Skip to content

live

research · 61 pieces

Research.

61 published pieces — original research, CVE technical writeups, and a reference taxonomy of AI security — across adversarial AI, prompt injection, agent security, kernel and container work.

all45 ai security research16 jailbreaking6 prompt injection7 infrastructure & appsec6 per-cve writeups10

AI Security Research

22 articles

Premise Collision: What Happens When the Poisoned Fact and the True One Are Both in the Window

When the poisoned fact and the true record are both in the window, the model arbitrates on weight, not truth. Measured: poison wins 44/48, and one memory note makes it total.

agent security · empirical

Where Is My NX Bit? Instruction/Data Separation, Enforcement & Agent Identity

Authentication ≠ authorization ≠ intent — why AI-agent identity can’t stop prompt injection, and what a real enforcement bit would need.

Return-Oriented Prompting: The Attack Class That Survives Instruction/Data Separation

The agentic attack that supplies no instructions — it injects trusted facts and the model builds the malicious plan itself. Gadget taxonomy + why benchmarks miss it.

No Responsibility by Design: Cross-Thread Container Desync → Host RCE

A composition vulnerability class — cross-thread container desync to host RCE. 7 primitives, 4 recycles, end-to-end.

Reverse-Engineering Claude’s Memory Architecture From Inside the Sandbox

The binaries, protobuf schemas, TLS interception, encryption model, and a CWE-522 credential extraction chain — extracted live from inside the Claude code sandbox.

SKILBin: AI Agent Skills as the New LOLBin

a malicious Claude skill harvests SSH, AWS, and Kubernetes credentials inside an Anthropic-signed process no EDR flags — the LOLBin for the agent era.

Semantic-to-Metadata Smuggling in Multi-LoRA Routing Gateways

SHELL.003 — signal suppression at the multi-LoRA routing gateway as an unreviewed trust boundary.

prompt injection

Indirect Injection Was Never Blind

the wire carries the tool call before the interface hides it — closed-loop indirect injection via the SSE wire.

prompt injection

Self-Replicating Memory Worm: Persistent Injection with Autonomous Propagation

A single memory edit becomes an autonomous, self-replicating worm with credential harvesting and cross-service pivoting. See how it survives session resets.

Adversarial Prompting: The Complete Technical Guide

Every adversarial prompting technique mapped from role hijacking to multi-turn escalation. Learn how attacks work, why defenses fail, and how to test them.

Weaponized AI Supply Chain: How Threat Actors Turned LLMs Into Attack Infrastructure

89% increase in AI-enabled attacks. LLM-integrated malware, autonomous cyber espionage, and $1.1B in deepfake fraud. Explore the full offensive AI arsenal.

MCP vs A2A Attack Surface: Every Trust Boundary Mapped

MCP has 40+ CVEs and real-world breaches while A2A has zero. Get the complete side-by-side attack surface comparison with defensive guidance for AI agents.

The 30% Blind Spot: Why LLM Safety Judges Fail

LLM safety judges miss 63% of unsafe content. Built one, tested six iterations, 680+ responses. See why every major AI provider has this same blind spot.

AI Breach Detection Gap: The Logs Are Clean. You're Not.

74% of organizations found AI breaches when they looked. Most are not looking. Discover why LLM attacks evade traditional security detection and what to do.

LLM Red Teamer's Playbook: Diagnosing AI Defense Layers

Stop guessing which jailbreak works. A systematic, layered methodology for diagnosing LLM defense layers and selecting the right bypass technique each time.

AATMF v3.1 vs MITRE ATLAS: Which AI Security Framework Wins?

MITRE ATLAS covers 66 techniques. AATMF v3.1 maps 240 techniques with 4,980+ prompts and quantitative risk scoring. Compare both frameworks and choose wisely.

AI Coding Agent Attack Surface: A Full Taxonomy

AI coding agents trust code comments, README files, and MCP servers like humans trust authority. Explore the full attack surface taxonomy and defenses.

Computational Countertransference: LLM Context Inheritance

LLMs adopt adversarial states from pasted transcripts. 13-month study reveals context inheritance as an architectural vulnerability in GPT-4o, Claude, Gemini.

AI Gateway Threat Model: 8 Attack Vectors

First generalized AI gateway threat model covering 8 unmapped attack vectors. 91K attack sessions analyzed. Apply these AATMF TC-21 gateway defense tactics.

Agentic AI Threat Landscape: Attack Vectors & Defenses

Full agentic AI threat landscape covering prompt injection, MCP tool poisoning, multi-agent infection, and memory poisoning. Learn why no single defense works.

RAG, Agentic AI, and the New Attack Surface

RAG pipelines and agentic AI expand the LLM attack surface beyond prompts. How retrieval poisoning and tool autonomy create exploitable vulnerability classes.

AI Social Engineering: Deepfake Voice Detection

How AI enables sophisticated social engineering through deepfake voices. Real-world attack cases, detection techniques, and organizational defense strategies.

The Structural Vulnerabilities of Large Language Models

Tokenization evasion, parsing limit exploits, and alignment failure modes that break production LLMs. A full pipeline security report for AI deployments.

Hidden Risks of AI: An Offensive Security Perspective

Emerging AI threat vectors analyzed from an offensive security lens. Shadow AI, supply chain poisoning, and blind spots that blue teams consistently miss.

Jailbreaking

6 articles

LLM Jailbreak Techniques: A Technical Taxonomy

Complete taxonomy of LLM jailbreak methods — role hijacking, multi-turn escalation, context manipulation, encoding exploits, and chain-of-thought abuse.

Memory Manipulation: AI Context Poisoning

How attackers poison AI context windows and memory systems to compromise future interactions. Persistent manipulation techniques and defense strategies.

Inherent AI Vulnerabilities: Technical Deep Dive

Deep technical analysis of structural vulnerabilities in AI systems. Why certain adversarial attacks succeed regardless of safety training and guardrails.

Context Inheritance Exploit: Persistent Jailbreaks

Jailbroken states persist across GPT sessions through context inheritance. Explore this novel attack vector, its persistence mechanics, and defense gaps.

Is AI Inherently Vulnerable? An Offensive Analysis

Are large language models inherently vulnerable? Examining the fundamental security limitations of LLMs and why adversarial manipulation remains unsolvable.

ChatGPT Jailbreak via Context Manipulation

Step-by-step walkthrough of jailbreaking ChatGPT using context manipulation and social awareness techniques. Original research and methodology breakdown.

Prompt Injection

5 articles

Memory Injection Through Nested Skills: Autonomous LLM Agent Compromise

Skill injection plus cross-session memory poisoning creates a self-healing LLM implant. Explore this novel persistence chain exploiting agent trust boundaries.

Prompt Injection Examples: Real Attack Patterns Explained

Real-world prompt injection examples across direct injection, indirect injection, MCP tool poisoning, and memory attacks. Learn how each pattern works.

MCP Security Hardening: Production Vulnerability Guide

How to secure MCP servers in production AI environments. Real-world vulnerability scenarios, server configuration hardening, and AATMF-mapped defense patterns.

MCP Threat Analysis: Attack Chains & Protocol Dissection

Offensive threat analysis of the Model Context Protocol. Attack chains, privilege escalation paths, and exploitation techniques targeting AI tool integration.

Custom Instruction Backdoor: ChatGPT Prompt Injection

Uncovering emergent prompt injection risks through ChatGPT custom instructions. Learn how user settings become persistent attack vectors in LLM applications.

Infrastructure & AppSec

6 articles

Linux Kernel io_uring/zcrx: Race Condition to Double-Free

Race condition in io_uring zerocopy receive (zcrx) — non-atomic user_refs operations cause double-free and out-of-bounds write. Kernel fix by Kai Aizen.

Zero-Trust Container Runtime Attestation

Implementing zero-trust principles in container runtime environments. Runtime attestation strategies, security architecture, and hardening techniques.

Advanced Container Escapes: Security Deep Dive

Deep technical analysis of container escape techniques — namespace breakouts, capability abuse, kernel exploits, and principle-based prevention strategies.

RCE & DNS Exfiltration in ChatGPT Canvas

Research documenting Python Pickle RCE and DNS exfiltration in ChatGPT's Code Interpreter sandbox. Two critical vulnerabilities forming one attack chain.

Evading Endpoint Detection and Response (EDR)

Technical analysis of EDR evasion techniques — unhooking, direct syscalls, AMSI bypasses, and ETW patching. How attackers evade endpoint detection at runtime.

Exploiting Cloud Vulnerabilities: Tools and Techniques

Practical guide to cloud security testing across AWS, Azure, and GCP. Tools and techniques for exploiting Docker, Terraform, CI/CD, and Kubernetes flaws.

Per-CVE Writeups

37 articles

CVE-2026-48782: pydantic-ai SSRF Blocklist Bypass

CVE-2026-48782 — pydantic-ai SSRF (incomplete fix): with force_download=allow-local on untrusted URL

CVE-2026-31899 — CairoSVG

CVE-2026-31899: Exponential DoS via recursive amplification in CairoSVG. CVSS 7.5 · High severity. D

CVE-2026-2717 — HTTP Headers

CVE-2026-2717: CRLF injection in HTTP Headers. CVSS 5.5 · Medium severity. Disclosure writeup, refer

CVE-2026-55528: PraisonAI AgentServer Missing Auth

CVE-2026-55528 — PraisonAI's AgentServer declares an auth_token but never enforces it, leaving every

CVE-2026-1314 — 3D FlipBook

CVE-2026-1314: Missing authentication in 3D FlipBook. CVSS 5.3 · Medium severity. Disclosure writeup

CVE-2026-55530: PraisonAI Arbitrary File Write

CVE-2026-55530 — PraisonAI's ast_grep_rewrite lacks the @require_approval gate, letting an agent ove

CVE-2026-0811 — Advanced CF7 DB

CVE-2026-0811: CSRF in Advanced CF7 DB. CVSS 5.4 · Medium severity. Disclosure writeup, references,

CVE-2026-3599 — Riaxe Product Customizer

CVE-2026-3599: SQL injection in Riaxe Product Customizer. CVSS 7.5 · High severity. Disclosure write

CVE-2026-3594 — Riaxe Product Customizer

CVE-2026-3594: Information disclosure in Riaxe Product Customizer. CVSS 5.3 · Medium severity. Discl

CVE-2026-45620 — WWBN/AVideo

CVE-2026-45620: Incomplete fix for CVE-2026-43881. CVSS —, Medium. Coordinated disclosure by Kai Aiz

CVE-2026-8368: Zero header strip on cross-host redirect. CVSS —, Medium. Coordinated disclosure by K

CVE-2026-46132: Linux Kernel net/rtnetlink

CVE-2026-46132 — uninitialized memory infoleak in the Linux kernel net/rtnetlink subsystem.

CVE-2026-45363 — jwt/ruby-jwt

CVE-2026-45363: Empty-key HMAC bypass. CVSS 7.4, High. Coordinated disclosure by Kai Aizen.

CVE-2026-47398: PraisonAI Code Injection via Unguarded

CVE-2026-47398 — PraisonAI: two unguarded spec.loader.exec_module call sites in agents_generator.

CVE-2026-46627: Twig Sandbox Resource Exhaustion

CVE-2026-46627 — the Twig sandbox restricts code and data access but not resource consumption. Untru

CVE-2026-3595 — Riaxe Product Customizer

CVE-2026-3595: Unauthenticated user deletion in Riaxe Product Customizer. CVSS 5.3 · Medium severity

CVE-2026-44217 — sse-channel (npm)

CVE-2026-44217: SSE injection — unsanitized fields. CVSS —, Medium. Coordinated disclosure by Kai Ai

CVE-2026-48022: @hapi/wreck Redirect Credential Leak

CVE-2026-48022 — @hapi/wreck strips credential headers on redirect but checks only the hostname, ign

CVE-2026-45619 — WWBN/AVideo

CVE-2026-45619: Incomplete fix for CVE-2026-43884 in WWBN/AVideo — isSSRFSafeURL() discards $resolve

CVE-2026-1313 — MimeTypes Link Icons

CVE-2026-1313: SSRF in MimeTypes Link Icons. CVSS 8.3 · High severity. Disclosure writeup, reference

CVE-2026-49853: Tornado Cross-Origin Auth Header Leak

CVE-2026-49853 — Tornado's SimpleAsyncHTTPClient leaked Authorization/Cookie headers across cross-or

CVE-2026-47393: PraisonAI API Server Auth Disabled by

CVE-2026-47393 — PraisonAI's API code generator creates Flask servers with authentication disabled b

CVE-2026-49353: 9router Local-Only Access Gate Bypass via

CVE-2026-49353 — 9router's local-only access gate can be bypassed by spoofing the Host header, expos

CVE-2026-0814 — Advanced CF7 DB

CVE-2026-0814: Missing authentication in Advanced CF7 DB. CVSS 4.3 · Medium severity. Disclosure wri

CVE-2026-48814: Network AI Empty Default Secret Authorizes

CVE-2026-48814 — Network AI ships with an empty default secret, and the authorization check treats t

CVE-2026-3596 — Riaxe Product Customizer

CVE-2026-3596: Privilege escalation in Riaxe Product Customizer. CVSS 9.8 · Critical severity. Discl

CVE-2026-43884 — WWBN/AVideo

CVE-2026-43884: SSRF — HTTP redirect & DNS rebinding bypass in WWBN/AVideo. CVSS 7.7 · High severity

CVE-2025-12030 | IDOR in ACF to REST API Plugin

CVE-2025-12030: Insecure Direct Object Reference in ACF to REST API WordPress plugin. Unauthorized data access via API manipulation. CVSS 4.3 Medium.

CVE-2026-32809 | Symlink Resolution Bypass in ouch

CVE-2026-32809: Unvalidated symlink targets in ouch tar extraction enable arbitrary file read via crafted archives. Affects all tar formats. CVSS 7.4.

CVE-2025-9776 | SQL Injection in CatFolders Plugin

CVE-2025-9776: Authenticated SQL Injection via CSV Import in CatFolders WordPress plugin. CVSS 6.5. Full technical analysis and remediation by Kai Aizen.

CVE-2026-3288 | Config Injection in ingress-nginx rewrite-target

CVE-2026-3288: Configuration injection in ingress-nginx via rewrite-target annotation enables RCE and cluster-wide Secret disclosure. CVSS 8.8 High severity.

CVE-2025-12163 | Stored XSS in OmniPress Plugin

CVE-2025-12163: Stored XSS in OmniPress WordPress plugin via author-level access. CVSS 6.4. Full technical analysis, PoC, and remediation by Kai Aizen.

CVE-2025-11174 | Missing Auth in Document Library Lite

CVE-2025-11174: Missing authorization in Document Library Lite exposes sensitive data. CVSS 5.3. Full vulnerability analysis and remediation by Kai Aizen.

CVE-2026-33693 | SSRF via Incomplete IP Validation in activitypub-federation-rust

CVE-2026-33693: SSRF bypass in activitypub-federation-rust via 0.0.0.0. Missing is_unspecified() check affects Lemmy and 6+ Fediverse projects. CVSS 6.5.

CVE-2026-32885 | Path Traversal (ZipSlip) in ddev

CVE-2026-32885: ZipSlip path traversal in ddev local development tool. Malicious archives escape extraction directory via Untar/Unzip. CVSS 6.5 Medium.

CVE-2025-11171 | Missing Auth in Chartify Plugin

CVE-2025-11171: Missing authentication for admin functions in Chartify WordPress plugin. CVSS 5.3. Full technical analysis and remediation by Kai Aizen.

CVE-2026-1208 | CSRF to Settings Update in Friendly Functions for Welcart

CVE-2026-1208: CSRF in Friendly Functions for Welcart WordPress plugin enables unauthorized settings manipulation. CVSS 4.3. Full analysis by Kai Aizen.

featured

When the research listed below intersects with real vendor stacks, these are the CVEs that ship.

Flagship Disclosures.

Six writeups with dedicated quick-facts, FAQ, and references — for engineers landing here from a search for the CVE itself.

Kubernetes ingress-nginx — Config Injection via rewrite-target

Apache Airflow Core — Missing Authorization on HITL endpoints

Dgraph — Pre-auth DQL Injection

Linux kernel · io_uring/zcrx — Race → Double-free → OOB Write

GHSA-j425-whc4-4jgc

OpenClaw — system.run env-override RCE

Apache Airflow · Databricks — TLS Verification Bypass