PUBLIC-EVIDENCE TOPIC COLLECTION
AI data exposure cases involving connectors, cross-tenant access, credentials, local files, private prompts, cloud data, and exfiltration paths.
18 matched references · all link to complete source and scoring records
AI systems concentrate high-value context and frequently connect private sources to public or attacker-influenced sinks. This collection helps assessors trace whether data minimization, tenant isolation, retrieval authorization, output controls, and audit evidence actually constrain that path.
Framework routes: OWASP AISVS · CSA AI Security. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-08-12 · Agentic / MCP System
Opaque state is not safe state: reasoning artifacts need confidentiality, principal/session binding, bounded retention, and an output gate before they enter logs or client-visible trajectories.
Indicative ERS 3.5 · 1.5–5.4
2026-08-02 · Agentic / MCP System
Persistent memory changes prompt injection from a one-chat event into delayed control flow; trusted intent must govern both memory promotion and every later rehydration.
Indicative ERS 6.1 · 3.1–9.1
2026-08-02 · Agentic / MCP System
A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
Indicative ERS 5.7 · 2.6–8.8
2026-07-11 · Agentic / MCP System
A human-approval gate only counts for as much of the chain as it actually governs: Notion's page-edit approval was real enough to raise Aa to 0.50 and hold Cn-6 above zero, yet the render hop that fired before the gate carried the data out, which is exactly the worst-case chain-composition condition Cn-6's upper anchors require and the reason Cp still resolves to 1.00.
Indicative ERS 5.1 · 2.4–7.7
2026-07-07 · Agentic / MCP System
This case shows the Behavioral Attestation Window being correctly withheld: the agent is unambiguously Agentic and scores at the ORP ceiling, but none of the four BAW checklist items is evidenced for a single-session browser agent, so applying the behavioural staleness floor would have been an assumption rather than a finding — the freshness penalty here comes from the event and monitoring caps, which the evidence does support.
Indicative ERS 6.8 · 3.0–10.0
2026-07-07 · Agentic / MCP System
AgentFlayer is the batch's clearest case of a control that half-held changing two scores at once: because a URL reputation check existed and had to be bypassed, Cn-3 sits at the rubric's bypass anchor (0.25) rather than its absence anchor — yet under the GDCP rule that a gate may only be claimed at CBR >= 0.95, that same demonstrated bypass invalidates the gate for cascade purposes and makes Cp corroborated rather than defaulted. The 358-day evidence age is the second lesson: it drives Temporal Freshness toward zero and, per spec 3.3.4, that is the framework declaring the assessment stale rather than declaring the product risky.
Indicative ERS 5.8 · 2.8–8.8
2026-07-06 · Tool-Calling LLM / Connected GenAI
DifyTap is the case that separates audit-trail completeness from audit-trail safety: Tr-3 field coverage was strong enough for the 0.75 band and still capped at 0.50, because the 0.75 criterion requires the trail to be access-controlled — and the same records that made the platform investigable were the records that leaked across tenants.
Indicative ERS 4.9 · 2.3–7.5
2026-07-06 · Tool-Calling LLM / Connected GenAI
Two AITBM behaviours meet in this case: As sitting exactly on 0.75 keeps N_elevated at one and CRM at 1.00 even though the cascade path is corroborated all the way to a credential-issuing node, and 191-day-old evidence about a stateful consumer-facing app drives the behavioural freshness floor low enough that the honest conclusion is 'reassess', not 'here is a precise score'.
Indicative ERS 3.8 · 1.3–6.3
2026-07-06 · Agentic / MCP System
When a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-4 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped, version-boundaried vendor fix earns Rf = 0.00 without moving any IVP score, which is exactly the layer separation AITBM is built to preserve.
Indicative ERS 5.4 · 2.9–7.8
2026-06-22 · Tool-Calling LLM / Connected GenAI
This is the clean illustration of cp_basis = 'default' versus 'corroborated': all four stack layers were reachable and data did leave the tenant, but every terminal node in the observed path was read-scoped, so the reconstruction supports 0.75 on its merits and Cp = 1.00 applies only because no verified System Dependency Graph exists — while the controls that held (CSP, entitlement scoping, a real sanitiser) raise Cn-2 and Ro-1 well above the containment floor.
Indicative ERS 4.8 · 2.5–7.2
2026-06-01 · Agentic / MCP System
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Indicative ERS 6.7 · 3.8–9.7
2026-05-15 · Agentic / MCP System
Nothing in this case reaches the model — there is no prompt, no injection, and no Robustness-1 signal at all — so AITBM's not-applicable redistribution rule carries the whole assessment on Containment, identity, and posture evidence, which is the correct answer for an incident where, as the brief puts it, security was lost before the model saw any prompt.
Indicative ERS 7.2 · 3.4–10.0
2026-05-03 · Agentic / MCP System
The exploited input never reached the model, which is exactly why Ro-1 must be scored over the agent's whole task-setup surface rather than its prompt: an agent's adversarial-input resistance is only as good as the least-validated field in the request that provisions its container.
Indicative ERS 4.0 · 1.9–6.0
2026-05-03 · Agentic / MCP System
Containment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely on Cn-1 and Cn-5 — and demonstrates that a 'no model involvement' incident is still an AI security finding, not an exemption from scoring.
Indicative ERS 4.0 · 1.8–6.3
2026-04-29 · RAG / Retrieval-Augmented System
An incident with no established root cause is still scorable — the enforced boundary and the missing release gate are directly observable from the outcome — and the unresolved mechanism belongs in ACI (thin coverage, a critical-invariant C_event cap) rather than being smoothed over with invented sub-metric scores; it is also the clearest example of a 'default' Cp, where 1.00 comes from the missing dependency graph and not from the impact.
Indicative ERS 3.6 · 1.5–5.6
2026-04-23 · RAG / Retrieval-Augmented System
This is the batch's clearest demonstration that a control which held still gets scored, and scored up: CSP blocked the direct egress domain and the XPIA classifier forced the attacker to craft plain prose, which is exactly why Cn-3 and Cn-1 sit at 0.50 and Ro-1 at 0.40 rather than at failure anchors — and the residual risk is carried instead by Cp, where a single demonstrated chain crossing a declared-blocked boundary invalidates that gate's containment claim and corroborates the 1.00 anchor.
Indicative ERS 4.3 · 2.0–6.6
2026-04-18 · Tool-Calling LLM / Connected GenAI
Identity, not the model, is the AI attack surface here: every low sub-metric sits in Containment (Cn-1, Cn-2, Cn-4, Cn-5, Cn-6 all at or near the floor) while Robustness barely features - and the case is the cleanest available demonstration of PAD >= 3 corroborating Cp = 1.00 on its merits, because one leaked frontend credential reached a P4 permission-issuing node with no gate on the path.
Indicative ERS 5.6 · 3.2–7.9
2026-04-16 · Agentic / MCP System
ForcedLeak shows why Cp = 1.00 here is corroborated rather than defaulted: a sink gate that a researcher's payload was observed crossing cannot be claimed at CBR >= 0.95, so the path counts as ungated to a P3 node on its own merits - and it shows a control can be simultaneously credited (Cn-1 = 0.25 not 0.00, because the CSP constrained the attacker) and defeated, which is what a two-sided assessment looks like.
Indicative ERS 7.7 · 4.0–10.0
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.
