PUBLIC-EVIDENCE TOPIC COLLECTION
Indirect and direct prompt injection case studies across copilots, connectors, browser agents, assistants, RAG, and operating-system AI.
7 matched references · all link to complete source and scoring records
Prompt injection becomes a system security problem when instructions from email, webpages, documents, notifications, connectors, or retrieved data can reach privileged tools or sensitive context. These records preserve the complete path from untrusted content to outcome.
Framework routes: OWASP LLM Top 10 · MITRE ATLAS. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-08-02 · Agentic / MCP System
Persistent memory changes prompt injection from a one-chat event into delayed control flow; trusted intent must govern both memory promotion and every later rehydration.
Indicative ERS 6.1 · 3.1–9.1
2026-07-07 · Agentic / MCP System
This is the cleanest Cn-6 = 0.00 in the set and shows why AITBM separates Cn-6 from Cn-1: the agent never exceeded its granted CRM permissions, so a permission-only assessment would find nothing wrong, yet the absence of any pre-execution reversibility classification let an ungated bounded-irreversible write execute repeatedly on the authority of anonymous external text.
Indicative ERS 6.4 · 2.8–10.0
2026-07-07 · Agentic / MCP System
AgentFlayer is the batch's clearest case of a control that half-held changing two scores at once: because a URL reputation check existed and had to be bypassed, Cn-3 sits at the rubric's bypass anchor (0.25) rather than its absence anchor — yet under the GDCP rule that a gate may only be claimed at CBR >= 0.95, that same demonstrated bypass invalidates the gate for cascade purposes and makes Cp corroborated rather than defaulted. The 358-day evidence age is the second lesson: it drives Temporal Freshness toward zero and, per spec 3.3.4, that is the framework declaring the assessment stale rather than declaring the product risky.
Indicative ERS 5.8 · 2.8–8.8
2026-06-09 · Agentic / MCP System
A confirmation gate that exists but is not bound to a canonical action summary earns Cn-6 = 0.25, not credit for human-in-the-loop control — and because the gate cannot be claimed at CBR >= 0.95, the same defect forces Cp to the corroborated 1.00 anchor by making an otherwise-gated path to a write-external node effectively ungated.
Indicative ERS 5.3 · 2.5–8.1
2026-04-25 · Agentic / MCP System
A population study can be scored honestly as a representative configuration, but only if the assurance layer carries the cost: Pc = 0.10 and a class-level Cp classified as default rather than corroborated are what keep the case from overclaiming — and the ORP shows the strict-inequality boundary at work, with Aa and Rf sitting exactly at 0.75 and therefore not counting toward N_elevated.
Indicative ERS 6.4 · 3.2–9.7
2026-04-25 · Tool-Calling LLM / Connected GenAI
Controls that held move the numbers as much as the ones that failed: a measured 76% attack success rate coexists with Cn-1 and Cn-2 at 0.50 (the OS app sandbox bounded the blast radius) and Rf at 0.25 (a platform patch shipped), so only Cascade Potential is elevated, N_elevated stays at one and no Compound Risk Alert is raised — a profile a failure-only assessment would have got badly wrong.
Indicative ERS 3.9 · 1.8–6.0
2026-04-16 · Agentic / MCP System
ForcedLeak shows why Cp = 1.00 here is corroborated rather than defaulted: a sink gate that a researcher's payload was observed crossing cannot be claimed at CBR >= 0.95, so the path counts as ungated to a P3 node on its own merits - and it shows a control can be simultaneously credited (Cn-1 = 0.25 not 0.00, because the CSP constrained the attacker) and defeated, which is what a two-sided assessment looks like.
Indicative ERS 7.7 · 4.0–10.0
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.
