PUBLIC-EVIDENCE TOPIC COLLECTION
AI supply-chain security cases covering malicious models, packages, extensions, routers, agent configuration, dependencies, and namespace reuse.
15 matched references · all link to complete source and scoring records
An AI system inherits risk from models, datasets, packages, plugins, registries, extensions, prompts, configuration, and hosted services. The cases below show how trusted names and normal developer workflows can become execution or data-theft paths.
Framework routes: MITRE ATLAS · AIDEFEND. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-08-12 · Agentic / MCP System
MCP onboarding cannot be a one-time trust decision: clients must bind descriptor and prompt semantics, detect drift, and re-authorize every consequential action against current user intent.
Indicative ERS 6.8 · 3.9–9.7
2026-08-06 · Agentic / MCP System
A confirmation gate that fired every time still let 16 users run an attacker's command within 8 hours, because it showed no provenance and the domain was a lookalike: AITBM credits the gate (Cn-6 0.25, Aa held at 0.75) while Ro-1, Ro-5, Tr-4 and Cn-5 record that everything upstream of it — instruction file, registry listing, publisher identity — was unverified.
Indicative ERS 6.0 · 2.6–9.4
2026-08-06 · Agentic / MCP System
Rules files are mutable behavioural state, so AITBM scores the backdoor through Ro-5 and Cn-5 (both 0.00) and applies the behavioural staleness window; the invisible Unicode defeats human review rather than a model filter, which is why it does not lift Cn-8 above the class precedent's 0.00.
Indicative ERS 6.2 · 2.9–9.5
2026-08-06 · Traditional ML / Classifier
A scanner that must fully deserialize an artifact to judge it sits on the wrong side of the code-execution boundary: the evasion holds Ro-5 at 0.25 only because a hub-side scan existed, while the loader compromise is carried by Containment rather than by any model property.
Indicative ERS 3.7 · 1.4–5.9
2026-08-02 · Standalone LLM / Generative AI
A targeted weight edit that moves aggregate benchmark accuracy by 0.1% is invisible to benchmark-based acceptance, so model supply-chain risk must be scored on provenance binding and targeted behavioural tests (Ro-5, Tr-4) rather than on benchmark parity.
Indicative ERS 3.1 · 1.1–5.1
2026-08-02 · Standalone LLM / Generative AI
A familiar model name is not an identity: deployment admission must bind approved bytes, signer, source ownership, and loader policy before first load and every reload.
Indicative ERS 4.0 · 1.7–6.4
2026-08-02 · Traditional ML / Classifier
Keeping the classifier server-side denies white-box access but not evasion: client-side feature disclosure plus an unthrottled verdict oracle were enough for a transfer attack that evaded the production model for most samples, so Ro-1 is the one observed placement and the containment sub-metrics that would govern oracle access remain UNKNOWN.
Indicative ERS 5.0 · 1.9–8.1
2026-08-02 · Agentic / MCP System
An attack that never ran can still be scored, but only where it was observed: the poisoned commit-to-release path yields Ro-5 and Cn-5 at 0.25, while every agent-side Containment sub-metric stays UNKNOWN because a syntax error, not a control, stopped execution — the wide interval is the honest result.
Indicative ERS 3.8 · 1.3–6.3
2026-08-02 · Traditional ML / Classifier
An ensemble whose secondary reputation model can override the primary classifier inherits the weaker model's robustness, and a log channel that exposes decision internals turns that weakness into a universal bypass: Ro-1 and Cn-4 carry the evidence while every other sub-metric stays UNKNOWN.
Indicative ERS 5.1 · 2.1–8.1
2026-06-01 · Agentic / MCP System
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Indicative ERS 7.0 · 4.3–9.7
2026-05-08 · Agentic / MCP System
The adversary never touched the model — it optimised the documentation the model reads — so the scoring weight lands on Ro-5 ingestion integrity and Cn-1/Cn-6 execution gating rather than on jailbreak resistance, and the case shows why AITBM scores the pipeline configuration rather than the assistant that proposed the change.
Indicative ERS 6.1 · 3.9–8.4
2026-05-03 · Agentic / MCP System
Containment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely on Cn-1 and Cn-5 — and demonstrates that a 'no model involvement' incident is still an AI security finding, not an exemption from scoring.
Indicative ERS 4.2 · 2.2–6.2
2026-04-25 · Agentic / MCP System
The trust boundary that fails here is neither the model nor the tool but the transport intermediary between them, and AITBM localises it precisely — Cn-5 = 0.25 for an unverifiable response origin under API-key-only identity and Cn-6 = 0.00 for ARCR = 0 under auto-approve — a failure that no model-layer sub-metric and no prompt-injection test would have surfaced.
Indicative ERS 8.0 · 5.4–10.0
2026-04-18 · Tool-Calling LLM / Connected GenAI
AITBM scores a software supply-chain compromise as an AI-system finding without distorting either: the AI-specific signal lands on Ro-5 (the dependency ingestion path is a poisoning channel), Cn-5 (static credentials with no workload binding) and Tr-4 (no AIBOM to bound the blast radius), while the thinness of published deployment detail is carried honestly by a base coverage of 4 of 22 rather than by inventing scores — the epistemic penalty appears in ACI, which is where the framework intends it.
Indicative ERS 4.3 · 1.8–6.9
2026-04-18 · Agentic / MCP System
A containment control can hold and the deployment still be compromised: the agent sandbox blocked in-runtime execution, which is why Cn-1 is scored up to 0.50 rather than down at a failure anchor, while the compromise travelled the one path the sandbox never covered — an instruction relayed through the human. AITBM captures this only because Cn-1's 0.50 anchor names delegated workflows explicitly, and because the assessment is required to score the control that held alongside the ones that did not.
Indicative ERS 6.0 · 2.8–9.1
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.
