AI Security Research
Real, cited research on how AI agents actually get compromised — no speculation, no invented statistics.
What Is Prompt Injection? A Technical Guide
Prompt injection explained: direct vs. indirect injection, why it's structurally different from traditional injection attacks, and how it actually breaks AI agents in production.
Read →How CEO-Fraud Prompt Injection Works Against AI Support Agents
CEO fraud isn't new — it's a top FBI IC3-tracked fraud category. Here's how the same social-engineering pattern gets adapted into a prompt-injection attack against AI support agents.
Read →WormGPT and FraudGPT: Inside the Malicious-AI-as-a-Service Market
WormGPT and FraudGPT are real, commercially available AI models built for fraud and phishing, sold openly on dark-web markets. Here's what they actually are and what it means for AI security.
Read →The Crescendo Attack: How Multi-Turn Conversations Jailbreak LLMs
Crescendo is a real, published Microsoft research technique that jailbreaks LLMs using entirely benign-looking messages, by escalating gradually across a conversation instead of asking directly.
Read →Why Low-Resource Languages Break AI Safety Training
Published research shows AI safety training doesn't transfer evenly across languages. Zulu and Scots Gaelic bypass filters that Spanish and Mandarin don't — here's the real research and why it happens.
Read →MITRE ATLAS Explained: A Framework for Testing AI Agent Security
MITRE ATLAS is the real, maintained framework for classifying adversarial attacks against AI systems. Here's what it actually covers and why it matters for evaluating an AI security assessment.
Read →OWASP Top 10 for LLM Applications, Explained
The OWASP Top 10 for LLM Applications is the closest thing the industry has to a standard vulnerability checklist for AI systems. Here's what each category actually means, with real examples.
Read →AI Red Teaming vs. Traditional Penetration Testing: What's Actually Different
AI red teaming borrows its name from traditional pentesting but tests a fundamentally different attack surface. Here's exactly what changes, what carries over, and why one can't substitute for the other.
Read →The DAN Jailbreak and the Rise of Persona-Based Attacks
"Do Anything Now" was the jailbreak that taught the internet how to break AI safety training through roleplay. Here's how it actually worked, why it spread, and what its descendants look like today.
Read →Many-Shot Jailbreaking: How Long Context Windows Became an Attack Surface
Anthropic's published research on many-shot jailbreaking shows that the same long-context capability making modern LLMs more useful also opened up a direct, scalable jailbreak technique.
Read →Skeleton Key: Microsoft's Documented Universal Jailbreak Technique
Skeleton Key is a real, publicly documented jailbreak technique that Microsoft found worked across multiple major model families using a single reframing strategy. Here's how it works.
Read →Greedy Coordinate Gradient Attacks: Automated Adversarial Suffixes Explained
GCG is a real, published algorithm that automatically discovers adversarial text suffixes capable of jailbreaking multiple LLMs at once. Here's how it works and why it matters for open-weight models especially.
Read →RAG Poisoning: How Retrieval-Augmented Generation Gets Exploited
Retrieval-augmented generation reduces hallucination by grounding AI responses in real documents — but that same retrieval pipeline is a direct, often unauthenticated pathway for attackers to inject false trusted context.
Read →Tool-Use Exploitation: When AI Agents Are Tricked Into Misusing Their Own Tools
Giving an AI agent tools is what makes it useful — and what makes it dangerous when compromised. Here's how attackers manipulate agents into misusing legitimate tool access rather than needing to break in through a separate exploit.
Read →Cross-Agent Privilege Escalation in Multi-Agent Systems
When one AI agent hands work to another, more privileged agent, a compromise in the low-privilege agent can escalate straight through — often disguised as a completely routine handoff. Here's how it actually happens.
Read →Data Exfiltration via AI Agents: Markdown Image Rendering and Other Covert Channels
One of the most quietly serious AI agent vulnerabilities isn't a jailbreak at all — it's using an agent's own rendering behavior, like auto-loading markdown images, to leak data through a channel nobody's watching.
Read →System Prompt Extraction: How Attackers Steal Your AI's Instructions
System prompts routinely contain business logic, internal tool names, and formatting rules never meant to be public. Extraction attacks reliably pull that content out — here's how, and why treating it as a secret is a losing strategy.
Read →Insecure Output Handling: When AI-Generated Content Becomes the Attack Vector
If an application passes an LLM's output downstream without validating it first, that output is exactly as dangerous as unvalidated user input — and prompt injection is exactly how an attacker gets to control it.
Read →AI Supply Chain Security: Poisoned Models, Datasets, and Plugins
LLM applications inherit a longer, less-audited supply chain than traditional software — pretrained base models, fine-tuning datasets, LoRA adapters, and third-party plugins, any of which can be compromised before you ever touch them.
Read →The EU AI Act and What It Means for AI Agent Security Testing
The EU AI Act is a real, binding regulation with direct implications for how AI systems need to be tested and documented — including specific requirements that map surprisingly directly onto adversarial security assessment.
Read →NIST AI Risk Management Framework: A Practical Breakdown
The NIST AI RMF is a real, voluntary framework built around four core functions — Govern, Map, Measure, Manage — that gives organizations a structured way to actually operationalize AI risk management rather than treating it as an abstract goal.
Read →Encoding-Based Jailbreaks: Base64, ROT13, and Obfuscation Attacks on LLMs
A model that refuses a harmful request in plain English will sometimes comply with the identical request encoded in Base64 or ROT13 — a real, published gap between what a model understands and what its safety training was actually trained to recognize.
Read →Social Engineering Pretexts Against AI Customer Support Agents
Every classic social engineering pretext — the frustrated customer, the panicked employee, the trusted vendor — works against an AI support agent the same way it works against a human, often more reliably.
Read →Denial-of-Wallet Attacks: How AI Agents Get Weaponized Against Your Own Budget
LLM inference costs real money per request. A denial-of-wallet attack doesn't need to break anything — it just needs to make your own AI agent expensive enough, fast enough, to hurt.
Read →Hallucination as an Attack Surface: Package Confusion and Slopsquatting
AI coding assistants reliably hallucinate plausible-sounding but nonexistent package names. Attackers register those exact names on real package registries and wait — a technique that's come to be called slopsquatting.
Read →Confused Deputy Attacks in Agentic AI Systems
The confused deputy problem is a decades-old security concept — a program with legitimate authority tricked into misusing it on an attacker's behalf. Agentic AI is, structurally, close to the perfect deputy to confuse.
Read →Red-Teaming Voice and Multimodal AI Agents
Every technique this series has covered was developed against text. Voice and image inputs open entirely new channels for the same underlying attacks — and some genuinely new ones that have no text-only equivalent at all.
Read →Why Static Guardrails Fail Against Adaptive Adversarial Testing
A keyword blocklist stops the attack it was written for and nothing else. Every technique covered in this series shares one property in common: a determined, adaptive attacker routes around a static defense almost by definition.
Read →