PUBLIC-EVIDENCE TOPIC COLLECTION
Public-evidence agentic AI security cases covering autonomous actions, tool use, identity, memory, delegation, and containment failures.
41 matched references · all link to complete source and scoring records
Agentic systems turn model output into action. Their security therefore depends on authorization, identity, execution boundaries, reversible actions, aggregate budgets, and evidence that those controls hold across multi-step paths—not only on whether a model refuses a malicious prompt.
Framework routes: OWASP Agentic AI · OWASP AISVS. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-08-12 · Agentic / MCP System
Opaque state is not safe state: reasoning artifacts need confidentiality, principal/session binding, bounded retention, and an output gate before they enter logs or client-visible trajectories.
Indicative ERS 3.5 · 1.5–5.4
2026-08-12 · Agentic / MCP System
MCP onboarding cannot be a one-time trust decision: clients must bind descriptor and prompt semantics, detect drift, and re-authorize every consequential action against current user intent.
Indicative ERS 6.4 · 3.2–9.6
2026-08-05 · Agentic / MCP System
The benchmark aggregates 20 scenarios across five browser-agent products and reports vendor-level completion counts without a complete prompt-and-trace corpus, exact reproducible builds, or repeated-run counts. It is useful evidence for authorization testing, but not one bounded deployment. A single score would average incompatible products, account states, tools, and transaction effects and would therefore manufacture a system that was never assessed.
Research note · no ERS
2026-08-05 · Agentic / MCP System
Long-term memory is persistent control input: every write needs provenance and promotion policy, and every recall must be re-authorized against the current task before it can influence tools.
Indicative ERS 4.7 · 2.2–7.2
2026-08-05 · Agentic / MCP System
The source reports a vulnerability class spanning more than ten AI IDE products, over 30 findings, and 24 CVEs. It does not define one product version, workspace trust state, enabled native feature set, agent tool policy, or deployment boundary from which a single IVP/ORP/ACI result can be calculated. Selecting one representative configuration would require an assessor choice not made by the source, so the analysis is preserved with its AIDEFEND routes but carries no ERS.
Research note · no ERS
2026-08-02 · Agentic / MCP System
Persistent memory changes prompt injection from a one-chat event into delayed control flow; trusted intent must govern both memory promotion and every later rehydration.
Indicative ERS 6.1 · 3.1–9.1
2026-08-02 · Agentic / MCP System
Model weights are only one executable release component; chat templates must be digest-bound, provenance-checked, and security-regression-tested with the same rigor as the weights.
Indicative ERS 4.8 · 2.0–7.7
2026-08-02 · Agentic / MCP System
A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
Indicative ERS 5.7 · 2.6–8.8
2026-07-27 · Agentic / MCP System
A platform can ship an approval gate and still score Cn-6 = 0.00 when that gate is writable by the very workflow it governs — AITBM scores the exercised configuration, not the nominal capability — and because the forged agent constitutes an identity-boundary change with new tool authority, the C_event <= 0.35 cap, not the seven-day calendar age, is what sets Temporal Freshness.
Indicative ERS 7.4 · 4.5–10.0
2026-07-22 · Agentic / MCP System
A case can have eight or nine genuinely effective controls — an SSRF allowlist that never failed, 84 straight denials at the credential store, digest verification that kept the supply chain clean — and still sit at the ceiling of the ORP layer, because AITBM scores boundaries independently rather than crediting an incident for the boundaries that happened not to be on the attacker's path: one ungated escalation route from an entry-exposed workload to credential-issuing nodes forces Cp to 1.00 on its own merits, and no number of denials elsewhere reduces it.
Indicative ERS 7.0 · 4.1–10.0
2026-07-11 · Agentic / MCP System
A human-approval gate only counts for as much of the chain as it actually governs: Notion's page-edit approval was real enough to raise Aa to 0.50 and hold Cn-6 above zero, yet the render hop that fired before the gate carried the data out, which is exactly the worst-case chain-composition condition Cn-6's upper anchors require and the reason Cp still resolves to 1.00.
Indicative ERS 5.1 · 2.4–7.7
2026-07-07 · Agentic / MCP System
This is the cleanest Cn-6 = 0.00 in the set and shows why AITBM separates Cn-6 from Cn-1: the agent never exceeded its granted CRM permissions, so a permission-only assessment would find nothing wrong, yet the absence of any pre-execution reversibility classification let an ungated bounded-irreversible write execute repeatedly on the authority of anonymous external text.
Indicative ERS 6.4 · 2.8–10.0
2026-07-07 · Agentic / MCP System
This case shows the Behavioral Attestation Window being correctly withheld: the agent is unambiguously Agentic and scores at the ORP ceiling, but none of the four BAW checklist items is evidenced for a single-session browser agent, so applying the behavioural staleness floor would have been an assumption rather than a finding — the freshness penalty here comes from the event and monitoring caps, which the evidence does support.
Indicative ERS 6.8 · 3.0–10.0
2026-07-07 · Multi-Agent / MCP System
This is the reference case for cp_basis = default: the agents are maximally exposed and their navigation action is entirely ungated, yet the measured terminal impact is a benign HTTP request, so Cp = 1.00 is the spec's worst-case default for a missing System Dependency Graph rather than a finding the evidence corroborates — and saying which of the two applies is what keeps a published ERS honest.
Indicative ERS 7.1 · 3.0–10.0
2026-07-07 · Agentic / MCP System
AgentFlayer is the batch's clearest case of a control that half-held changing two scores at once: because a URL reputation check existed and had to be bypassed, Cn-3 sits at the rubric's bypass anchor (0.25) rather than its absence anchor — yet under the GDCP rule that a gate may only be claimed at CBR >= 0.95, that same demonstrated bypass invalidates the gate for cascade purposes and makes Cp corroborated rather than defaulted. The 358-day evidence age is the second lesson: it drives Temporal Freshness toward zero and, per spec 3.3.4, that is the framework declaring the assessment stale rather than declaring the product risky.
Indicative ERS 5.8 · 2.8–8.8
2026-07-06 · Agentic / MCP System
PerplexedBrowser is the case where the assessed system's own security controls were largely irrelevant to the outcome: the vault held, the model filter partly held, and the system still failed — because Cn-1, Cn-3 and Cn-6 were all measuring boundaries that simply did not exist between an untrusted-content task and an authenticated session sharing one agent context, which is why Cp is corroborated at 1.00 rather than defaulted.
Indicative ERS 7.4 · 3.5–10.0
2026-07-06 · Agentic / MCP System
LangGraph is the cleanest available demonstration that agent memory is an Ro-4 poisoning surface rather than a storage detail: an attacker-planted checkpoint row promoted straight into trusted agent state with no signature, type guarantee or quarantine gate scores Ro-4 = 0.00 outright — and because the checkpointer is exactly the cross-session model-writable memory the BAW checklist describes, the same fact that sets Ro-4 also switches on the behavioural staleness floor.
Indicative ERS 5.2 · 2.4–8.0
2026-07-06 · Agentic / MCP System
JADEPUFFER is the case that forces the assessor to keep the attacker out of the assessed system: the agentic behaviour that compressed the kill chain to 31-second self-repair belonged to the offence, so it drives no ORP or BAW score here — what AITBM scores is a Tier 1 workflow host with Cn-1, Cn-2 and Cn-5 all at 0.00 and a corroborated Cp = 1.00 traced from an unauthenticated origin to a P4 backdoor-administrator terminal.
Indicative ERS 6.9 · 3.0–10.0
2026-07-06 · Multi-Agent / MCP System
A loopback-bound control plane is not a lower-exposure deployment: because a browsing agent renders untrusted content on the same host, As reaches the 1.00 anchor and the Cp path is corroborated end-to-end — while the thin two-axis evidence base forces the Lite Ec cap, showing how AITBM records the limits of its own evidence rather than papering over them.
Indicative ERS 5.6 · 2.4–8.7
2026-07-06 · Agentic / MCP System
When a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-4 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped, version-boundaried vendor fix earns Rf = 0.00 without moving any IVP score, which is exactly the layer separation AITBM is built to preserve.
Indicative ERS 5.4 · 2.9–7.8
2026-07-06 · Agentic / MCP System
This is the batch's only case with no patch to point at, and it lands where AITBM says it should: Rf = 0.75 rather than 0.00 because every remedy is an external containment layer, while Cn-6 = 0.00 for a subtler reason than a missing gate — the payload arrived over DNS at runtime, so the action's reversibility class was undeterminable at the only moment a gate could have fired.
Indicative ERS 6.6 · 3.8–9.4
2026-06-27 · Multi-Agent / MCP System
Detection capability and evidence freshness are scored in different layers, and this case separates them cleanly: the monitor's blindness is a point-in-time IVP finding at Ro-1 and Cn-3, while the same sensor loss independently caps ACI Temporal Freshness through C_monitor and Band 0 C_behavior — and because the report measured visibility rather than consequence, Cn-1 and Cn-6 are correctly omitted instead of guessed.
Indicative ERS 5.0 · 2.0–8.0
2026-06-22 · Agentic / MCP System
A tool integration that is read-only by design can still drive an agent to code execution: the boundary that failed is the MCP output boundary, not the model, which is why Ro-1 stays at 0.25 while five Containment sub-metrics sit at the ad-hoc anchor and Cp is corroborated at 1.00 by an ungated path from an anonymous event submitter to host credential material.
Indicative ERS 7.4 · 4.3–10.0
2026-06-09 · Agentic / MCP System
A confirmation gate that exists but is not bound to a canonical action summary earns Cn-6 = 0.25, not credit for human-in-the-loop control — and because the gate cannot be claimed at CBR >= 0.95, the same defect forces Cp to the corroborated 1.00 anchor by making an otherwise-gated path to a write-external node effectively ungated.
Indicative ERS 5.3 · 2.5–8.1
2026-06-01 · Agentic / MCP System
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Indicative ERS 6.7 · 3.8–9.7
2026-05-27 · Multi-Agent / MCP System
Authentication is not authorisation: a cryptographically valid, correctly authenticated peer session still scores Cn-5 low, because Cn-5 measures whether identity is bound to instruction provenance and tool invocation — not merely whether the counterparty is who it claims to be.
Indicative ERS 8.0 · 4.3–10.0
2026-05-18 · Agentic / MCP System
There is no assessed deployment. The brief summarises an academic position paper (arXiv 2603.30016, 'Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection') that argues for plan, policy, approval, execution, and feedback boundaries in general-purpose agents. It reports no incident, no victim system, no observed configuration, and no measurement of any deployment — every statement is an architectural proposal or a critique of benchmark methodology. Scoring it would require inventing a system's IVP, ORP, and ACI inputs from prescriptive text, which the protocol forbids. The brief is retained for its AIDEFEND mapping and for what its benchmark critique implies about AITBM's own evidence-quality machinery.
Research note · no ERS
2026-05-15 · Agentic / MCP System
Nothing in this case reaches the model — there is no prompt, no injection, and no Robustness-1 signal at all — so AITBM's not-applicable redistribution rule carries the whole assessment on Containment, identity, and posture evidence, which is the correct answer for an incident where, as the brief puts it, security was lost before the model saw any prompt.
Indicative ERS 7.2 · 3.4–10.0
2026-05-08 · Agentic / MCP System
The adversary never touched the model — it optimised the documentation the model reads — so the scoring weight lands on Ro-4 ingestion integrity and Cn-1/Cn-6 execution gating rather than on jailbreak resistance, and the case shows why AITBM scores the pipeline configuration rather than the assistant that proposed the change.
Indicative ERS 6.1 · 3.8–8.4
2026-05-03 · Agentic / MCP System
There is no adversary in this case at all, and AITBM still scores it as a Containment collapse — Cn-1, Cn-2 and Cn-6 are driven by what the agent was technically able to do, not by whether anyone attacked it, which is why an assessment that only looks for attack success rates would have missed this deployment entirely.
Indicative ERS 4.9 · 2.0–7.7
2026-05-03 · Agentic / MCP System
The exploited input never reached the model, which is exactly why Ro-1 must be scored over the agent's whole task-setup surface rather than its prompt: an agent's adversarial-input resistance is only as good as the least-validated field in the request that provisions its container.
Indicative ERS 4.0 · 1.9–6.0
2026-05-03 · Agentic / MCP System
Containment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely on Cn-1 and Cn-5 — and demonstrates that a 'no model involvement' incident is still an AI security finding, not an exemption from scoring.
Indicative ERS 4.0 · 1.8–6.3
2026-04-29 · Agentic / MCP System
An AI system can fail the Containment axis with no model in the loop at all: Cn-5 is scored on the enforced authorization boundary around agent identities, so a directory role whose documented scope and effective scope diverge is an agent-identity finding, not merely an IAM bug.
Indicative ERS 3.8 · 1.2–6.3
2026-04-25 · Agentic / MCP System
The trust boundary that fails here is neither the model nor the tool but the transport intermediary between them, and AITBM localises it precisely — Cn-5 = 0.25 for an unverifiable response origin under API-key-only identity and Cn-6 = 0.00 for ARCR = 0 under auto-approve — a failure that no model-layer sub-metric and no prompt-injection test would have surfaced.
Indicative ERS 7.8 · 4.8–10.0
2026-04-25 · Agentic / MCP System
A population study can be scored honestly as a representative configuration, but only if the assurance layer carries the cost: Pc = 0.10 and a class-level Cp classified as default rather than corroborated are what keep the case from overclaiming — and the ORP shows the strict-inequality boundary at work, with Aa and Rf sitting exactly at 0.75 and therefore not counting toward N_elevated.
Indicative ERS 6.4 · 3.2–9.7
2026-04-25 · Agentic / MCP System
Authentication succeeded and the provider's write boundary held, so the failure has to be located precisely rather than described as 'broken identity': AITBM puts it in Cn-5 = 0.40 (a valid managed token with no binding to agent instance, session or invocation) and Cn-1 = 0.25 (flat reachability across three project boundaries), while Tr-3 stays at 0.50 because cloud audit logging did record the calls it could not attribute.
Indicative ERS 5.2 · 2.9–7.5
2026-04-22 · Agentic / MCP System
The scoring turns on an evidentiary rule rather than a judgement call: the 0.50 Ro-1 anchor describes this case qualitatively — common attacks resisted, multi-step tool-mediated attacks still effective — but its ASR-below-50% precondition is unmeasured, so the quantitative precondition fails and 0.25 governs; meanwhile Cn-6 = 0.00 is the cleanest reading in the batch, because a system that treats spawning an arbitrary OS process as routine tool setup has an Action Reversibility Classification Rate of exactly zero.
Indicative ERS 5.8 · 3.0–8.6
2026-04-18 · Agentic / MCP System
Cn-5 is the case's hinge and shows why a mechanism-only reading of the rubric is wrong: the gateway had real authentication (pairing, device tokens, a password), which is the 0.25 anchor, but the measured Identity Spoofing Success Rate approached 1.00, so the precedence rule — quantitative floor, qualitative ceiling — drives the score to 0.10, and it is the identity failure rather than any single missing feature that turns a loopback listener into an internet-reachable admin API.
Indicative ERS 6.5 · 2.8–10.0
2026-04-18 · Agentic / MCP System
A containment control can hold and the deployment still be compromised: the agent sandbox blocked in-runtime execution, which is why Cn-1 is scored up to 0.50 rather than down at a failure anchor, while the compromise travelled the one path the sandbox never covered — an instruction relayed through the human. AITBM captures this only because Cn-1's 0.50 anchor names delegated workflows explicitly, and because the assessment is required to score the control that held alongside the ones that did not.
Indicative ERS 5.9 · 2.7–9.2
2026-04-16 · Agentic / MCP System
ForcedLeak shows why Cp = 1.00 here is corroborated rather than defaulted: a sink gate that a researcher's payload was observed crossing cannot be claimed at CBR >= 0.95, so the path counts as ungated to a P3 node on its own merits - and it shows a control can be simultaneously credited (Cn-1 = 0.25 not 0.00, because the CSP constrained the attacker) and defeated, which is what a two-sided assessment looks like.
Indicative ERS 7.7 · 4.0–10.0
2026-04-16 · Agentic / MCP System
A case with no exploit still moves the AITBM score: a change to an agent's authority boundary trips the C_event <= 0.35 cap and, with mutable behavioural state, the M_Em = 3.0 behavioural staleness floor - so 'nothing was breached' does not mean 'the prior assessment is still fresh'. It is also a clean example of Cp = 1.00 by default rather than by corroboration, because the gates in force were never shown to be bypassed.
Indicative ERS 6.1 · 2.0–10.0
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.
