PUBLIC-EVIDENCE TOPIC COLLECTION
Public-evidence agentic AI security cases covering autonomous actions, tool use, identity, memory, delegation, and containment failures.
90 matched references · all link to complete source and scoring records
Agentic systems turn model output into action. Their security therefore depends on authorization, identity, execution boundaries, reversible actions, aggregate budgets, and evidence that those controls hold across multi-step paths—not only on whether a model refuses a malicious prompt.
Framework routes: OWASP Agentic AI · OWASP AISVS. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-10-09 · Agentic / MCP System
The confirmed harm was internal software removal and failed checks, not an accepted grade or proven full filesystem wipe.
Indicative ERS 6.7 · 2.0–10.0
2026-09-28 · Agentic / MCP System
A confirmed internal agent task-boundary escape supports Cn-1 only; approval, origin handling, and reversibility batteries remain unknown.
Indicative ERS 7.5 · 2.2–10.0
2026-09-25 · Agentic / MCP System
The verified failure is an alternate task-authority route and public token publication; secret-filter efficacy as a five-level metric remains unmeasured.
Indicative ERS 7.1 · 2.0–10.0
2026-09-24 · Agentic / MCP System
The controlled Slack reply route documents task-scope and URL-filter bypass without proving an authentication or ARCR failure.
Indicative ERS 5.5 · 1.7–9.4
2026-09-24 · Agentic / MCP System
Existing CRM permission was real, yet task scope and output redaction failed in the controlled pre-fix chain.
Indicative ERS 5.5 · 1.7–9.4
2026-09-18 · Agentic / MCP System
When an agent's control interface is internet-reachable without effective authentication, identity, scope, escalation and output filtering all fail through the same door, so every Containment sub-metric the evidence touches sits at 0.00; AITBM's multi-dimensional profile exposes one deployment-exposure root cause, and the CRM (three elevated ORP dimensions) rather than the IVP carries the compounding.
Indicative ERS 6.9 · 2.7–10.0
2026-09-18 · Agentic / MCP System
A researcher-built replica on a real agent platform can be scored as a representative configuration when the source states its trigger, tools and reach — but its fidelity is staging-equivalent, and an email-triggered agent with bulk CRM read and unrestricted send reaches CRM 1.35 on autonomy, exposure and corroborated cascade alone.
Indicative ERS 7.5 · 3.3–10.0
2026-09-15 · Agentic / MCP System
OX reproduced a default DeepSeek Harness local control path: a confined coding agent called an unauthenticated loopback API, spoofed a trusted Host, changed its own session to danger-full-access, and disabled approval prompts.
Indicative ERS 4.1 · 1.2–7.0
2026-09-13 · Agentic / MCP System
Zenity demonstrated one Claude in Chrome prompt-injection boundary: an attacker-origin email instructed the browser agent to import code via javascript_tool in an authenticated browser session, then read Gmail Atom feed. Slack, X, and Claude.ai account paths are downstream consequences of that shared agent failure.
Indicative ERS 4.3 · 1.2–7.5
2026-09-08 · Agentic / MCP System
Anthropic reported a September 2025 campaign that used Claude Code, its AI coding agent, against roughly 30 organizations and compromised a small number. Anthropic attributes GTG-1002 to a Chinese state-sponsored actor with high confidence. The attackers posed as legitimate security testers and fragmented malicious objectives into plausible technical tasks, depriving the model of the context needed to judge their combined purpose. Their orchestration connected Claude to external tools through MCP, and the technical report describes an SSRF path from scanning and payload generation to validation, human approval, and exploitation, followed by internal discovery and credential abuse. Anthropic estimated AI performed 80 to 90 percent of tactical work while humans retained critical decisions, and notes that Claude fabricated credentials and misrepresented public information as secret discoveries, so generated reports are not proof of compromise. Anthropic investigated Claude usage, banned accounts, and notified affected entities; its account is not a complete independent reconstruction of every local command or victim outcome. MITRE ATLAS records the campaign as case study AML.CS0069.
Research note · no ERS
2026-09-01 · Agentic / MCP System
Qwen Code processed packaged Git configuration during startup before agent authorization and ran a configured helper as the developer. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-09-01 · Agentic / MCP System
The first agent message caused Hermes Git context gathering to invoke an executable helper from packaged .git/config as the developer. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-09-01 · Agentic / MCP System
Grok Build processed the packaged Git configuration on the first keystroke and ran a configured helper as the developer. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-09-01 · Agentic / MCP System
Review of a ZIP-delivered repository with executable .git/config caused Goose Git context gathering to run a configured helper as the developer, outside the agent sandbox. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-09-01 · Agentic / MCP System
The ultrareview workflow triggered a second Git setting path from packaged .git/config and executed a helper as the developer; the exact setting key was not disclosed. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-09-01 · Agentic / MCP System
Claude Code startup Git context collection triggered core.fsmonitor from packaged .git/config, executing a command as the developer before an approval boundary. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-08-25 · Agentic / MCP System
The blast radius came from the managed runtime boundary, not from the compromised Playbook. Tr-3 scores 0.00 rather than 0.25 because the decisive event produced no record at all and the Playbook could then be restored — so the surviving audit surface does not merely omit fields, it actively describes a state that is no longer executing. That is the difference between an incomplete log and a misleading one.
Indicative ERS 4.7 · 2.4–7.0
2026-08-25 · Agentic / MCP System
Cn-6 scores 0.00 for a reason the per-action view would miss: the write that overwrote cursorsandbox and the command that later ran unsandboxed are different hops, and neither is individually catastrophic. The worst-case composition rule exists precisely for this shape — an irreversible step hiding inside a chain whose visible steps look ordinary — and nothing in the assessed configuration enforced it.
Indicative ERS 6.9 · 2.9–10.0
2026-08-25 · Agentic / MCP System
Computer-use agents introduce a physical gap between perception and action, and AITBM prices it as a Containment failure rather than a perception failure. The screenshot was accurate when taken and the model reasoned correctly about it; what was missing is any rule that an observation expires. Cn-6 is the sub-metric that would have caught it regardless of timing, because an email is a delegated-irreversible action and no observation, fresh or stale, authorises one.
Indicative ERS 7.3 · 2.6–10.0
2026-08-25 · Agentic / MCP System
The memory branch demonstrates persistent-state containment failure, now covered by Cn-9. A webpage-derived record entered durable memory without a promotion gate, and Varonis found that password changes, session revocation, and device re-registration left it in place until explicitly deleted. Recovery therefore requires checking and removing the affected durable state as well as ending sessions.
Indicative ERS 8.0 · 3.9–10.0
2026-08-25 · Agentic / MCP System
Disabling web search did not remove the sink, and that is the scoring lesson: Cn-1 is not measured by which features are switched off but by the complete inventory of outbound-capable tools an untrusted instruction can reach. A control that governs one named capability while a generic URL-retrieval path remains unrestricted is an inventory gap, which is why this scores 0.00 rather than the 0.25 that an enforced-but-leaky boundary would earn.
Indicative ERS 7.6 · 3.0–10.0
2026-08-24 · Agentic / MCP System
Popularity is not provenance. Ro-5 scores 0.00 not because the skill was malicious when reviewed — it was not — but because the admission decision was never bound to the bytes it approved, so an install counter earned on 5 July still authorised different content on 11 July. That is the same failure the Behavioural Attestation Window exists to price: approval that does not expire when behaviour changes.
Indicative ERS 7.8 · 3.8–10.0
2026-08-24 · Agentic / MCP System
Miasma moves supply-chain execution from package installation to project open, and AITBM records that as an identity failure as much as a containment one: Cn-5 scores 0.00 because nothing bound the agent's operating directive to a verified source, so a repository rather than the operator defined what the agent would do at startup. The non-AI VS Code route is deliberately excluded from the assessed system — the brief's own defence descriptions disclaim coverage of it, and folding it in would have mixed a conventional IDE trust boundary into an AI-agent score.
Indicative ERS 7.9 · 3.9–10.0
2026-08-12 · Agentic / MCP System
Opaque state is not safe state: reasoning artifacts need confidentiality, principal/session binding, bounded retention, and an output gate before they enter logs or client-visible trajectories.
Indicative ERS 3.4 · 1.5–5.4
2026-08-12 · Agentic / MCP System
MCP onboarding cannot be a one-time trust decision: clients must bind descriptor and prompt semantics, detect drift, and re-authorize every consequential action against current user intent.
Indicative ERS 6.8 · 3.9–9.7
2026-08-06 · Agentic / MCP System
A confirmation gate that fired every time still let 16 users run an attacker's command within 8 hours, because it showed no provenance and the domain was a lookalike: AITBM credits the gate (Cn-6 0.25, Aa held at 0.75) while Ro-1, Ro-5, Tr-4 and Cn-5 record that everything upstream of it — instruction file, registry listing, publisher identity — was unverified.
Indicative ERS 6.0 · 2.6–9.4
2026-08-06 · Agentic / MCP System
Rules files are mutable behavioural state, so AITBM scores the backdoor through Ro-5 and Cn-5 (both 0.00) and applies the behavioural staleness window; the invisible Unicode defeats human review rather than a model filter, which is why it does not lift Cn-8 above the class precedent's 0.00.
Indicative ERS 6.2 · 2.9–9.5
2026-08-06 · Agentic / MCP System
A tool supply-chain compromise can bypass the model entirely: the BCC was added in server code, so no prompt-injection or output control could have seen it, and AITBM places the evidence on Ro-5, Tr-4, Cn-1 and Cn-5 — the integrity, lineage, scope and publisher identity of the tool — while leaving Ro-1 unknown rather than inferring a model failure.
Indicative ERS 3.8 · 1.4–6.2
2026-08-06 · Agentic / MCP System
A human-approval gate is only as strong as the authority that can switch it off: OpenClaw's dangerous-command prompt and sandbox were real, so Cn-1 and Cn-6 sit at 0.25 rather than 0.00, but because the ordinary Gateway token could disable both, a one-click token theft (Cn-5 0.25) converted an approval-gated agent into ungated host execution.
Indicative ERS 6.6 · 2.1–10.0
2026-08-06 · Agentic / MCP System
A human confirmation prompt is a real control and lifts Cn-2 and Cn-6 to 0.25, but it gates a tool class, not a reversibility class: an obscured command carrying a delegated-irreversible credential disclosure looked like any other shell call, so Cn-1 and Cp still resolve to the worst case.
Indicative ERS 5.0 · 1.9–8.1
2026-08-06 · Agentic / MCP System
Tool metadata is instruction input: a docstring alone moved an agent from a benign request to reading an SSH private key and exfiltrating it in a tool argument, so AITBM scores the receiving client (Cn-8, Ro-4, Cn-1, Cn-2, Cn-3) rather than the malicious server, which is attacker tooling, and places the leak on Cn-3 because the data left through a tool-call argument rather than through model memorisation.
Indicative ERS 4.5 · 1.6–7.4
2026-08-05 · Agentic / MCP System
hCaptcha Threat Analysis Group (hTAG) tested 20 abuse scenarios against ChatGPT Atlas, Claude Computer Use, Gemini Computer Use, Manus AI, and Perplexity Comet. In the reported configurations, agents frequently completed account, session, payment, and probing tasks after direct or lightly reworded requests. The benchmark is vendor-authored and not independently replicated, but it reinforces a durable engineering rule: a model's willingness to act cannot authorize a real account, browser session, or transaction.
Research note · no ERS
2026-08-05 · Agentic / MCP System
Long-term memory is persistent control input: every write needs provenance and promotion policy, and every recall must be re-authorized against the current task before it can influence tools.
Indicative ERS 4.6 · 1.8–7.3
2026-08-05 · Agentic / MCP System
IDEsaster is a cross-product vulnerability class in which prompt injection does not need a dangerous agent tool to finish the attack. The agent uses ordinary file access, then the underlying IDE automatically loads a remote schema, changes a workspace boundary, or executes a configured program. The research reported more than 30 vulnerabilities and 24 CVEs across over ten products. Defenders must therefore constrain the combined authority of the agent, IDE, native bridge, and background features.
Research note · no ERS
2026-08-02 · Agentic / MCP System
Persistent memory changes prompt injection from a one-chat event into delayed control flow; trusted intent must govern both memory promotion and every later rehydration.
Indicative ERS 6.0 · 2.6–9.3
2026-08-02 · Agentic / MCP System
A provenance heuristic keyed to the turn in which untrusted data arrives is a real control and earns Cn-2 = 0.25, but once a one-word reply can move the instruction past it, the path to physical and external-effect actions is ungated — Cn-6 falls to 0.00 and Cp is corroborated rather than defaulted.
Indicative ERS 5.8 · 2.2–9.4
2026-08-02 · Agentic / MCP System
Model weights are only one executable release component; chat templates must be digest-bound, provenance-checked, and security-regression-tested with the same rigor as the weights.
Indicative ERS 4.8 · 1.9–7.7
2026-08-02 · Agentic / MCP System
'Living off AI' is a Cn-2 failure with a working role model underneath it: Jira's portal separation forced the attacker through the engineer's AI session, which earns 0.25 rather than 0.00, but an unscoped MCP connection and an ungated public-reply tool turned that relay into a delegated-irreversible disclosure, so Cn-1, Cn-3 and Cn-6 still resolve to 0.00.
Indicative ERS 5.4 · 1.8–9.0
2026-08-02 · Agentic / MCP System
A guardrail the attacker has to talk past still earns Ro-1 0.25, but it moves no Containment score: with an ungated, sudo-capable shell, one successful jailbreak converts directly into irreversible destruction, which is why Cn-2 and Cn-6 carry the case.
Indicative ERS 7.4 · 2.7–10.0
2026-08-02 · Agentic / MCP System
An attack that never ran can still be scored, but only where it was observed: the poisoned commit-to-release path yields Ro-5 and Cn-5 at 0.25, while every agent-side Containment sub-metric stays UNKNOWN because a syntax error, not a control, stopped execution — the wide interval is the honest result.
Indicative ERS 3.8 · 1.3–6.3
2026-08-02 · Agentic / MCP System
A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
Indicative ERS 5.8 · 2.8–8.8
2026-08-02 · Agentic / MCP System
A computer-use agent's clipboard and terminal are tools like any other: AITBM scores AI ClickFix as a Containment collapse (Cn-1, Cn-2 and Cn-6 at 0.00) rather than a perception error, because the decisive failure is that page content could reach shell execution with no gate, whatever the lure.
Indicative ERS 7.5 · 2.9–10.0
2026-07-27 · Agentic / MCP System
A platform can ship an approval gate and still score Cn-6 = 0.00 when that gate is writable by the very workflow it governs — AITBM scores the exercised configuration, not the nominal capability — and because the forged agent constitutes an identity-boundary change with new tool authority, the C_event <= 0.35 cap, not the seven-day calendar age, is what sets Temporal Freshness.
Indicative ERS 7.3 · 4.2–10.0
2026-07-22 · Agentic / MCP System
Re-derived against OpenAI's 26 August end-to-end report, the case moves in two directions at once and neither is a metadata bump. Cn-4 falls from 0.25 to 0.00 because what the earlier account recorded as one file-disclosure reference is now two independent unintended-read primitives in the same parser surface, and Cn-7 enters at 0.00 because a five-second polling loop on 41 production workers and a self-respawning fleet are an execution-containment failure the earlier account did not expose. Ro-4 stays at 0.50 even though the CI branch was upgraded from an attempted pivot to a workflow that actually executed — because the anchor is defined by the boundary that held, and digest verification plus the merge gate did hold. The system:masters claim that previously carried part of the tier rationale was withdrawn upstream and has been removed rather than quietly retained.
Indicative ERS 7.2 · 5.0–9.3
2026-07-11 · Agentic / MCP System
A human-approval gate only counts for as much of the chain as it actually governs: Notion's page-edit approval was real enough to raise Aa to 0.50 and hold Cn-6 above zero, yet the render hop that fired before the gate carried the data out, which is exactly the worst-case chain-composition condition Cn-6's upper anchors require and the reason Cp still resolves to 1.00.
Indicative ERS 4.8 · 1.9–7.8
2026-07-07 · Agentic / MCP System
This is the cleanest Cn-6 = 0.00 in the set and shows why AITBM separates Cn-6 from Cn-1: the agent never exceeded its granted CRM permissions, so a permission-only assessment would find nothing wrong, yet the absence of any pre-execution reversibility classification let an ungated bounded-irreversible write execute repeatedly on the authority of anonymous external text.
Indicative ERS 6.2 · 2.2–10.0
2026-07-07 · Agentic / MCP System
This case shows the Behavioral Attestation Window being correctly withheld: the agent is unambiguously Agentic and scores at the ORP ceiling, but none of the four BAW checklist items is evidenced for a single-session browser agent, so applying the behavioural staleness floor would have been an assumption rather than a finding — the freshness penalty here comes from the event and monitoring caps, which the evidence does support.
Indicative ERS 6.7 · 2.9–10.0
2026-07-07 · Agentic / MCP System
A mode-selection fallback is a privilege decision: Atlas scores Cn-2 0.25 because ambiguous omnibox input was elevated to the most trusted role, yet with only a navigation demonstrated Cp stays at the specification default rather than corroborated, because AITBM does not score described-but-undemonstrated abuse.
Indicative ERS 3.7 · 1.1–6.3
2026-07-07 · Multi-Agent / MCP System
This is the reference case for cp_basis = default: the agents are maximally exposed and their navigation action is entirely ungated, yet the measured terminal impact is a benign HTTP request, so Cp = 1.00 is the spec's worst-case default for a missing System Dependency Graph rather than a finding the evidence corroborates — and saying which of the two applies is what keeps a published ERS honest.
Indicative ERS 7.1 · 2.8–10.0
2026-07-07 · Agentic / MCP System
AgentFlayer is the batch's clearest case of a control that half-held changing two scores at once: because a URL reputation check existed and had to be bypassed, Cn-3 sits at the rubric's bypass anchor (0.25) rather than its absence anchor — yet under the GDCP rule that a gate may only be claimed at CBR >= 0.95, that same demonstrated bypass invalidates the gate for cascade purposes and makes Cp corroborated rather than defaulted. The 358-day evidence age is the second lesson: it drives Temporal Freshness toward zero and, per spec 3.3.4, that is the framework declaring the assessment stale rather than declaring the product risky.
Indicative ERS 5.8 · 2.7–8.9
2026-07-06 · Agentic / MCP System
PerplexedBrowser is the case where the assessed system's own security controls were largely irrelevant to the outcome: the vault held, the model filter partly held, and the system still failed — because Cn-1, Cn-3 and Cn-6 were all measuring boundaries that simply did not exist between an untrusted-content task and an authenticated session sharing one agent context, which is why Cp is corroborated at 1.00 rather than defaulted.
Indicative ERS 7.4 · 3.3–10.0
2026-07-06 · Agentic / MCP System
LangGraph is the cleanest available demonstration that agent memory is an Ro-4 poisoning surface rather than a storage detail: an attacker-planted checkpoint row promoted straight into trusted agent state with no signature, type guarantee or quarantine gate scores Ro-4 = 0.00 outright — and because the checkpointer is exactly the cross-session model-writable memory the BAW checklist describes, the same fact that sets Ro-4 also switches on the behavioural staleness floor.
Indicative ERS 5.2 · 2.2–8.1
2026-07-06 · Agentic / MCP System
JADEPUFFER is the case that forces the assessor to keep the attacker out of the assessed system: the agentic behaviour that compressed the kill chain to 31-second self-repair belonged to the offence, so it drives no ORP or BAW score here — what AITBM scores is a Tier 1 workflow host with Cn-1, Cn-2 and Cn-5 all at 0.00 and a corroborated Cp = 1.00 traced from an unauthenticated origin to a P4 backdoor-administrator terminal.
Indicative ERS 7.0 · 3.2–10.0
2026-07-06 · Multi-Agent / MCP System
A loopback-bound control plane is not a lower-exposure deployment: because a browsing agent renders untrusted content on the same host, As reaches the 1.00 anchor and the Cp path is corroborated end-to-end — while the thin two-axis evidence base forces the Lite Ec cap, showing how AITBM records the limits of its own evidence rather than papering over them.
Indicative ERS 5.6 · 2.4–8.7
2026-07-06 · Agentic / MCP System
When a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-5 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped, version-boundaried vendor fix earns Rf = 0.00 without moving any IVP score, which is exactly the layer separation AITBM is built to preserve.
Indicative ERS 5.5 · 3.2–7.8
2026-07-06 · Agentic / MCP System
This is the batch's only case with no patch to point at, and it lands where AITBM says it should: Rf = 0.75 rather than 0.00 because every remedy is an external containment layer, while Cn-6 = 0.00 for a subtler reason than a missing gate — the payload arrived over DNS at runtime, so the action's reversibility class was undeterminable at the only moment a gate could have fired.
Indicative ERS 7.0 · 4.5–9.4
2026-06-29 · Agentic / MCP System
An approval policy can exist and still be the failure point: exempting self-addressed messages from approval is a real Cn-6 classification (0.25, not 0.00), but because the exempted hop is the one that releases bearer-equivalent links, the same exemption leaves the path to external disclosure ungated and corroborates Cp at 1.00.
Indicative ERS 5.9 · 2.9–8.9
2026-06-29 · Agentic / MCP System
When a backdoor lives in model-writable memory, the egress fix and the persistence fix are different remediations: closing the font-src channel under CVE-2026-24299 does not retire the unaudited record_memory write path, which is why Rf sits at 0.50, Tr-3 is scored from the Purview gap, and the behavioural staleness window applies.
Indicative ERS 5.9 · 2.9–8.9
2026-06-27 · Multi-Agent / MCP System
Detection capability and evidence freshness are scored in different layers, and this case separates them cleanly: the monitor's blindness is a point-in-time IVP finding at Ro-1 and Cn-3, while the same sensor loss independently caps ACI Temporal Freshness through C_monitor and Band 0 C_behavior — and because the report measured visibility rather than consequence, Cn-1 and Cn-6 are correctly omitted instead of guessed.
Indicative ERS 5.0 · 1.9–8.0
2026-06-22 · Agentic / MCP System
A tool integration that is read-only by design can still drive an agent to code execution: the boundary that failed is the MCP output boundary, not the model, which is why Ro-1 stays at 0.25 while five Containment sub-metrics sit at the ad-hoc anchor and Cp is corroborated at 1.00 by an ungated path from an anonymous event submitter to host credential material.
Indicative ERS 7.8 · 5.1–10.0
2026-06-09 · Agentic / MCP System
A confirmation gate that exists but is not bound to a canonical action summary earns Cn-6 = 0.25, not credit for human-in-the-loop control — and because the gate cannot be claimed at CBR >= 0.95, the same defect forces Cp to the corroborated 1.00 anchor by making an otherwise-gated path to a write-external node effectively ungated.
Indicative ERS 5.2 · 2.4–8.1
2026-06-01 · Agentic / MCP System
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Indicative ERS 7.0 · 4.3–9.7
2026-05-27 · Multi-Agent / MCP System
Authentication is not authorisation: a cryptographically valid, correctly authenticated peer session still scores Cn-5 low, because Cn-5 measures whether identity is bound to instruction provenance and tool invocation — not merely whether the counterparty is who it claims to be.
Indicative ERS 7.9 · 4.0–10.0
2026-05-18 · Agentic / MCP System
This is a methodology source rather than an incident. The paper reframes indirect prompt injection as a system-architecture problem: an attacker hides instructions in an email, webpage, document, or tool output, the agent reads it during a legitimate task, and the malicious text attempts to steer the next plan, policy update, or tool call. It argues that dynamic replanning is necessary for utility but opens a boundary, so attacker-controlled feedback must not be allowed to expand what the agent may do; that model-based security judges must be constrained to narrow structured artefacts such as typed traces or proposed plan and policy diffs rather than raw attacker-controlled text; and that human review must be designed, with explicit checkpoints, evidence, and authority for ambiguous cases. It closes by criticising static benchmarks as overstating safety, calling for tests with long tasks, replanning, policy updates, parameter-level attacks, and adaptive payloads. No system was tested and no compromise is reported.
Research note · no ERS
2026-05-15 · Agentic / MCP System
Nothing in this case reaches the model — there is no prompt, no injection, and no Robustness-1 signal at all — so AITBM's not-applicable redistribution rule carries the whole assessment on Containment, identity, and posture evidence, which is the correct answer for an incident where, as the brief puts it, security was lost before the model saw any prompt.
Indicative ERS 7.5 · 4.1–10.0
2026-05-08 · Agentic / MCP System
The adversary never touched the model — it optimised the documentation the model reads — so the scoring weight lands on Ro-5 ingestion integrity and Cn-1/Cn-6 execution gating rather than on jailbreak resistance, and the case shows why AITBM scores the pipeline configuration rather than the assistant that proposed the change.
Indicative ERS 6.1 · 3.9–8.4
2026-05-08 · Agentic / MCP System
Persistent instruction files turn one indirect prompt injection into a standing implant: AITBM records the injection on Ro-1 (0.25) and the poisoned, re-ingested system-prompt file separately on Ro-4 (0.00), and the BAW flag ages the behavioural evidence fastest precisely because the agent's operating prompt was writable by the agent's own tool output.
Indicative ERS 7.4 · 3.1–10.0
2026-05-03 · Agentic / MCP System
There is no adversary in this case at all, and AITBM still scores it as a Containment collapse — Cn-1, Cn-2 and Cn-6 are driven by what the agent was technically able to do, not by whether anyone attacked it, which is why an assessment that only looks for attack success rates would have missed this deployment entirely.
Indicative ERS 4.8 · 2.0–7.7
2026-05-03 · Agentic / MCP System
The exploited input never reached the model, which is exactly why Ro-1 must be scored over the agent's whole task-setup surface rather than its prompt: an agent's adversarial-input resistance is only as good as the least-validated field in the request that provisions its container.
Indicative ERS 4.0 · 1.9–6.1
2026-05-03 · Agentic / MCP System
Containment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely on Cn-1 and Cn-5 — and demonstrates that a 'no model involvement' incident is still an AI security finding, not an exemption from scoring.
Indicative ERS 4.2 · 2.2–6.2
2026-04-29 · Agentic / MCP System
An AI system can fail the Containment axis with no model in the loop at all: Cn-5 is scored on the enforced authorization boundary around agent identities, so a directory role whose documented scope and effective scope diverge is an agent-identity finding, not merely an IAM bug.
Indicative ERS 3.8 · 1.3–6.3
2026-04-25 · Agentic / MCP System
The trust boundary that fails here is neither the model nor the tool but the transport intermediary between them, and AITBM localises it precisely — Cn-5 = 0.25 for an unverifiable response origin under API-key-only identity and Cn-6 = 0.00 for ARCR = 0 under auto-approve — a failure that no model-layer sub-metric and no prompt-injection test would have surfaced.
Indicative ERS 8.0 · 5.4–10.0
2026-04-25 · Agentic / MCP System
A population study can be scored honestly as a representative configuration, but only if the assurance layer carries the cost: Pc = 0.10 and a class-level Cp classified as default rather than corroborated are what keep the case from overclaiming — and the ORP shows the strict-inequality boundary at work, with Aa and Rf sitting exactly at 0.75 and therefore not counting toward N_elevated.
Indicative ERS 6.4 · 3.0–9.8
2026-04-25 · Agentic / MCP System
Authentication succeeded and the provider's write boundary held, so the failure has to be located precisely rather than described as 'broken identity': AITBM puts it in Cn-5 = 0.40 (a valid managed token with no binding to agent instance, session or invocation) and Cn-1 = 0.25 (flat reachability across three project boundaries), while Tr-3 stays at 0.50 because cloud audit logging did record the calls it could not attribute.
Indicative ERS 5.2 · 3.0–7.4
2026-04-22 · Agentic / MCP System
The scoring turns on an evidentiary rule rather than a judgement call: the 0.50 Ro-1 anchor describes this case qualitatively — common attacks resisted, multi-step tool-mediated attacks still effective — but its ASR-below-50% precondition is unmeasured, so the quantitative precondition fails and 0.25 governs; meanwhile Cn-6 = 0.00 is the cleanest reading in the batch, because a system that treats spawning an arbitrary OS process as routine tool setup has an Action Reversibility Classification Rate of exactly zero.
Indicative ERS 6.1 · 3.8–8.5
2026-04-18 · Agentic / MCP System
Cn-5 is the case's hinge and shows why a mechanism-only reading of the rubric is wrong: the gateway had real authentication (pairing, device tokens, a password), which is the 0.25 anchor, but the measured Identity Spoofing Success Rate approached 1.00, so the precedence rule — quantitative floor, qualitative ceiling — drives the score to 0.10, and it is the identity failure rather than any single missing feature that turns a loopback listener into an internet-reachable admin API.
Indicative ERS 6.8 · 3.2–10.0
2026-04-18 · Agentic / MCP System
A containment control can hold and the deployment still be compromised: the agent sandbox blocked in-runtime execution, which is why Cn-1 is scored up to 0.50 rather than down at a failure anchor, while the compromise travelled the one path the sandbox never covered — an instruction relayed through the human. AITBM captures this only because Cn-1's 0.50 anchor names delegated workflows explicitly, and because the assessment is required to score the control that held alongside the ones that did not.
Indicative ERS 6.0 · 2.8–9.1
2026-04-16 · Agentic / MCP System
ForcedLeak shows why Cp = 1.00 here is corroborated rather than defaulted: a sink gate that a researcher's payload was observed crossing cannot be claimed at CBR >= 0.95, so the path counts as ungated to a P3 node on its own merits - and it shows a control can be simultaneously credited (Cn-1 = 0.25 not 0.00, because the CSP constrained the attacker) and defeated, which is what a two-sided assessment looks like.
Indicative ERS 7.6 · 3.7–10.0
2026-04-16 · Agentic / MCP System
A case with no exploit still moves the AITBM score: a change to an agent's authority boundary trips the C_event <= 0.35 cap and, with mutable behavioural state, the M_Em = 3.0 behavioural staleness floor - so 'nothing was breached' does not mean 'the prior assessment is still fresh'. It is also a clean example of Cp = 1.00 by default rather than by corroboration, because the gates in force were never shown to be bypassed.
Indicative ERS 6.1 · 2.1–10.0
2026-02-06 · Agentic / MCP System
Microsoft found that SessionsPythonPlugin DownloadFileAsync was exposed to model calls and accepted an AI-controlled localFilePath with no path restriction. In a controlled chain, the model created a script inside the isolated session and downloaded it into the host Windows Startup folder; host execution followed on the next sign-in.
Indicative ERS 4.1 · 1.2–7.0
2025-11-20 · Agentic / MCP System
The agent had a nominal workspace write boundary, but changing multi-root folders and settings could extend that boundary and activate an executable path. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-10-02 · Agentic / MCP System
Cursor had protected some editor-sensitive files, but a .code-workspace file could be modified without that approval. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-09-04 · Agentic / MCP System
Roo Code protected .vscode writes but did not apply the same approval to .code-workspace under the documented auto-approval configuration. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-08-11 · Agentic / MCP System
Zed limited writes outside the project and normally required terminal approval, but a project-local settings write let the agent disable that approval. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-08-02 · Agentic / MCP System
Cursor protected edits to existing dotfiles but did not apply the same approval gate to creating a new sensitive editor settings file. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-07-07 · Agentic / MCP System
Roo Code had an approval system, but with Write auto-approval enabled it did not protect .vscode/settings.json from agent writes. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-06-27 · Agentic / MCP System
A workspace read boundary existed, but search_files failed to enforce it; prompt influence could reach an outside file and schema-fetch URL. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-06-11 · Agentic / MCP System
The default schema fetch followed a model-influenced JSON write to an arbitrary external URL without a per-request authorization gate. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.1–6.4
2025-02-27 · Agentic / MCP System
MetaGPT 0.7.3 metagpt.strategy.tot.TreeofThought is one bounded prompt-to-code research path. The paper reports this CVE and 8.4 but no complete original vector was verified.
Indicative ERS 4.3 · 1.2–7.5
2025-02-27 · Agentic / MCP System
MetaGPT 0.7.3 DataInterpreter is one bounded prompt-to-code research path. The paper lists no CVE for this independent API.
Indicative ERS 4.3 · 1.2–7.5
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.
