templates Backdoor Inference Without Changing Model Weights

Sun, 02 Aug 2026 00:00:00 +0000

Model weights are only one executable release component; chat templates must be digest-bound, provenance-checked, and security-regression-tested with the same rigor as the weights.

Model Namespace Reuse Turns a Trusted Name Into a Supply-Chain Redirect

Sun, 02 Aug 2026 00:00:00 +0000

A familiar model name is not an identity: deployment admission must bind approved bytes, signer, source ownership, and loader policy before first load and every reload.

ZombieAgent Shows How Connector Prompt Injection Can Persist and Spread

Sun, 02 Aug 2026 00:00:00 +0000

Persistent memory changes prompt injection from a one-chat event into delayed control flow; trusted intent must govern both memory promotion and every later rehydration.

Claude Code GitHub Action: When a File-Read Tool Crosses the CI Secret Boundary

Sun, 02 Aug 2026 00:00:00 +0000

A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.

AgentForger Turned One ChatGPT Link Into a Scheduled Autonomous Insider

Mon, 27 Jul 2026 00:00:00 +0000

A platform can ship an approval gate and still score Cn-6 = 0.00 when that gate is writable by the very workflow it governs — AITBM scores the exercised configuration, not the nominal capability — and because the forged agent constitutes an identity-boundary change with new tool authority, the C_event <= 0.35 cap, not the seven-day calendar age, is what sets Temporal Freshness.

Frontier Lab Agent Intrusion into Hugging Face: Technical Reconstruction and Defensive Priorities

Wed, 22 Jul 2026 00:00:00 +0000

A case can have eight or nine genuinely effective controls — an SSRF allowlist that never failed, 84 straight denials at the credential store, digest verification that kept the supply chain clean — and still sit at the ceiling of the ORP layer, because AITBM scores boundaries independently rather than crediting an incident for the boundaries that happened not to be on the attacker's path: one ungated escalation route from an entry-exposed workload to credential-issuing nodes forces Cp to 1.00 on its own merits, and no number of denials elsewhere reduces it.

Notion AI Agent Lethal Trifecta Leads to Silent Data Exfiltration

Sat, 11 Jul 2026 00:00:00 +0000

A human-approval gate only counts for as much of the chain as it actually governs: Notion's page-edit approval was real enough to raise Aa to 0.50 and hold Cn-6 above zero, yet the render hop that fired before the gate carried the data out, which is exactly the worst-case chain-composition condition Cn-6's upper anchors require and the reason Cp still resolves to 1.00.

Moltbook Shows How Agent Social Feeds Can Become a Global Callback Surface

Tue, 07 Jul 2026 00:00:00 +0000

This is the reference case for cp_basis = default: the agents are maximally exposed and their navigation action is entirely ungated, yet the measured terminal impact is a benign HTTP request, so Cp = 1.00 is the spec's worst-case default for a missing System Dependency Graph rather than a finding the evidence corroborates — and saying which of the two applies is what keeps a published ERS honest.

AgentFlayer Turns ChatGPT Connectors Into a Zero-Click Exfiltration Path

Tue, 07 Jul 2026 00:00:00 +0000

AgentFlayer is the batch's clearest case of a control that half-held changing two scores at once: because a URL reputation check existed and had to be bypassed, Cn-3 sits at the rubric's bypass anchor (0.25) rather than its absence anchor — yet under the GDCP rule that a gate may only be claimed at CBR >= 0.95, that same demonstrated bypass invalidates the gate for cascade purposes and makes Cp corroborated rather than defaulted. The 358-day evidence age is the second lesson: it drives Temporal Freshness toward zero and, per spec 3.3.4, that is the framework declaring the assessment stale rather than declaring the product risky.

Prompt Mines Show Why CRM Agents Need Write-Action Gates

Tue, 07 Jul 2026 00:00:00 +0000

This is the cleanest Cn-6 = 0.00 in the set and shows why AITBM separates Cn-6 from Cn-1: the agent never exceeded its granted CRM permissions, so a permission-only assessment would find nothing wrong, yet the absence of any pre-execution reversibility classification let an ungated bounded-irreversible write execute repeatedly on the authority of anonymous external text.

PerplexedBrowser: When an Agent Browser Can Read Local Files

Tue, 07 Jul 2026 00:00:00 +0000

This case shows the Behavioral Attestation Window being correctly withheld: the agent is unambiguously Agentic and scores at the ORP ceiling, but none of the four BAW checklist items is evidenced for a single-session browser agent, so applying the behavioural staleness floor would have been an assumption rather than a finding — the freshness penalty here comes from the event and monitoring caps, which the evidence does support.

LangGraph Checkpointer Bugs Turn Agent State History Into an RCE Path