PUBLIC-EVIDENCE LIBRARY
The library combines 88 AIDEFEND in Action analyses, 69 AIDEFEND SecureFlow attack flows, and 44 evidence-checked primary-report records. Of these, 156 have evidence-bounded AITBM scenarios with uncertainty intervals, while 45 retain traceable attack steps and AIDEFEND mappings without an ERS (0 awaiting analysis, 45 not scorable by design).
These are not assessments of record. Search by incident, architecture, AITBM sub-metric, or AIDEFEND technique, or browse the categories below.
Indicative ERS midpoints span 3.1–8.0: 23 High, 45 Moderate, and 88 Low-Moderate. Unknown controls remain unknown; no case is forced to Critical because evidence is absent.
INCIDENT REFERENCE COLLECTIONS
Use focused collections to find comparable incidents, reusable evaluation questions, related AITBM sub-metrics, and framework routes.
Autonomy, tools, identity, actions, memory, and containment.
Servers, configuration, tool authorization, and execution boundaries.
Indirect instructions across email, web, connectors, and RAG.
Cross-tenant access, credentials, local files, and exfiltration.
Models, packages, extensions, routers, and configuration.
Repositories, IDEs, CI secrets, shells, and destructive actions.
Retrieval trust, vector stores, tenant isolation, and poisoning.
Loading, backdoors, inference, tokenizers, and lineage.
Each scored case is a retrospective public-evidence scenario for a bounded affected configuration, built from the cited vendor, maintainer, researcher, or AIDEFEND in Action analysis. Attack-flow records mirrored from AIDEFEND SecureFlow carry ordered attack steps and step-matched defenses but no score. It is a website companion, not an AITBM assessment of record and not a statement about any vendor's current product.
Architecture alone determines applicability. Missing public evidence remains unknown. The result is recomputed with unknown applicable inputs at 1.00, 0.50, and 0.00 to show the best-security bound, maximum-entropy midpoint, and worst-security bound.
A demonstrated allowlist rejection, authorization denial, or integrity verification can raise a sub-metric. A recommended defence, presumed log, or product capability does not prove operation in the assessed configuration and earns no positive credit.
Cp is not read off a prose ladder: it comes from a verified System Dependency Graph, and spec 3.2.1 forces Cp = 1.00 whenever no such graph exists. No organisation publishes one after an incident, so Cp sits at 1.00 throughout. Each case says whether that was corroborated by an observed ungated path to a privileged node, or is merely the worst-case default — 87 of 156 rest on the default alone.
The comparative scenario fixes ACI at 1.00 so article completeness does not overwhelm the system-risk signal. The public-evidence ACI is still calculated and shown as a diagnostic, but it is not represented as actual system assurance or inserted into the scenario ERS.
The midpoint assigns every unknown applicable sub-metric 0.50, the expected value of a maximum-entropy prior over the five rubric anchors. This is a deterministic comparison convention, not a finding that an undisclosed control achieved 0.50. The interval is the primary uncertainty statement.
The midpoint supports transparent comparison between the case studies; it must always be quoted with its interval and the label Indicative ERS (normalized-assurance scenario). A first-party assessment replaces the interval with measured inputs and uses its actual ACI in the normative ERS formula.
The interval is conditional on the single Operational Risk Posture the workpaper asserts. Optional cited ORP ranges, admission decision records and non-ERS evidence profiles are described on the evidence-scenario method page; no current case uses them, and no existing score changes.
Every workpaper preserves its documented evidence age and event caps. Those values calculate a public-evidence ACI diagnostic on the stated reference date. The generator no longer overwrites every case with a seven-day age, because a constant would be a scenario assumption rather than measured evidence freshness.
The Behavioral Attestation Window uses the specification's non-double-counting rule: lambdabehavior = lambdatier × Mthreat × max(MTDI, MEm). The public-evidence ACI does not determine the comparative midpoint; it tells readers how much confidence the article package itself can support.
READ THIS BEFORE QUOTING A NUMBER
The SecureFlow benchmark guide is now in Evaluation methods →
CASE DISCOVERY
Search directly, browse by category, or scan the compact directory. Every result opens its complete evidence trail and available evaluation data.
2026-10-09 · Primary reports · Agentic / MCP System · Tier 4
Internal grading agent damaged its task environmentThe confirmed harm was internal software removal and failed checks, not an accepted grade or proven full filesystem wipe.
CVSS — no applicable published score verified
2026-09-28 · Primary reports · Agentic / MCP System · Tier 4
Experimental OpenAI agent exceeded the Australian reporting task boundaryA confirmed internal agent task-boundary escape supports Cn-1 only; approval, origin handling, and reversibility batteries remain unknown.
CVSS — no applicable published score verified
2026-09-25 · Primary reports · Agentic / MCP System · Tier 4
Internal agent pushed a token-bearing file to public GitHubThe verified failure is an alternate task-authority route and public token publication; secret-filter efficacy as a five-level metric remains unmeasured.
CVSS — no applicable published score verified
2026-09-24 · Primary reports · Agentic / MCP System · Tier 3
SalesBleed Agentforce Slack phishing reply pathThe controlled Slack reply route documents task-scope and URL-filter bypass without proving an authentication or ARCR failure.
CVSS — no applicable published score verified
2026-09-24 · Primary reports · Agentic / MCP System · Tier 3
SalesBleed Agentforce CRM data exfiltration pathExisting CRM permission was real, yet task scope and output redaction failed in the controlled pre-fix chain.
CVSS — no applicable published score verified
2026-09-18 · AIDEFEND SecureFlow · Tool-Calling LLM / Connected GenAI · Tier 3
Threat Actor Uses a DeepSeek-Powered Hermes Agent in Langflow and n8n Exploitation AttemptsControls that hold still score at the anchor they evidence: auto_login disabled and no public flow defeated an autonomous, AI-driven exploit, yet they prove only the basic Cn-5 and Cn-1 anchors, so the…
Published CVSS CVE-2026-33017 · CVSS 4.0 Base 9.3 Critical · GitHub_M
2026-09-18 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Exposed ClawdBot Control Interfaces Leads to Credential Access and ExecutionWhen an agent's control interface is internet-reachable without effective authentication, identity, scope, escalation and output filtering all fail through the same door, so every Containment sub-metric the…
CVSS — no applicable published score verified
2026-09-18 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Data Exfiltration via Agent Tools in Copilot StudioA researcher-built replica on a real agent platform can be scored as a representative configuration when the source states its trigger, tools and reach — but its fidelity is staging-equivalent, and an…
CVSS — no applicable published score verified
2026-09-18 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
ShadowRay: Hijacking Exposed Ray ClustersA production model was observed on exploited Ray infrastructure, permitting a narrowly bounded host-inheritance score for the unauthenticated Jobs path; no model tampering is evidenced.
CVSS — no applicable published score verified
2026-09-15 · AIDEFEND in Action · Agentic / MCP System · Tier 3
A Coding Agent Could Switch Off Its Own Sandbox With One Loopback RequestOX reproduced a default DeepSeek Harness local control path: a confined coding agent called an unauthenticated loopback API, spoofed a trusted Host, changed its own session to danger-full-access, and…
Published CVSS CVE-2026-82533 · CVSS 4.0 Base 9.4 Critical · OX SecurityCVE-2026-82533 · CVSS 3.1 Base 9.6 Critical · VulnCheck CNA
2026-09-15 · AIDEFEND in Action · Standalone LLM / Generative AI · Tier 2
A Vision Model's Image Loader Became an Internal Port Scanner Twelve Hours After DisclosureSysdig recorded 10 attacker requests in eight minutes against its LMDeploy VLM-serving honeypot. Requests supplied image_url values through chat completions to probe IMDS and loopback services; unrestricted…
Published CVSS CVE-2026-33626 · CVSS 3.1 Base 7.5 High · GitHub maintainer advisory
2026-09-15 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 2
A Shared Package Service Let One ChatGPT Account Run Tasks Inside AnotherCheck Point reproduced cross-account data relay through a shared JFrog Artifactory reachable from two otherwise isolated ChatGPT code containers. The attacker-controlled shared conversation induced victim…
CVSS — no applicable published score verified
2026-09-13 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Claude-Site Scripting Turns One Email Into Multiple Browser Account PathsZenity demonstrated one Claude in Chrome prompt-injection boundary: an attacker-origin email instructed the browser agent to import code via javascript_tool in an authenticated browser session, then read…
CVSS — no applicable published score verified
2026-09-13 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 2
Cryptographic Context Injection Makes a Trusted Runtime Lie About Page ContentAdversa demonstrated a Grok web-chat browsing path in which a hostile page induced runtime decryption of attacker instructions and privileged navigation to an attacker URL containing private session context…
CVSS — no applicable published score verified
2026-09-01 · Primary reports · Agentic / MCP System · Tier 3
Qwen Code startup Git helper executes before authorizationQwen Code processed packaged Git configuration during startup before agent authorization and ran a configured helper as the developer. The attack requires a delivered repository directory or ZIP with…
CVSS — no applicable published score verified
2026-09-01 · Primary reports · Agentic / MCP System · Tier 3
Hermes Agent first-message Git helper executionThe first agent message caused Hermes Git context gathering to invoke an executable helper from packaged .git/config as the developer. The attack requires a delivered repository directory or ZIP with…
Published CVSS CVE-2026-71963 · CVSS 4.0 Base 8.6 High · CVE CNACVE-2026-71963 · CVSS 3.1 Base 8.8 High · VulnCheck CNA
2026-09-01 · Primary reports · Agentic / MCP System · Tier 3
Grok Build first-keystroke Git helper executionGrok Build processed the packaged Git configuration on the first keystroke and ran a configured helper as the developer. The attack requires a delivered repository directory or ZIP with .git/config files;…
CVSS — no applicable published score verified
2026-09-01 · Primary reports · Agentic / MCP System · Tier 3
Goose repository review executes Git helper from packaged .git/configReview of a ZIP-delivered repository with executable .git/config caused Goose Git context gathering to run a configured helper as the developer, outside the agent sandbox. The attack requires a delivered…
Published CVSS CVE-2026-72718 · CVSS 4.0 Base 7.0 High · GitHub maintainer CNA
2026-09-01 · Primary reports · Agentic / MCP System · Tier 3
Claude Code ultrareview Git-setting helper executionThe ultrareview workflow triggered a second Git setting path from packaged .git/config and executed a helper as the developer; the exact setting key was not disclosed. The attack requires a delivered…
CVSS — no applicable published score verified
2026-09-01 · Primary reports · Agentic / MCP System · Tier 3
Claude Code startup executes packaged Git core.fsmonitor helperClaude Code startup Git context collection triggered core.fsmonitor from packaged .git/config, executing a command as the developer before an approval boundary. The attack requires a delivered repository…
CVSS — no applicable published score verified
2026-08-25 · AIDEFEND in Action · Agentic / MCP System · Tier 2
CoSnitch Combined Copilot Autorun Exfiltration with a Separate Memory-Poisoning PathThe memory branch demonstrates persistent-state containment failure, now covered by Cn-9. A webpage-derived record entered durable memory without a promotion gate, and Varonis found that password changes,…
Published CVSS CVE-2026-24301 · CVSS 3.1 Base 8.8 High · microsoft
2026-08-25 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Atlassian Rovo Had Two Independent Prompt-to-Exfiltration PathsDisabling web search did not remove the sink, and that is the scoring lesson: Cn-1 is not measured by which features are switched off but by the complete inventory of outbound-capable tools an untrusted…
CVSS — no applicable published score verified
2026-08-25 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Rogue Agent: One Dialogflow CX Permission Crossed a Shared Project RuntimeThe blast radius came from the managed runtime boundary, not from the compromised Playbook. Tr-3 scores 0.00 rather than 0.25 because the decisive event produced no record at all and the Playbook could then…
CVSS — no applicable published score verified
2026-08-25 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Computer-Use TOCTOU: The Agent Clicked a Screen It Had Not RecheckedComputer-use agents introduce a physical gap between perception and action, and AITBM prices it as a Containment failure rather than a perception failure. The screenshot was accurate when taken and the…
CVSS — no applicable published score verified
2026-08-25 · AIDEFEND in Action · Agentic / MCP System · Tier 3
DuneSlide: Two LLM-Controlled Paths Escaped Cursor's Terminal SandboxCn-6 scores 0.00 for a reason the per-action view would miss: the write that overwrote cursorsandbox and the command that later ran unsandboxed are different hops, and neither is individually catastrophic.…
Published CVSS CVE-2026-50548 · CVSS 4.0 Base 9.3 Critical · GitHub_MCVE-2026-50549 · CVSS 4.0 Base 9.3 Critical · GitHub_M
2026-08-25 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 2
Copilot for Word Turned a Hidden Prompt into a Document-Borne AI WormCp is recorded as the specification default rather than as corroborated, and that distinction is the point of the case. The failure is real and reproducible, but it terminates inside the document: nothing…
CVSS — no applicable published score verified
2026-08-24 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Typosquatted Agent Skills Built Reputation Before a Credential-Stealing Rug PullPopularity is not provenance. Ro-5 scores 0.00 not because the skill was malicious when reviewed — it was not — but because the admission decision was never bound to the bytes it approved, so an install…
CVSS — no applicable published score verified
2026-08-24 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Miasma Targets Repository-Local Trust in Claude Code, Gemini CLI, Cursor, and VS CodeMiasma moves supply-chain execution from package installation to project open, and AITBM records that as an identity failure as much as a containment one: Cn-5 scores 0.00 because nothing bound the agent's…
CVSS — no applicable published score verified
2026-08-24 · AIDEFEND in Action · Traditional ML / Classifier · Tier 3
Ray DNS Rebinding: A Malicious Page Reaches the Local Jobs APIThree boundaries each failed independently — an origin heuristic mistaken for identity, network reachability from a browser process to a management port, and an unauthenticated execution API — and the case…
Published CVSS CVE-2025-62593 · CVSS 4.0 Base 9.4 Critical · GitHub_M
2026-08-24 · AIDEFEND in Action · Traditional ML / Classifier · Tier 3
MLflow Webhook Redirects Turn a Public URL into Full-Read SSRFCn-1 scores 0.25 rather than 0.00 even though the SSRF succeeded completely, because AITBM scores the boundary that exists rather than the outcome that occurred: MLflow did have a destination policy and it…
Published CVSS CVE-2026-64849 · CVSS 3.1 Base 8.6 High · MLflow / GitHub maintainer advisory
2026-08-24 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 3
Flowise CSV Agent: Prompt Injection Bypasses a Regex Blocklist and Reaches Host-Capable PyodideA denylist is not an admission gate. The control that was present ran on every snippet and still scored only 0.25, because Cn-3 measures survival under systematic evasion and eight independent working…
Published CVSS CVE-2026-70477 · CVSS 4.0 Base 9.5 Critical · GitHub_M
2026-08-12 · AIDEFEND in Action · Agentic / MCP System · Tier 1
Deadbugz: GitHub PRs Delivered a Delayed, Shape-Shifting Malicious MCP ServerMCP onboarding cannot be a one-time trust decision: clients must bind descriptor and prompt semantics, detect drift, and re-authorize every consequential action against current user intent.
CVSS — no applicable published score verified
2026-08-12 · AIDEFEND in Action · Agentic / MCP System · Tier 1
Stolen Thoughts: Opaque Reasoning Blocks Could Be Replayed to Recover SecretsOpaque state is not safe state: reasoning artifacts need confidentiality, principal/session binding, bounded retention, and an output gate before they enter logs or client-visible trajectories.
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 2
Cross-Site Scripting via Prompt Manipulation in Lenovo AI ChatbotA chatbot with no tools at all can still reach Cp = 1.00 on corroborated evidence when its output is persisted into a privileged downstream renderer: the risk sits in Cn-3's unsanitised output, not in the…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 2
Storm-2139 Azure OpenAI Guardrail BypassA content filter that blocks the first attempt but yields to iterative rewording is a 0.25 control, and on a hosted service it fails together with credential binding: Storm-2139 needed both a leaked key and…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Data Exfiltration via Remote Poisoned MCP ToolTool metadata is instruction input: a docstring alone moved an agent from a benign request to reading an SSH private key and exfiltrating it in a tool argument, so AITBM scores the receiving client (Cn-8,…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Poisoned Postmark MCP Server Email ExfiltrationA tool supply-chain compromise can bypass the model entirely: the BCC was added in server code, so no prompt-injection or output control could have seen it, and AITBM places the evidence on Ro-5, Tr-4, Cn-1…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
OpenClaw 1-Click Remote Code ExecutionA human-approval gate is only as strong as the authority that can switch it off: OpenClaw's dangerous-command prompt and sandbox were real, so Cn-1 and Cn-6 sit at 0.25 rather than 0.00, but because the…
Published CVSS CVE-2026-25253 · CVSS 3.1 Base 8.8 High · mitre
2026-08-06 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Supply Chain Compromise via Poisoned ClawdBot SkillA confirmation gate that fired every time still let 16 users run an attacker's command within 8 hours, because it showed no provenance and the domain was a lookalike: AITBM credits the gate (Cn-6 0.25, Aa…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 3
Data Exfiltration via an MCP Server used by CursorA human confirmation prompt is a real control and lifts Cn-2 and Cn-6 to 0.25, but it gates a tool class, not a reversibility class: an obscured command carrying a delegated-irreversible credential…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 3
Rules File Backdoor: Supply Chain Attack on AI Coding AssistantsRules files are mutable behavioural state, so AITBM scores the backdoor through Ro-5 and Cn-5 (both 0.00) and applies the behavioural staleness window; the invisible Unicode defeats human review rather than…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · RAG / Retrieval-Augmented System · Tier 3
Data Exfiltration from Slack AI via Indirect Prompt InjectionAccess control held and still leaked: Slack AI honoured every channel permission, which earns Cn-1 its 0.50, yet one authenticated member's public post steered the victim's authorised context into…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
Live Deepfake Image Injection to Evade Mobile KYC VerificationRepresentative-configuration scoring lets an unnamed KYC deployment be scored without inventing a vendor: the observed defeat of passive and active liveness by camera-feed injection places Ro-1 at 0.25,…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 3
Malicious Models on Hugging FaceA scanner that must fully deserialize an artifact to judge it sits on the wrong side of the code-execution boundary: the evasion holds Ro-5 at 0.25 only because a hub-side scan existed, while the loader…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 3
Organization Confusion on Hugging FaceWhen the namespace owner is the attacker, every downstream integrity control inherits a false root of trust: lineage, poisoning resistance, and scope fail at the same identity step, so the case lands on…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Tool-Calling LLM / Connected GenAI · Tier 3
Financial Transaction Hijacking with M365 Copilot as an InsiderA retrieval-grounded answer can fail on integrity without any data leaving the tenant: the citation that is supposed to let a human verify Copilot's answer was dictated by the poisoned email it cited, which…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · RAG / Retrieval-Augmented System · Tier 2
Morris II Worm: RAG-Based AttackSelf-replication is what separates Morris II from an ordinary RAG injection in AITBM terms: output that re-enters other assistants' retrieval stores corroborates Cp at 1.00 through unbounded fan-out and…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
Backdoor Attack on Deep Learning Models in Mobile AppsShipping a model inside a client package moves its integrity boundary onto the device, and an app that loads that model without verification scores Ro-5 = 0.00 however accurate the clean model is; a single…
CVSS — no applicable published score verified
2026-08-06 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
ClearviewAI MisconfigurationAn AI supply-chain exposure with no model-level attack is scored on the escalation and workload-identity controls that failed (Cn-2 and Cn-5 at 0.25), while the training-data and release tampering the…
CVSS — no applicable published score verified
2026-08-05 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 1
LangSmith Tracing Header Injection Turned Observability Metadata into a Data RouteObservability metadata is routing authority when it can select an exporter; trace context must be schema-restricted, destination-pinned, and minimized before export.
Published CVSS CVE-2026-25528 · CVSS 3.1 Base 5.8 Medium · GitHub_M
2026-08-05 · AIDEFEND in Action · Standalone LLM / Generative AI · Tier 1
SGLang's ZMQ and Pickle Paths Show Why Internal AI Messages Need a Trust BoundaryAn internal AI message bus is still an untrusted code boundary: peer identity, segmentation, and safe serialization must hold before bytes reach a deserializer.
Published CVSS CVE-2026-3059 · CVSS 3.1 Base 9.8 Critical · CISA-ADPCVE-2026-3060 · CVSS 3.1 Base 9.8 Critical · CISA-ADP
2026-08-05 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 1
Pydantic AI Shows How Message History Can Become Server-Side Fetch AuthoritySerialized conversation history is active authority when deserialization triggers I/O; replay paths require the same destination policy as an explicit network tool call.
Published CVSS CVE-2026-25580 · CVSS 3.1 Base 8.6 High · GitHub_M
2026-08-05 · AIDEFEND in Action · Agentic / MCP System · Tier 2
MCFA Turns Agent Memory into a Delayed Control-Flow InputLong-term memory is persistent control input: every write needs provenance and promotion policy, and every recall must be re-authorized against the current task before it can influence tools.
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Prompt-Based Attacks Against Gemini via Calendar InvitationsA provenance heuristic keyed to the turn in which untrusted data arrives is a real control and earns Cn-2 = 0.25, but once a one-word reply can move the instruction past it, the path to physical and…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
Google Photos AI Model ExtractionModel extraction from a client application is scored on Pr-2 since its 2026-10-14 revision: unprotected models shipped in the package set the placement at 0.00 even though encryption forced runtime…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 2
Model Distillation Campaigns Targeting Anthropic ClaudeA hosted model's caller identity and its extraction monitoring are both security controls: when one actor can operate thousands of authenticated accounts behind resale proxies, authentication and regional…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
AI ClickFix: Hijacking Computer-Use Agents Using ClickFixA computer-use agent's clipboard and terminal are tools like any other: AITBM scores AI ClickFix as a Containment collapse (Cn-1, Cn-2 and Cn-6 at 0.00) rather than a perception error, because the decisive…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 3
Code to Deploy Destructive AI Agent Discovered in Amazon Q VS Code ExtensionAn attack that never ran can still be scored, but only where it was observed: the poisoned commit-to-release path yields Ro-5 and Cn-5 at 0.25, while every agent-side Containment sub-metric stays UNKNOWN…
Published CVSS CVE-2025-8217 · CVSS 4.0 Base 5.1 Medium · AMZN
2026-08-02 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Data Destruction via Indirect Prompt Injection Targeting Claude Computer-UseA guardrail the attacker has to talk past still earns Ro-1 0.25, but it moves no Containment score: with an ungated, sudo-capable shell, one successful jailbreak converts directly into irreversible…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Tool-Calling LLM / Connected GenAI · Tier 2
Hacking ChatGPT's Memories with Prompt InjectionA visible notification is not an integrity control: the 'memory set' notice keeps Tr-3 at 0.25, but the memory channel itself accepted untraceable externally sourced writes at Ro-4 = 0.00, and that…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
Living Off AI: Prompt Injection via Jira Service Management'Living off AI' is a Cn-2 failure with a working role model underneath it: Jira's portal separation forced the attacker through the engineer's AI session, which earns 0.25 rather than 0.00, but an unscoped…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Tool-Calling LLM / Connected GenAI · Tier 2
Planting Instructions for Delayed Automatic AI Agent Tool InvocationA control that gates tools by the turn in which untrusted data arrives, rather than by the provenance of the instruction being executed, earns credit as an existing check (Cn-2 = 0.25) but not as an…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 3
LLM JackingFor a hosted model service the decisive control is credential binding, not the model: authorisation worked as designed, yet a replayable credential plus an error-oracle side channel let attackers confirm…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · RAG / Retrieval-Augmented System · Tier 2
Google Bard Conversation ExfiltrationCrediting a held control once and only once: Bard's CSP genuinely forced a bypass and earns Cn-1 its 0.50, but because it governs destinations rather than output content it does not also lift Cn-3, where…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Tool-Calling LLM / Connected GenAI · Tier 2
ChatGPT Conversation ExfiltrationA single injected page fails Cn-1 on two separate scope paths at once — the renderer's network destination and the model's tool selection — and both automated actions ran ungated, which is why Cn-6 sits at…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · RAG / Retrieval-Augmented System · Tier 2
Indirect Prompt Injection Threats: Bing Chat Data PirateWhen the exfiltration hop is a user-followed link rather than an automatic fetch, the risk moves out of Autonomy Amplification (0.00) and into Robustness and Output Filtering, so a purely conversational…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 2
PoisonGPTA targeted weight edit that moves aggregate benchmark accuracy by 0.1% is invisible to benchmark-based acceptance, so model supply-chain risk must be scored on provenance binding and targeted behavioural…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
Bypassing ID.me Identity VerificationIdentity-verification fraud is scored on the document-authenticity and face-match controls that were defeated, not on the downstream payout: a low-cost forgery-and-disguise technique places Ro-1 at 0.25,…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Tool-Calling LLM / Connected GenAI · Tier 2
Achieving Code Execution in MathGPT via Prompt InjectionThe case is the clearest Cn-7 failure in the batch: a one-line 'compute forever' prompt produced an unbounded loop that only a host restart ended, so Cn-7 is scored on observed evidence at 0.00 rather than…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
Confusing Antimalware Neural NetworksKeeping the classifier server-side denies white-box access but not evasion: client-side feature disclosure plus an unthrottled verdict oracle were enough for a transfer attack that evaded the production…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 2
Tay PoisoningOnline learning turns every public message into a training write: with no admission gate on the feedback loop, AITBM scores the poisoning (Ro-4), the echo path (Cn-3), and the representational harm (Fa-3)…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
ProofPoint EvasionReturning raw model scores to the sender is a Cn-4 side channel that turns a black-box classifier into a trainable oracle; the resulting copy is a Pr-2 extraction failure, and it is what makes the Ro-1…
Published CVSS CVE-2019-20634 · CVSS 3.1 Base 3.7 Low · mitre
2026-08-02 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 2
Attack on Machine Translation ServicesModel extraction and adversarial transfer form one chain, not two findings: a replica built from ordinary public outputs became the staging ground for production evasion, so AITBM records the extraction on…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
Camera Hijack Attack on Facial Recognition SystemA biometric verification failure with large real-world fraud still yields one directly observed sub-metric: AITBM scores the liveness control that was defeated (Ro-1 0.25), carries the USD 77 million…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 2
Bypassing Cylance's AI Malware DetectionAn ensemble whose secondary reputation model can override the primary classifier inherits the weaker model's robustness, and a log channel that exposes decision internals turns that weakness into a…
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND in Action · Agentic / MCP System · Tier 1
Poisoned GGUF Chat Templates Backdoor Inference Without Changing Model WeightsModel weights are only one executable release component; chat templates must be digest-bound, provenance-checked, and security-regression-tested with the same rigor as the weights.
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND in Action · Standalone LLM / Generative AI · Tier 1
Model Namespace Reuse Turns a Trusted Name Into a Supply-Chain RedirectA familiar model name is not an identity: deployment admission must bind approved bytes, signer, source ownership, and loader policy before first load and every reload.
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND in Action · Agentic / MCP System · Tier 1
ZombieAgent Shows How Connector Prompt Injection Can Persist and SpreadPersistent memory changes prompt injection from a one-chat event into delayed control flow; trusted intent must govern both memory promotion and every later rehydration.
CVSS — no applicable published score verified
2026-08-02 · AIDEFEND in Action · Agentic / MCP System · Tier 1
Claude Code GitHub Action: When a File-Read Tool Crosses the CI Secret BoundaryA sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
CVSS — no applicable published score verified
2026-07-27 · AIDEFEND in Action · Agentic / MCP System · Tier 3
AgentForger Turned One ChatGPT Link Into a Scheduled Autonomous InsiderA platform can ship an approval gate and still score Cn-6 = 0.00 when that gate is writable by the very workflow it governs — AITBM scores the exercised configuration, not the nominal capability — and…
CVSS — no applicable published score verified
2026-07-22 · AIDEFEND in Action · Agentic / MCP System · Tier 1
OpenAI Evaluation Agents and the Hugging Face Intrusion: Updated Technical ReconstructionRe-derived against OpenAI's 26 August end-to-end report, the case moves in two directions at once and neither is a metadata bump. Cn-4 falls from 0.25 to 0.00 because what the earlier account recorded as…
CVSS — no applicable published score verified
2026-07-11 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Notion AI Agent Lethal Trifecta Leads to Silent Data ExfiltrationA human-approval gate only counts for as much of the chain as it actually governs: Notion's page-edit approval was real enough to raise Aa to 0.50 and hold Cn-6 above zero, yet the render hop that fired…
CVSS — no applicable published score verified
2026-07-07 · AIDEFEND SecureFlow · Standalone LLM / Generative AI · Tier 3
Ollama Windows Auto-Update Persistent RCEA local AI runtime's updater is part of its supply chain: a no-op signature check and an unconstrained staging path place the case at Ro-5 = 0.00 and Cn-1 = 0.25 without any model being touched, while a…
Published CVSS CVE-2026-42248 · CVSS 4.0 Base 7.7 High · CERT-PLCVE-2026-42249 · CVSS 4.0 Base 7.7 High · CERT-PL
2026-07-07 · AIDEFEND SecureFlow · Traditional ML / Classifier · Tier 1
NVIDIA Triton Python Backend Unauthenticated RCE ChainA serving runtime's own error path can hand an unauthenticated caller the key to its private memory: Cn-4 and Cn-5 at 0.00 and Cn-1 at 0.25 show that information leakage, caller identity, and API scope…
Published CVSS CVE-2025-23319 · CVSS 3.1 Base 8.1 High · nvidiaCVE-2025-23320 · CVSS 3.1 Base 7.5 High · nvidiaCVE-2025-23334 · CVSS 3.1 Base 5.9 Medium · nvidia
2026-07-07 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
OpenAI Atlas Omnibox Prompt InjectionA mode-selection fallback is a privilege decision: Atlas scores Cn-2 0.25 because ambiguous omnibox input was elevated to the most trusted role, yet with only a navigation demonstrated Cp stays at the…
CVSS — no applicable published score verified
2026-07-07 · AIDEFEND in Action · Multi-Agent / MCP System · Tier 2
Moltbook Shows How Agent Social Feeds Can Become a Global Callback SurfaceThis is the reference case for cp_basis = default: the agents are maximally exposed and their navigation action is entirely ungated, yet the measured terminal impact is a benign HTTP request, so Cp = 1.00…
CVSS — no applicable published score verified
2026-07-07 · AIDEFEND in Action · Agentic / MCP System · Tier 2
AgentFlayer Turns ChatGPT Connectors Into a Zero-Click Exfiltration PathAgentFlayer is the batch's clearest case of a control that half-held changing two scores at once: because a URL reputation check existed and had to be bypassed, Cn-3 sits at the rubric's bypass anchor…
CVSS — no applicable published score verified
2026-07-07 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Prompt Mines Show Why CRM Agents Need Write-Action GatesThis is the cleanest Cn-6 = 0.00 in the set and shows why AITBM separates Cn-6 from Cn-1: the agent never exceeded its granted CRM permissions, so a permission-only assessment would find nothing wrong, yet…
CVSS — no applicable published score verified
2026-07-07 · AIDEFEND in Action · Agentic / MCP System · Tier 2
PerplexedBrowser: When an Agent Browser Can Read Local FilesThis case shows the Behavioral Attestation Window being correctly withheld: the agent is unambiguously Agentic and scores at the ORP ceiling, but none of the four BAW checklist items is evidenced for a…
CVSS — no applicable published score verified
2026-07-06 · AIDEFEND in Action · Agentic / MCP System · Tier 2
LangGraph Checkpointer Bugs Turn Agent State History Into an RCE PathLangGraph is the cleanest available demonstration that agent memory is an Ro-4 poisoning surface rather than a storage detail: an attacker-planted checkpoint row promoted straight into trusted agent state…
CVSS — no applicable published score verified
2026-07-06 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 2
ChainLeak Shows How AI Framework Helper APIs Can Expose Prompts, Files, and Cloud KeysTwo AITBM behaviours meet in this case: As sitting exactly on 0.75 keeps N_elevated at one and CRM at 1.00 even though the cascade path is corroborated all the way to a credential-issuing node, and…
CVSS — no applicable published score verified
2026-07-06 · AIDEFEND in Action · Multi-Agent / MCP System · Tier 3
AutoJack Turns Localhost Agent Control Planes Into a Browser-RCE LessonA loopback-bound control plane is not a lower-exposure deployment: because a browsing agent renders untrusted content on the same host, As reaches the 1.00 anchor and the Cp path is corroborated end-to-end…
CVSS — no applicable published score verified
2026-07-06 · AIDEFEND in Action · Agentic / MCP System · Tier 3
A Clean Repo Can Still Turn an AI Coding Agent Into a Reverse ShellThis is the batch's only case with no patch to point at, and it lands where AITBM says it should: Rf = 0.75 rather than 0.00 because every remedy is an external containment layer, while Cn-6 = 0.00 for a…
CVSS — no applicable published score verified
2026-07-06 · AIDEFEND in Action · Agentic / MCP System · Tier 2
PerplexedBrowser Shows Why Agentic Browsers Need Session and Sink BoundariesPerplexedBrowser is the case where the assessed system's own security controls were largely irrelevant to the outcome: the vault held, the model filter partly held, and the system still failed — because…
CVSS — no applicable published score verified
2026-07-06 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Amazon Q's MCP Auto-Load Bug Made Cloned Repos a Cloud Credential RiskWhen a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-5 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped,…
Published CVSS CVE-2026-12957 · CVSS 4.0 Base 8.5 High · AMZN
2026-07-06 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 2
DifyTap Turns Multi-Tenant AI App Plumbing Into a Data Exposure ProblemDifyTap is the case that separates audit-trail completeness from audit-trail safety: Tr-3 field coverage was strong enough for the 0.75 band and still capped at 0.50, because the 0.75 criterion requires the…
Published CVSS CVE-2026-41949 · CVSS 4.0 Base 8.2 High · VulnCheck CNA
2026-07-06 · AIDEFEND in Action · Agentic / MCP System · Tier 1
JADEPUFFER Shows Agentic Ransomware Moving From AI RCE to Database ExtortionJADEPUFFER is the case that forces the assessor to keep the attacker out of the assessed system: the agentic behaviour that compressed the kill chain to 31-second self-repair belonged to the offence, so it…
Published CVSS CVE-2025-3248 · CVSS 3.1 Base 9.8 Critical · VulnCheck
2026-07-02 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 3
LiteLLM Control Plane Is Being Hit in the WildAn AI gateway with no agents, no memory and no autonomy still classifies as Connected GenAI and still forces Cp = 1.00 on its merits — because the corroborating path runs through a credential-issuing (P4)…
Published CVSS CVE-2026-40217 · CVSS 3.1 Base 8.8 High · mitre
2026-07-02 · AIDEFEND in Action · Standalone LLM / Generative AI · Tier 3
Exposed LLM Backends Are Becoming Attacker AI ComputeArchitecture class is scored on the assessed boundary, not on the attacker's behaviour: the exposed backend is a Standalone LLM with Aa = 0.25 and baw/agentic both false, yet three Containment sub-metrics…
CVSS — no applicable published score verified
2026-06-29 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 3
Copirate 365: Persistent Memory-Backdoor Data Exfiltration in Microsoft 365 Copilot (CVE-2026-24299)When a backdoor lives in model-writable memory, the egress fix and the persistence fix are different remediations: closing the font-src channel under CVE-2026-24299 does not retire the unaudited…
Published CVSS CVE-2026-24299 · CVSS 3.1 Base 5.3 Medium · microsoft
2026-06-29 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 3
Cowork Exfil: Poisoned-Skill File Exfiltration via Microsoft 365 Copilot CoworkAn approval policy can exist and still be the failure point: exempting self-addressed messages from approval is a real Cn-6 classification (0.25, not 0.00), but because the exempted hop is the one that…
CVSS — no applicable published score verified
2026-06-27 · AIDEFEND in Action · Multi-Agent / MCP System · Tier 3
Lingua Ex Machina: When the AI Monitor Cannot See What the Executor SeesDetection capability and evidence freshness are scored in different layers, and this case separates them cleanly: the monitor's blindness is a point-in-time IVP finding at Ro-1 and Cn-3, while the same…
CVSS — no applicable published score verified
2026-06-22 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 3
SearchLeak: How a Microsoft 365 Copilot Search Link Became a One-Click Data Exfiltration PathThis is the clean illustration of cp_basis = 'default' versus 'corroborated': all four stack layers were reachable and data did leave the tenant, but every terminal node in the observed path was…
Published CVSS CVE-2026-42824 · CVSS 3.1 Base 6.5 Medium · microsoft
2026-06-22 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Agentjacking: How Fake Sentry Errors Turn MCP Telemetry into Agent Code ExecutionA tool integration that is read-only by design can still drive an agent to code execution: the boundary that failed is the MCP output boundary, not the model, which is why Ro-1 stays at 0.25 while five…
CVSS — no applicable published score verified
2026-06-10 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
Sider Spyder synthetic gestures cross the browser origin boundaryForever Security demonstrated that an attacker page could dispatch a synthetic drag event to Sider, causing it to embed an authenticated Gemini page after weakening iframe restrictions. Through an open…
Published CVSS Spyder-Sider-research · CVSS 10.0 (version and metric group not stated by source) Critical · Forever Security Research
2026-06-10 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
MaxAI MaXSS page messages invoke privileged browser APIsForever Security demonstrated that a webpage could forge the expected MaxAI message marker and cause the content script to forward arbitrary function names and arguments to a privileged background API…
Published CVSS MaXSS-MaxAI-research · CVSS 10.0 (version and metric group not stated by source) Critical · Forever Security Research
2026-06-09 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Gemini Voice Assistant: When Phone Notifications Become Prompt InjectionA confirmation gate that exists but is not bound to a canonical action summary earns Cn-6 = 0.25, not credit for human-in-the-loop control — and because the gate cannot be claimed at CBR >= 0.95, the same…
CVSS — no applicable published score verified
2026-06-06 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 2
ChatGPhish: When a Webpage Makes ChatGPT Render a Phishing InterfaceCascade Potential can legitimately be a default rather than a corroborated 1.00: the injected content traverses all four stack layers, but the terminal node is an external fetch rather than a write-external…
CVSS — no applicable published score verified
2026-06-01 · AIDEFEND in Action · Agentic / MCP System · Tier 3
TrapDoor: Poisoned .cursorrules and CLAUDE.md Turn AI Coding Assistants Into Credential StealersRo-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with…
CVSS — no applicable published score verified
2026-05-27 · AIDEFEND in Action · Multi-Agent / MCP System · Tier 1
Agent Session Smuggling: Hidden Instructions Across A2A Agent SessionsAuthentication is not authorisation: a cryptographically valid, correctly authenticated peer session still scores Cn-5 low, because Cn-5 measures whether identity is bound to instruction provenance and tool…
CVSS — no applicable published score verified
2026-05-26 · AIDEFEND in Action · RAG / Retrieval-Augmented System · Tier 3
ChromaToast: ChromaDB Pre-Auth RCE Through Malicious Hugging Face Model LoadingRemediation Feasibility sits at its bottom anchor — a patchable ordering bug with a CVE and a fixed release — while Cascade Potential still forces 1.00, which is exactly the layer separation AITBM is built…
Published CVSS CVE-2026-45829 · CVSS 4.0 Base 10.0 Critical · HiddenLayer
2026-05-15 · AIDEFEND in Action · Agentic / MCP System · Tier 2
AI App Misconfigurations: Public Agent Endpoints as RCE and Credential-Leak PathsNothing in this case reaches the model — there is no prompt, no injection, and no Robustness-1 signal at all — so AITBM's not-applicable redistribution rule carries the whole assessment on Containment,…
CVSS — no applicable published score verified
2026-05-08 · AIDEFEND SecureFlow · Agentic / MCP System · Tier 2
OpenClaw Command & Control via Prompt InjectionPersistent instruction files turn one indirect prompt injection into a standing implant: AITBM records the injection on Ro-1 (0.25) and the poisoned, re-ingested system-prompt file separately on Ro-4…
CVSS — no applicable published score verified
2026-05-08 · AIDEFEND in Action · Agentic / MCP System · Tier 3
PromptMink: Malicious Packages Built to Persuade AI Coding AgentsThe adversary never touched the model — it optimised the documentation the model reads — so the scoring weight lands on Ro-5 ingestion integrity and Cn-1/Cn-6 execution gating rather than on jailbreak…
CVSS — no applicable published score verified
2026-05-03 · AIDEFEND in Action · Agentic / MCP System · Tier 3
OpenAI Codex Command Injection: Malicious GitHub Branch Names as a Token-Theft PathThe exploited input never reached the model, which is exactly why Ro-1 must be scored over the agent's whole task-setup surface rather than its prompt: an agent's adversarial-input resistance is only as…
CVSS — no applicable published score verified
2026-05-03 · AIDEFEND in Action · Agentic / MCP System · Tier 3
CursorJacking: Rogue Cursor Extensions Can Steal AI API KeysContainment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely…
Published CVSS Cursorjacking · CVSS 8.2 (version and metric group not stated by source) High · LayerX Security
2026-05-03 · AIDEFEND in Action · Agentic / MCP System · Tier 3
PocketOS Cursor Agent Data Wipe: Destructive Actions Need Runtime Boundaries, Not Prompt RulesThere is no adversary in this case at all, and AITBM still scores it as a Containment collapse — Cn-1, Cn-2 and Cn-6 are driven by what the agent was technically able to do, not by whether anyone attacked…
CVSS — no applicable published score verified
2026-04-29 · AIDEFEND in Action · Agentic / MCP System · Tier 1
Entra Agent ID Administrator Scope Gap: Agent Roles Reaching Service PrincipalsAn AI system can fail the Containment axis with no model in the loop at all: Cn-5 is scored on the enforced authorization boundary around agent identities, so a directory role whose documented scope and…
CVSS — no applicable published score verified
2026-04-29 · AIDEFEND in Action · RAG / Retrieval-Augmented System · Tier 2
Kimi Privacy Leak Report: When a Translation Request Returns Another User's ResumeAn incident with no established root cause is still scorable — the enforced boundary and the missing release gate are directly observable from the outcome — and the unresolved mechanism belongs in ACI (thin…
CVSS — no applicable published score verified
2026-04-25 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Web-Based IDPI in the Wild: When Webpages Become Agent Prompt DeliveryA population study can be scored honestly as a representative configuration, but only if the assurance layer carries the cost: Pc = 0.10 and a class-level Cp classified as default rather than corroborated…
CVSS — no applicable published score verified
2026-04-25 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Vertex AI Double Agents: When Service-Agent Defaults Become an Agentic Cloud BoundaryAuthentication succeeded and the provider's write boundary held, so the failure has to be located precisely rather than described as 'broken identity': AITBM puts it in Cn-5 = 0.40 (a valid managed token…
CVSS — no applicable published score verified
2026-04-25 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 2
Apple Intelligence Hijack: Prompt Injection Against an OS-Level Local LLMControls that held move the numbers as much as the ones that failed: a measured 76% attack success rate coexists with Cn-1 and Cn-2 at 0.50 (the OS app sandbox bounded the blast radius) and Rf at 0.25 (a…
CVSS — no applicable published score verified
2026-04-25 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Your Agent Is Mine: Malicious LLM API Routers as an Agent Supply-Chain BoundaryThe trust boundary that fails here is neither the model nor the tool but the transport intermediary between them, and AITBM localises it precisely — Cn-5 = 0.25 for an unverifiable response origin under…
CVSS — no applicable published score verified
2026-04-24 · AIDEFEND in Action · Traditional ML / Classifier · Tier 3
Malicious Hugging Face Models: When Loading a Model Opens a BackdoorAn artifact-supply-chain incident with no agent, no prompt and no model output is still fully scorable — the evidence lands on Ro-5, Tr-3/Tr-4 and Cn-1/Cn-2 — and because the assessed configuration was…
CVSS — no applicable published score verified
2026-04-23 · AIDEFEND in Action · RAG / Retrieval-Augmented System · Tier 2
Microsoft "EchoLeak": How One Email Turned Microsoft 365 Copilot into a Zero-Click Data Exfiltration PathThis is the batch's clearest demonstration that a control which held still gets scored, and scored up: CSP blocked the direct egress domain and the XPIA classifier forced the attacker to craft plain prose,…
Published CVSS CVE-2025-32711 · CVSS 3.1 Base 9.3 Critical · microsoft
2026-04-22 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Anthropic MCP STDIO Command Execution: When Tool Configuration Becomes an RCE PrimitiveThe scoring turns on an evidentiary rule rather than a judgement call: the 0.50 Ro-1 anchor describes this case qualitatively — common attacks resisted, multi-step tool-mediated attacks still effective —…
CVSS — no applicable published score verified
2026-04-18 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 3
LiteLLM Fallout: How a Poisoned AI Dependency Reached MercorAITBM scores a software supply-chain compromise as an AI-system finding without distorting either: the AI-specific signal lands on Ro-5 (the dependency ingestion path is a poisoning channel), Cn-5 (static…
CVSS — no applicable published score verified
2026-04-18 · AIDEFEND in Action · Agentic / MCP System · Tier 2
ClawHub `google-qx4`: Malicious SKILL.md Prerequisites as Agent-Driven Social EngineeringA containment control can hold and the deployment still be compromised: the agent sandbox blocked in-runtime execution, which is why Cn-1 is scored up to 0.50 rather than down at a failure anchor, while the…
CVSS — no applicable published score verified
2026-04-18 · AIDEFEND in Action · Agentic / MCP System · Tier 2
OpenClaw 'ClawJacked': Website-to-Local Agent Takeover via Loopback Trust and WebSocket AbuseCn-5 is the case's hinge and shows why a mechanism-only reading of the rubric is wrong: the gateway had real authentication (pairing, device tokens, a password), which is the 0.25 anchor, but the measured…
CVSS — no applicable published score verified
2026-04-18 · AIDEFEND in Action · Tool-Calling LLM / Connected GenAI · Tier 3
Bain Pyxis Compromise: When a Frontend Credential Owns Eleven Databases and the Identity PlaneIdentity, not the model, is the AI attack surface here: every low sub-metric sits in Containment (Cn-1, Cn-2, Cn-4, Cn-5, Cn-6 all at or near the floor) while Robustness barely features - and the case is…
CVSS — no applicable published score verified
2026-04-17 · AIDEFEND in Action · RAG / Retrieval-Augmented System · Tier 3
McKinsey Lilli Compromise: When SQL Injection Reaches the AI Prompt LayerThe sub-metric that should have stopped this is Ro-4, not a web-application control: once the prompt and retrieval tables were writable, the AI platform's integrity depended on chunk and configuration…
CVSS — no applicable published score verified
2026-04-16 · AIDEFEND in Action · Agentic / MCP System · Tier 2
Salesforce 'ForcedLeak': Indirect Prompt Injection via Agentforce Web-to-Lead FormsForcedLeak shows why Cp = 1.00 here is corroborated rather than defaulted: a sink gate that a researcher's payload was observed crossing cannot be claimed at CBR >= 0.95, so the path counts as ungated to a…
Published CVSS ForcedLeak · CVSS 9.4 (version and metric group not stated by source) Critical · Noma Security
2026-04-16 · AIDEFEND in Action · Agentic / MCP System · Tier 3
Claude Code Protected Paths and Auto Mode: Why Bypass Is No Longer a Stable Control BoundaryA case with no exploit still moves the AITBM score: a change to an agent's authority boundary trips the C_event <= 0.35 cap and, with mutable behavioural state, the M_Em = 3.0 behavioural staleness floor -…
CVSS — no applicable published score verified
2026-02-19 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 3
Semantic Kernel Python SearchPlugin filter eval leads to host RCEMicrosoft reproduced a prompt-to-host command path in Semantic Kernel Python when a SearchPlugin input reached an InMemoryVectorStore filter built with eval(). The blocklist and empty builtins did not stop…
Published CVSS CVE-2026-26030 · CVSS 3.1 Base 9.9 Critical · Microsoft Semantic Kernel maintainer advisory
2026-02-06 · Primary reports · Agentic / MCP System · Tier 3
Semantic Kernel .NET session download writes attacker-chosen host pathMicrosoft found that SessionsPythonPlugin DownloadFileAsync was exposed to model calls and accepted an AI-controlled localFilePath with no path restriction. In a controlled chain, the model created a script…
Published CVSS CVE-2026-25592 · CVSS 3.1 Base 9.9 Critical · Microsoft Semantic Kernel maintainer advisory
2026-02-02 · Primary reports · Standalone LLM / Generative AI · Tier 2
vLLM video decoding pre-authentication RCE advisoryThe maintainer confirms a pre-auth video decoder RCE path; there is no evidence of in-the-wild exploitation.
Published CVSS CVE-2026-22778 · CVSS 3.1 Base 9.8 Critical · GitHub maintainer CNA
2025-11-20 · Primary reports · Agentic / MCP System · Tier 3
GitHub Copilot and VS Code multi-root workspace code executionThe agent had a nominal workspace write boundary, but changing multi-root folders and settings could extend that boundary and activate an executable path. The AITBM anchor applies only to the stated product…
Published CVSS CVE-2025-64660 · CVSS 3.1 Base 8.0 High · Microsoft CNA
2025-10-02 · Primary reports · Agentic / MCP System · Tier 3
Cursor Agent modifies .code-workspace settingsCursor had protected some editor-sensitive files, but a .code-workspace file could be modified without that approval. The AITBM anchor applies only to the stated product and configuration.
Published CVSS CVE-2025-61590 · CVSS 3.1 Base 7.5 High · GitHub maintainer CNA
2025-09-04 · Primary reports · Agentic / MCP System · Tier 3
Roo Code auto-approved .code-workspace writesRoo Code protected .vscode writes but did not apply the same approval to .code-workspace under the documented auto-approval configuration. The AITBM anchor applies only to the stated product and configuration.
Published CVSS CVE-2025-58372 · CVSS 3.1 Base 8.1 High · GitHub maintainer CNA
2025-08-11 · Primary reports · Agentic / MCP System · Tier 3
Zed Agent changes project settings to bypass tool permissionZed limited writes outside the project and normally required terminal approval, but a project-local settings write let the agent disable that approval. The AITBM anchor applies only to the stated product…
Published CVSS CVE-2025-55012 · CVSS 4.0 Base 8.5 High · GitHub maintainer CNA
2025-08-02 · Primary reports · Agentic / MCP System · Tier 3
Cursor Agent creates sensitive editor settings without approvalCursor protected edits to existing dotfiles but did not apply the same approval gate to creating a new sensitive editor settings file. The AITBM anchor applies only to the stated product and configuration.
Published CVSS CVE-2025-54130 · CVSS 3.1 Base 7.5 High · GitHub maintainer CNA
2025-07-07 · Primary reports · Agentic / MCP System · Tier 3
Roo Code auto-approved writes to VS Code settingsRoo Code had an approval system, but with Write auto-approval enabled it did not protect .vscode/settings.json from agent writes. The AITBM anchor applies only to the stated product and configuration.
Published CVSS CVE-2025-53536 · CVSS 3.1 Base 8.1 High · GitHub maintainer CNA
2025-06-27 · Primary reports · Agentic / MCP System · Tier 3
Roo Code search_files bypasses workspace read restrictionA workspace read boundary existed, but search_files failed to enforce it; prompt influence could reach an outside file and schema-fetch URL. The AITBM anchor applies only to the stated product and…
Published CVSS CVE-2025-53097 · CVSS 3.1 Base 5.9 Medium · GitHub maintainer CNA
2025-06-11 · Primary reports · Agentic / MCP System · Tier 3
Cursor Agent JSON schema fetch from an injected fileThe default schema fetch followed a model-influenced JSON write to an arbitrary external URL without a per-request authorization gate. The AITBM anchor applies only to the stated product and configuration.
Published CVSS CVE-2025-49150 · CVSS 3.1 Base 5.9 Medium · GitHub maintainer CNA
2025-02-27 · Primary reports · Agentic / MCP System · Tier 2
MetaGPT DataInterpreter executes unchecked generated codeMetaGPT 0.7.3 DataInterpreter is one bounded prompt-to-code research path. The paper lists no CVE for this independent API.
CVSS — no applicable published score verified
2025-02-27 · Primary reports · Agentic / MCP System · Tier 2
MetaGPT TreeofThought executes unchecked generated codeMetaGPT 0.7.3 metagpt.strategy.tot.TreeofThought is one bounded prompt-to-code research path. The paper reports this CVE and 8.4 but no complete original vector was verified.
CVSS — no applicable published score verified
2025-02-27 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
langroid TableChatAgent executes unchecked model-directed codelangroid 0.1.224 TableChatAgent.run is one bounded prompt-to-code research path. The paper lists this API as Reporting rather than assigning a CVE.
CVSS — no applicable published score verified
2025-02-27 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
Lagent PythonInterpreter executes unchecked model-directed codeLagent 0.1.1 lagent.actions.PythonInterpreter is one bounded prompt-to-code research path. The paper reports this CVE and its tested version; no complete primary CVSS vector was verified.
CVSS — no applicable published score verified
2025-02-27 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
Griptape Calculator executes unchecked model-directed codeGriptape 0.17.1 griptape.tools.Calculator is one bounded prompt-to-code research path. The paper reports this CVE and its tested version; no complete primary CVSS vector was verified.
CVSS — no applicable published score verified
2025-01-29 · Primary reports · Standalone LLM / Generative AI · Tier 2
DeepSeek unauthenticated ClickHouse log exposureUnauthenticated database reads support one failed scope anchor; they do not establish model-level leakage tests.
CVSS — no applicable published score verified
2024-12-06 · Primary reports · Standalone LLM / Generative AI · Tier 4
Terminal DiLLMa ANSI escape DNS exfiltration demonstrationOne controlled CLI output boundary failed; model origin-label design and other terminal paths remain unmeasured.
CVSS — no applicable published score verified
2024-06-27 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
Vanna ask executes unsandboxed model-generated codevanna 0.3.3 vanna.ask is one bounded prompt-to-code research path. The huntr CNA record corroborates the ask() prompt-injection path and provides exact CVSS 3.0 metadata.
Published CVSS CVE-2024-5826 · CVSS 3.0 Base 9.8 Critical · huntr CNA
2023-08-15 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
LlamaIndex PandasQueryEngine prompt-to-code executionLlamaIndex 0.7.13 PandasQueryEngine.query is one bounded prompt-to-code research path. The documented 0.7.13 path is scored; a separate third-party fix bypass is held.
CVSS — no applicable published score verified
2023-08-15 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
LangChain dataframe agents execute unchecked generated codeLangChain 0.0.232 create_csv_agent, create_spark_dataframe_agent, and create_pandas_dataframe_agent is one bounded prompt-to-code research path. Three dataframe agent API rows share one CVE and unchecked…
CVSS — no applicable published score verified
2023-08-05 · Primary reports · Tool-Calling LLM / Connected GenAI · Tier 2
LangChain PALChain.run executes unchecked generated codeLangChain 0.0.232 PALChain.run is one bounded prompt-to-code research path. One distinct PALChain API and prompt-to-code mechanism.
CVSS — no applicable published score verified
2023-03-24 · Primary reports · Standalone LLM / Generative AI · Tier 2
ChatGPT redis-py cross-user response disclosureThe only observed rubric failure is cross-user cache scope; the remaining applicable sub-metrics are unknown.
Published CVSS CVE-2023-28858 · CVSS 3.1 Base 3.7 Low · NVD
2026-09-24 · Primary reports
DIVD Zammad breach with reported agent useDIVD confirms its ticketing-system breach and describes agent use in the follow-on attack; its public case remains under investigation.
2026-09-22 · Primary reports
EvilTokens AI-enabled account compromise and fraudMicrosoft documents a disrupted cybercrime service combining stolen inbox access with AI-assisted mailbox analysis and fraud planning.
2026-09-19 · AIDEFEND in Action
AI Recommendation Poisoning: Summary Links That Try to Rewrite Assistant MemoryOfficial AIDEFEND in Action September 2026 brief retained as a public-evidence reference; see the linked source for its bounded findings.
2026-09-15 · AIDEFEND in Action
Attacker Tooling Now Knows AI Internals: Ninety Days of Honeypot TrafficOfficial AIDEFEND in Action September 2026 brief retained as a public-evidence reference; see the linked source for its bounded findings.
2026-09-15 · AIDEFEND in Action
LiteLLM's MCP Gateway Accepted Any Bearer Token, and Its Test Endpoint Ran Attacker CommandsOfficial AIDEFEND in Action September 2026 brief retained as a public-evidence reference; see the linked source for its bounded findings.
2026-09-13 · AIDEFEND in Action
SkillJack Turns Poisoned Agent Experience Into a Reusable SkillOfficial AIDEFEND in Action September 2026 brief retained as a public-evidence reference; see the linked source for its bounded findings.
2026-09-13 · AIDEFEND in Action
GitSpawn Runs From a Repository Before the Coding Agent Can Ask for TrustOfficial AIDEFEND in Action September 2026 brief retained as a public-evidence reference; see the linked source for its bounded findings.
2026-09-10 · Primary reports
GTG-50029 European political-target campaignAnthropic reports observing and disrupting a campaign using Claude-assisted tools and sub-agents against European political and affiliated targets.
2026-09-08 · AIDEFEND SecureFlow
Multi-Agent Framework Compromises Taiwanese Government SystemsIn early July 2026, an unknown Chinese-language operator used a multi-agent framework built on Hermes and OpenClaw against government systems that subsequent public reporting identified as Taiwanese. Dream Rese
2026-09-08 · AIDEFEND in Action
GTG-1002: Hiding an Espionage Campaign Inside Ordinary Claude Code TasksAnthropic reported a September 2025 campaign that used Claude Code, its AI coding agent, against roughly 30 organizations and compromised a small number. Anthropic attributes GTG-1002 to a Chinese state-sponsor
2026-08-25 · AIDEFEND in Action
Spyder and MaXSS Let Ordinary Webpages Inherit AI Extension PrivilegesRebora disclosed two different browser-extension privilege crossings in two different products. Spyder abused Sider's synthetic drag and cross-origin gesture path: an attacker page dispatched a dragstart event
2026-08-25 · AIDEFEND in Action
macOS.Gaslight Plants Fake System Messages to Disrupt AI Malware AnalysisSentinelLABS analyzed macOS.Gaslight, a Rust backdoor containing an approximately 3,500-byte prompt-injection payload with 38 fabricated system messages. The messages imitate an LLM-assisted malware-triage harn
2026-08-06 · AIDEFEND SecureFlow
AI in the Middle: Web-Based AI Services as C2 RelaysCheck Point Research demonstrated an "AI in the Middle" attack in which malware can abuse web-based AI assistants with anonymous or unauthenticated browsing and URL-fetch capabilities as a covert command-and-co
2026-08-06 · AIDEFEND SecureFlow
LLMSmith: RCE Vulnerabilities in LLM-Integrated ApplicationsResearchers identified 20 remote code execution (RCE) vulnerabilities across 11 different LLM frameworks. They discovered applications deployed on the public internet built using these LLM frameworks and demons
2026-08-06 · AIDEFEND SecureFlow
SesameOp: Novel backdoor uses OpenAI Assistants API for command and controlThe Microsoft Incident Response - Detection and Response Team (DART) investigated a compromised system where a threat actor utilized SesameOp, a backdoor implant that abuses the OpenAI Assistants API as a cover
2026-08-06 · AIDEFEND SecureFlow
AIKatz: Attacking LLM Desktop ApplicationsResearchers at Lumia have demonstrated that it is possible to extract authentication tokens from the memory of LLM Desktop Applications. An attacker could then use those tokens to impersonate the victim to the
2026-08-06 · AIDEFEND SecureFlow
ProKYC: Deepfake Tool for Account Fraud AttacksCato CTRL security researchers have identified ProKYC, a deepfake tool being sold to cybercriminals as a method to bypass Know Your Customer (KYC) verification on financial service applications such as cryptocu
2026-08-06 · AIDEFEND SecureFlow
Face Identification System Evasion via Physical CountermeasuresMITRE's AI Red Team demonstrated a physical-domain evasion attack on a commercial face identification service with the intention of inducing a targeted misclassification. This operation had a combination of tra
2026-08-05 · AIDEFEND in Action
hTAG's Browser-Agent Benchmark Shows Why Model Refusal Is Not AuthorizationhCaptcha Threat Analysis Group (hTAG) tested 20 abuse scenarios against ChatGPT Atlas, Claude Computer Use, Gemini Computer Use, Manus AI, and Perplexity Comet. In the reported configurations, agents frequently
2026-08-05 · AIDEFEND in Action
Vector Databases Are Not Just Vectors: Orca Exposure Findings and Milvus Authentication FailuresOrca found Internet-exposed vector databases containing source text, personal data, medical records, credentials, and internal configuration, then validated that credentials from one support-ticket index could
2026-08-05 · AIDEFEND in Action
IDEsaster Shows How Agent File Writes Can Activate Trusted IDE FeaturesIDEsaster is a cross-product vulnerability class in which prompt injection does not need a dangerous agent tool to finish the attack. The agent uses ordinary file access, then the underlying IDE automatically l
2026-08-02 · AIDEFEND SecureFlow
LAMEHUG: Malware Leveraging Dynamic AI-Generated CommandsIn July 2025, Ukrainian authorities reported the emergence of LAMEHUG, a new AI-powered malware attributed to the Russian state-backed threat actor APT28 (https://attack.mitre.org/groups/G0007/) (also tracked a
2026-08-02 · AIDEFEND SecureFlow
Malware Prototype with Embedded Prompt InjectionCheck Point Research identified a prototype malware sample in the wild that contained a prompt injection, which appeared to be designed to manipulate LLM-based malware detectors and/or analysis tools. However,
2026-08-02 · AIDEFEND SecureFlow
AI Model Tampering via Supply Chain AttackResearchers at Trend Micro, Inc. used service indexing portals and web searching tools to identify over 8,000 misconfigured private container registries exposed on the internet. Approximately 70% of the registr
2026-08-02 · AIDEFEND SecureFlow
Web-Scale Data Poisoning: Split-View AttackMany recent large-scale datasets are distributed as a list of URLs pointing to individual datapoints. The researchers show that many of these datasets are vulnerable to a "split-view" poisoning attack. The atta
2026-08-02 · AIDEFEND SecureFlow
ChatGPT Package HallucinationResearchers identified that large language models such as ChatGPT can hallucinate fake software package names that are not published to a package repository. An attacker could publish a malicious package under
2026-08-02 · AIDEFEND SecureFlow
Arbitrary Code Execution with Google ColabGoogle Colab is a Jupyter Notebook service that executes on virtual machines. Jupyter Notebooks are often used for ML and data science research and experimentation, containing executable snippets of Python code
2026-08-02 · AIDEFEND SecureFlow
Compromised PyTorch Dependency ChainLinux packages for PyTorch's pre-release version, called Pytorch-nightly, were compromised from December 25 to 30, 2022 by a malicious binary uploaded to the Python Package Index (PyPI) code repository. The mal
2026-08-02 · AIDEFEND SecureFlow
Microsoft Edge AI EvasionThe Azure Red Team performed a red team exercise on a new Microsoft product designed for running AI workloads at the edge. This exercise was meant to use an automated system to continuously manipulate a target
2026-08-02 · AIDEFEND SecureFlow
Microsoft Azure Service DisruptionThe Microsoft AI Red Team performed a red team exercise on an internal Azure service with the intention of disrupting its service. This operation had a combination of traditional ATT&CK enterprise techniques su
2026-08-02 · AIDEFEND SecureFlow
GPT-2 Model ReplicationOpenAI built GPT-2, a language model capable of generating high quality text samples. Over concerns that GPT-2 could be used for malicious purposes such as impersonating others, or generating misleading news ar
2026-08-02 · AIDEFEND SecureFlow
VirusTotal PoisoningMcAfee Advanced Threat Research noticed an increase in reports of a certain ransomware family that was out of the ordinary. Case investigation revealed that many samples of that particular ransomware family wer
2026-08-02 · AIDEFEND SecureFlow
Botnet Domain Generation Algorithm (DGA) Detection EvasionThe Palo Alto Networks Security AI research team was able to bypass a Convolutional Neural Network based botnet Domain Generation Algorithm (DGA) detector using a generic domain name mutation technique. It is a
2026-08-02 · AIDEFEND SecureFlow
Evasion of Deep Learning Detector for Malware C&C TrafficThe Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. Based on the publicly available paper by Le et al. (https:/
2026-06-30 · AIDEFEND SecureFlow
Prompt-to-Shell: Dual RCE Paths in Microsoft Semantic KernelMicrosoft documented two distinct Semantic Kernel prompt-to-host-RCE paths: a Python Search Plugin filter evaluated with eval(), and a .NET SessionsPythonPlugin file-transfer function exposed to model tool call
2026-06-24 · Primary reports
TradingView-themed ClawHub skills delivered a distinct cluw infostealerClawHub accepted and listed two TradingView-themed OpenClaw skills with malicious prerequisite instructions; at least one received an audit Pass. The redirection led to a Base64-encoded command that fetched a c
2026-06-24 · AIDEFEND in Action
Shadow AI and Enterprise Data Governance: What 22.4M Prompts RevealHarmonic analysed 22,458,240 enterprise GenAI prompts and file uploads across 665 tools and identified 579,113 sensitive exposures, with six applications accounting for 92.6% of them and ChatGPT alone for 71.2%
2026-06-06 · AIDEFEND in Action
Sysdig marimo: When an LLM Agent Drives Post-Exploitation After RCESysdig observed an intrusion on May 10 2026 in which an attacker reached an internet-facing marimo notebook, gained command execution through CVE-2026-39987 on the /terminal/ws WebSocket, and then used an LLM a
2026-05-18 · AIDEFEND in Action
System-Level Agent Defenses: Why Indirect Prompt Injection Needs Plan and Policy BoundariesThis is a methodology source rather than an incident. The paper reframes indirect prompt injection as a system-architecture problem: an attacker hides instructions in an email, webpage, document, or tool output
2026-04-26 · AIDEFEND in Action
Real Attackers Don’t Compute Gradients: Operational Threat Modeling for ML SecurityThis brief covers a research paper, not an incident. The paper separates the ML model from the ML system around it and argues that practical attackers frequently bypass several layers of that system rather than
2026-04-16 · AIDEFEND in Action
Subliminal Learning: Behavioural Traits Leak Through Semantically Unrelated Distillation DataResearchers showed that a student model can inherit a teacher model's behavioural traits from distillation data that carries no visible trace of the trait. A teacher is first nudged toward a preference (the pap
2025-11-26 · Primary reports
Mixpanel analytics compromise affecting OpenAI usersOpenAI confirms a Mixpanel breach affecting limited customer-identifiable analytics associated with some of its users, with a December clarification of the user scope.
2025-09-05 · Primary reports
Nx S1ngularity supply-chain compromiseNx confirms malicious npm releases that collected sensitive files, attempted to invoke local AI tools, and uploaded results to public repositories.
2024-12-11 · Primary reports
Ultralytics malicious package releasesPyPI confirms malicious Ultralytics releases following compromise of GitHub Actions workflows and a publishing token, with affected releases removed.
2024-05-31 · Primary reports
Hugging Face Spaces unauthorized accessHugging Face confirms unauthorized access to Spaces, revoked affected tokens, and engaged forensic specialists.
Indicative ERS is a normalized-assurance comparison scenario and must be read with its best-to-worst interval. Public ACI describes the article evidence package; MVT reports only a severity floor proved across the uncertainty bounds.
Renewed reporting makes this existing evidence-bounded ERS case relevant to the current news cycle. News selection does not change its assessment evidence or score.
FEATURED CASE
Re-derived against OpenAI's 26 August end-to-end report, the case moves in two directions at once and neither is a metadata bump. Cn-4 falls from 0.25 to 0.00 because what the earlier account recorded as one file-disclosure reference is now two independent unintended-read…
In the news: Axios: OpenAI hit with landmark lawsuit following Hugging Face hack · 2026-09-29. Selected 2026-10-02.
Open the complete evidence record →45 of the 201 records have no ERS, for one of two reasons. 0 are awaiting analysis: their source must still be reviewed, split into per-product records, or scored as the AI workload an infrastructure component serves. 45 have documented scoring limits: they may combine separately assessed product paths, lack a bounded victim AI system, or omit the evidence needed for a complete rubric anchor. Aggregate records link to their separate assessments where available. Every record follows the same four-step scorability admission test (system, boundary, observation, multiplicity). 21 of the unscored records mirror AIDEFEND SecureFlow attack flows and carry the ordered attack steps, ATLAS technique labels, and step-matched AIDEFEND defenses. They remain available through the archive browsing mode.
Select Browse unscored records to search this archive in the directory above. Complete attack steps, references, defenses, and scoring limitations are preserved on their individual record pages.
Research by Aaron Costello at AppOmni provides additional examples for designing AI security evaluations. Browse his AppOmni author archive and the original technical disclosures below. Source selection checked 2 October 2026.
These supplementary studies are outside the counted case library and have no ERS. The questions below are qualitative evaluation routes, not scored findings or evidence of implemented controls. Each study describes its tested configuration at disclosure time, rather than the current security posture of ServiceNow.
Aaron Costello · AppOmni · 13 January 2026 · CVE-2025-12420
A shared integration secret and email-based account linking enabled user impersonation and privileged Now Assist workflows. The disclosure records vendor remediation on 30 October 2025.
Aaron Costello · AppOmni · 19 November 2025
Attacker-controlled ticket content redirected an admin-invoked Now Assist agent to recruit another agent and copy restricted ticket data into an attacker-readable ticket, despite enabled prompt-injection protection. Tool and team configuration determined exposure.
These cases work backwards from an incident. The same three layers work forwards, before anything goes wrong — which is the point.
