Explore primary-source AI security research, evaluated models, attack techniques, and defensive evidence.
985 research findings · 1119 evaluated models
Matches every word across titles, descriptions, sources, affected systems, and models.
Exposed retrieval embeddings can reveal source text. SHAQ evaluates indexing generated queries instead of direct document embeddings to reduce that leakage.
Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.
Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.
Context assembly can promote repository, tool or skill content into higher-priority instructions or persistent state. The paper studies 12 pinned agent-harness versions.
Document-image PII detection can miss identifiers despite improving average localization scores. LeakageBench evaluates 500 pages with 11,954 annotations.
A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.
Third-party skills can inflate coding-agent resource use while an otherwise legitimate task remains functional.
Lower-trust tool content can assert facts beyond its authority and distort an agent's decisions. PIPES screens response units against source provenance and expected field meaning.
Shell-command screening can miss harmful actions generated by coding agents. CARE combines static checks with optional model review at the command-dispatch boundary.
Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.
Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.
Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.