PUBLIC-EVIDENCE TOPIC COLLECTION
AI data exposure cases involving connectors, cross-tenant access, credentials, local files, private prompts, cloud data, and exfiltration paths.
34 matched references · all link to complete source and scoring records
AI systems concentrate high-value context and frequently connect private sources to public or attacker-influenced sinks. This collection helps assessors trace whether data minimization, tenant isolation, retrieval authorization, output controls, and audit evidence actually constrain that path.
Framework routes: OWASP AISVS · CSA AI Security. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-09-24 · Agentic / MCP System
Existing CRM permission was real, yet task scope and output redaction failed in the controlled pre-fix chain.
Indicative ERS 5.5 · 1.7–9.4
2026-09-18 · Agentic / MCP System
When an agent's control interface is internet-reachable without effective authentication, identity, scope, escalation and output filtering all fail through the same door, so every Containment sub-metric the evidence touches sits at 0.00; AITBM's multi-dimensional profile exposes one deployment-exposure root cause, and the CRM (three elevated ORP dimensions) rather than the IVP carries the compounding.
Indicative ERS 6.9 · 2.7–10.0
2026-09-18 · Agentic / MCP System
A researcher-built replica on a real agent platform can be scored as a representative configuration when the source states its trigger, tools and reach — but its fidelity is staging-equivalent, and an email-triggered agent with bulk CRM read and unrestricted send reaches CRM 1.35 on autonomy, exposure and corroborated cascade alone.
Indicative ERS 7.5 · 3.3–10.0
2026-08-25 · Agentic / MCP System
The memory branch demonstrates persistent-state containment failure, now covered by Cn-9. A webpage-derived record entered durable memory without a promotion gate, and Varonis found that password changes, session revocation, and device re-registration left it in place until explicitly deleted. Recovery therefore requires checking and removing the affected durable state as well as ending sessions.
Indicative ERS 8.0 · 3.9–10.0
2026-08-25 · Agentic / MCP System
Disabling web search did not remove the sink, and that is the scoring lesson: Cn-1 is not measured by which features are switched off but by the complete inventory of outbound-capable tools an untrusted instruction can reach. A control that governs one named capability while a generic URL-retrieval path remains unrestricted is an inventory gap, which is why this scores 0.00 rather than the 0.25 that an enforced-but-leaky boundary would earn.
Indicative ERS 7.6 · 3.0–10.0
2026-08-24 · Agentic / MCP System
Popularity is not provenance. Ro-5 scores 0.00 not because the skill was malicious when reviewed — it was not — but because the admission decision was never bound to the bytes it approved, so an install counter earned on 5 July still authorised different content on 11 July. That is the same failure the Behavioural Attestation Window exists to price: approval that does not expire when behaviour changes.
Indicative ERS 7.8 · 3.8–10.0
2026-08-24 · Traditional ML / Classifier
Cn-1 scores 0.25 rather than 0.00 even though the SSRF succeeded completely, because AITBM scores the boundary that exists rather than the outcome that occurred: MLflow did have a destination policy and it did reject direct private-range URLs. What it lacked was binding that decision to the connection actually made — the distinction between a check and an enforcement point, which is exactly the gap between the 0.25 and 0.50 anchors.
Indicative ERS 5.0 · 1.8–8.2
2026-08-12 · Agentic / MCP System
Opaque state is not safe state: reasoning artifacts need confidentiality, principal/session binding, bounded retention, and an output gate before they enter logs or client-visible trajectories.
Indicative ERS 3.4 · 1.5–5.4
2026-08-06 · Agentic / MCP System
A tool supply-chain compromise can bypass the model entirely: the BCC was added in server code, so no prompt-injection or output control could have seen it, and AITBM places the evidence on Ro-5, Tr-4, Cn-1 and Cn-5 — the integrity, lineage, scope and publisher identity of the tool — while leaving Ro-1 unknown rather than inferring a model failure.
Indicative ERS 3.8 · 1.4–6.2
2026-08-06 · Agentic / MCP System
A human confirmation prompt is a real control and lifts Cn-2 and Cn-6 to 0.25, but it gates a tool class, not a reversibility class: an obscured command carrying a delegated-irreversible credential disclosure looked like any other shell call, so Cn-1 and Cp still resolve to the worst case.
Indicative ERS 5.0 · 1.9–8.1
2026-08-06 · Agentic / MCP System
Tool metadata is instruction input: a docstring alone moved an agent from a benign request to reading an SSH private key and exfiltrating it in a tool argument, so AITBM scores the receiving client (Cn-8, Ro-4, Cn-1, Cn-2, Cn-3) rather than the malicious server, which is attacker tooling, and places the leak on Cn-3 because the data left through a tool-call argument rather than through model memorisation.
Indicative ERS 4.5 · 1.6–7.4
2026-08-06 · RAG / Retrieval-Augmented System
Access control held and still leaked: Slack AI honoured every channel permission, which earns Cn-1 its 0.50, yet one authenticated member's public post steered the victim's authorised context into disclosing a private secret, so the loss is scored where it occurred — Ro-4, Pr-1 and Cn-3 — rather than in the permission model.
Indicative ERS 3.5 · 1.6–5.3
2026-08-02 · Agentic / MCP System
Persistent memory changes prompt injection from a one-chat event into delayed control flow; trusted intent must govern both memory promotion and every later rehydration.
Indicative ERS 6.0 · 2.6–9.3
2026-08-02 · RAG / Retrieval-Augmented System
Crediting a held control once and only once: Bard's CSP genuinely forced a bypass and earns Cn-1 its 0.50, but because it governs destinations rather than output content it does not also lift Cn-3, where the conversation-bearing URL rendered unexamined at 0.25.
Indicative ERS 4.3 · 1.6–7.0
2026-08-02 · Agentic / MCP System
A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
Indicative ERS 5.8 · 2.8–8.8
2026-08-02 · Tool-Calling LLM / Connected GenAI
A single injected page fails Cn-1 on two separate scope paths at once — the renderer's network destination and the model's tool selection — and both automated actions ran ungated, which is why Cn-6 sits at 0.00 even though the user never approved or saw either action.
Indicative ERS 4.9 · 1.6–8.3
2026-07-11 · Agentic / MCP System
A human-approval gate only counts for as much of the chain as it actually governs: Notion's page-edit approval was real enough to raise Aa to 0.50 and hold Cn-6 above zero, yet the render hop that fired before the gate carried the data out, which is exactly the worst-case chain-composition condition Cn-6's upper anchors require and the reason Cp still resolves to 1.00.
Indicative ERS 4.8 · 1.9–7.8
2026-07-07 · Agentic / MCP System
This case shows the Behavioral Attestation Window being correctly withheld: the agent is unambiguously Agentic and scores at the ORP ceiling, but none of the four BAW checklist items is evidenced for a single-session browser agent, so applying the behavioural staleness floor would have been an assumption rather than a finding — the freshness penalty here comes from the event and monitoring caps, which the evidence does support.
Indicative ERS 6.7 · 2.9–10.0
2026-07-07 · Agentic / MCP System
AgentFlayer is the batch's clearest case of a control that half-held changing two scores at once: because a URL reputation check existed and had to be bypassed, Cn-3 sits at the rubric's bypass anchor (0.25) rather than its absence anchor — yet under the GDCP rule that a gate may only be claimed at CBR >= 0.95, that same demonstrated bypass invalidates the gate for cascade purposes and makes Cp corroborated rather than defaulted. The 358-day evidence age is the second lesson: it drives Temporal Freshness toward zero and, per spec 3.3.4, that is the framework declaring the assessment stale rather than declaring the product risky.
Indicative ERS 5.8 · 2.7–8.9
2026-07-06 · Tool-Calling LLM / Connected GenAI
DifyTap is the case that separates audit-trail completeness from audit-trail safety: Tr-3 field coverage was strong enough for the 0.75 band and still capped at 0.50, because the 0.75 criterion requires the trail to be access-controlled — and the same records that made the platform investigable were the records that leaked across tenants.
Indicative ERS 4.9 · 2.2–7.5
2026-07-06 · Tool-Calling LLM / Connected GenAI
Two AITBM behaviours meet in this case: As sitting exactly on 0.75 keeps N_elevated at one and CRM at 1.00 even though the cascade path is corroborated all the way to a credential-issuing node, and 191-day-old evidence about a stateful consumer-facing app drives the behavioural freshness floor low enough that the honest conclusion is 'reassess', not 'here is a precise score'.
Indicative ERS 3.8 · 1.3–6.3
2026-07-06 · Agentic / MCP System
When a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-5 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped, version-boundaried vendor fix earns Rf = 0.00 without moving any IVP score, which is exactly the layer separation AITBM is built to preserve.
Indicative ERS 5.5 · 3.2–7.8
2026-06-29 · Agentic / MCP System
An approval policy can exist and still be the failure point: exempting self-addressed messages from approval is a real Cn-6 classification (0.25, not 0.00), but because the exempted hop is the one that releases bearer-equivalent links, the same exemption leaves the path to external disclosure ungated and corroborates Cp at 1.00.
Indicative ERS 5.9 · 2.9–8.9
2026-06-29 · Agentic / MCP System
When a backdoor lives in model-writable memory, the egress fix and the persistence fix are different remediations: closing the font-src channel under CVE-2026-24299 does not retire the unaudited record_memory write path, which is why Rf sits at 0.50, Tr-3 is scored from the Purview gap, and the behavioural staleness window applies.
Indicative ERS 5.9 · 2.9–8.9
2026-06-22 · Tool-Calling LLM / Connected GenAI
This is the clean illustration of cp_basis = 'default' versus 'corroborated': all four stack layers were reachable and data did leave the tenant, but every terminal node in the observed path was read-scoped, so the reconstruction supports 0.75 on its merits and Cp = 1.00 applies only because no verified System Dependency Graph exists — while the controls that held (CSP, entitlement scoping, a real sanitiser) raise Cn-2 and Ro-1 well above the containment floor.
Indicative ERS 4.8 · 2.3–7.3
2026-06-01 · Agentic / MCP System
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Indicative ERS 7.0 · 4.3–9.7
2026-05-15 · Agentic / MCP System
Nothing in this case reaches the model — there is no prompt, no injection, and no Robustness-1 signal at all — so AITBM's not-applicable redistribution rule carries the whole assessment on Containment, identity, and posture evidence, which is the correct answer for an incident where, as the brief puts it, security was lost before the model saw any prompt.
Indicative ERS 7.5 · 4.1–10.0
2026-05-03 · Agentic / MCP System
The exploited input never reached the model, which is exactly why Ro-1 must be scored over the agent's whole task-setup surface rather than its prompt: an agent's adversarial-input resistance is only as good as the least-validated field in the request that provisions its container.
Indicative ERS 4.0 · 1.9–6.1
2026-05-03 · Agentic / MCP System
Containment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely on Cn-1 and Cn-5 — and demonstrates that a 'no model involvement' incident is still an AI security finding, not an exemption from scoring.
Indicative ERS 4.2 · 2.2–6.2
2026-04-29 · RAG / Retrieval-Augmented System
An incident with no established root cause is still scorable — the enforced boundary and the missing release gate are directly observable from the outcome — and the unresolved mechanism belongs in ACI (thin coverage, a critical-invariant C_event cap) rather than being smoothed over with invented sub-metric scores; it is also the clearest example of a 'default' Cp, where 1.00 comes from the missing dependency graph and not from the impact.
Indicative ERS 3.5 · 1.4–5.6
2026-04-23 · RAG / Retrieval-Augmented System
This is the batch's clearest demonstration that a control which held still gets scored, and scored up: CSP blocked the direct egress domain and the XPIA classifier forced the attacker to craft plain prose, which is exactly why Cn-3 and Cn-1 sit at 0.50 and Ro-1 at 0.40 rather than at failure anchors — and the residual risk is carried instead by Cp, where a single demonstrated chain crossing a declared-blocked boundary invalidates that gate's containment claim and corroborates the 1.00 anchor.
Indicative ERS 4.3 · 1.9–6.7
2026-04-18 · Tool-Calling LLM / Connected GenAI
Identity, not the model, is the AI attack surface here: every low sub-metric sits in Containment (Cn-1, Cn-2, Cn-4, Cn-5, Cn-6 all at or near the floor) while Robustness barely features - and the case is the cleanest available demonstration of PAD >= 3 corroborating Cp = 1.00 on its merits, because one leaked frontend credential reached a P4 permission-issuing node with no gate on the path.
Indicative ERS 5.5 · 3.1–7.9
2026-04-16 · Agentic / MCP System
ForcedLeak shows why Cp = 1.00 here is corroborated rather than defaulted: a sink gate that a researcher's payload was observed crossing cannot be claimed at CBR >= 0.95, so the path counts as ungated to a P3 node on its own merits - and it shows a control can be simultaneously credited (Cn-1 = 0.25 not 0.00, because the CSP constrained the attacker) and defeated, which is what a two-sided assessment looks like.
Indicative ERS 7.6 · 3.7–10.0
2024-12-06 · Standalone LLM / Generative AI
One controlled CLI output boundary failed; model origin-label design and other terminal paths remain unmeasured.
Indicative ERS 3.2 · 1.0–5.4
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.
