Briefings, dashboards, and sanitized engagement notes.
14 briefings
A single crafted query leaks one document. An extraction agent that plans, adapts, and iterates leaks the corpus. We reproduce the RAG-Thief pattern against production retrieval systems and show what stops it.
Most AI risk assessments are compliance questionnaires that never touch the model. Here is the surface a real one measures — prompt boundaries, tool containment, RAG integrity, cost, and supply chain — and how to tell a checklist from an audit.
No single tool in your agent is dangerous. The composition is. We walk through four real escalation chains — read-only to admin — and the containment model that stops them.
The 2026 wave of screen-controlling agents turns every pixel they read into a potential command. We took over four of five computer-use deployments through content the agent was merely asked to look at.
Autonomous coding agents read issues, READMEs, and dependencies as instructions. We planted a backdoor in a client's release by editing a file the agent was told to trust — no commit access required.
If your assistant renders markdown, a single injected image tag can exfiltrate the conversation — zero clicks, no tool access required. We found this in 11 of 14 audited chat deployments.
Every system prompt we've been asked to protect, we've extracted — median time 41 minutes. The question isn't whether yours leaks. It's what the leak is worth to whoever pulls it.
One malicious tool description can redirect every tool call an agent makes — including calls to tools it doesn't own. The supply chain risk isn't the code. It's the metadata.
Chained injection attacks against multi-agent systems rose 312% in 12 months. The three payload families we pull out of production, why system-prompt guardrails miss them, and what contained it.
67% of audited RAG systems return at least one document the requester shouldn't see. The cause isn't your ACLs — it's the order your pipeline evaluates them. Here's the fix, with test cases.
A single recursive loop drained a $50K monthly LLM budget in under 9 hours. We break down the amplification math, the three attack patterns we see most, and the circuit breakers that actually stop them.
When an agent has tool access, injection attacks don't stop at text. We document three production compromises involving real tool execution.
Proprietary training data can be partially reconstructed from embedding endpoints. Here's the attack surface and what to close.
Semantic caches built for performance are trivially exploitable for injection persistence. One poisoned cache entry can affect thousands of users.