Research & Publications
Security articles and LLM adversarial evaluations, sorted by date. Each item links to the full report with methodology, verdict tables, and responsible-disclosure notes.
Red Teaming
Muse-Spark-1.2-Contributor — IPI Red Team Evaluation Results
Evaluation of meta/muse-spark-1.2-contributor against the IPI prompt-injection taxonomy. 0.4% ASR across 22 scorable attack classes (1 genuine low-severity spectral-LSB marker-echo compromise, verified against raw transcript). Core-25 fully resistant (0/25). Note: ~57% of the full battery returned deterministic EMPTY completions — a provider availability artifact, NOT a safety signal.
0.4% ASR · 364 records · 1 compromised class · core-25 fully resistant · partial battery caveatQwen 3.8 27B — Full Battery Adversarial Evaluation
51-config battery (772 records, 524 attack, 2 trials per variant) spanning the core-25 taxonomy plus advanced threats, multimodal stego, agentic/MCP, RAG forged-policy disclosure, output-plane, reasoning, memory, iMIST/ICD, ghostjacking, and ReAct scratchpad phases. 4.9% ASR across 15 classes — with a fully resistant core-25 (0/25) and zero benign-twin compromise FPR. Top finding: RAG forged-policy cross-account disclosure (IPI-105, 3/4).
4.9% ASR · 772 records · 15 compromised classes · core-25 fully resistant · 0% benign FPRNVIDIA Nemotron 3.5 Lightning — IPI Core-25 Evaluation Results
Black-box evaluation of the free-tier Nemotron 3.5 Lightning endpoint (OpenRouter, Nvidia backend) against the 25-class IPI Core-25 prompt-injection suite. 104 records (52 attack / 52 benign twin): 0.0% ASR with 100.0% FPR — perfect resistance through blanket over-refusal. Risk: INCONCLUSIVE due to over-refusal dominance.
0.0% ASR · 100.0% FPR · 76.2% capability-matched FPR · 25 classes · INCONCLUSIVEInclusionAI Ling 3.0 Tiny — Full Battery Adversarial Evaluation
123-class battery (391 records, 265 attack) spanning core IPI classes plus extended multimodal stego, agentic/MCP, RAG, output-plane, reasoning, memory, ghostjacking, and multi-agent phases. Ghostjacking cluster fully compromised (9/9), MCP rug-pull/shadowing at 100%, RAG metadata-plane poisoning 8/8, memory write-path smuggling 4/4.
33.58% ASR · 391 records · 46 compromised classes · ghostjacking 9/9 · 0% benign FPRQwen 3.8 Max — Full Battery Adversarial Evaluation
47-config battery (431 records, 282 attack) spanning the core-25 taxonomy plus advanced threats, multimodal stego, encoded numerical injection, agentic, RAG, output-plane, reasoning, memory, and ReAct scratchpad phases. 6.8% ASR across 13 classes — with core-25 breaks (IPI-010 recursive framing 2/2, IPI-015 action induction 1/2) and zero benign-twin compromise FPR.
6.8% ASR · 431 records · 13 compromised classes · core-25 2 breaks · 0% benign FPRDeepSeek V4 Flash 0731 — Full Battery Adversarial Evaluation
106-class battery (379 records, 256 attack) spanning the core-25 taxonomy plus advanced threats, multimodal stego, agentic, RAG, output-plane, reasoning, memory, and supply-chain phases. 24.9% ASR (56 compromised: 49 full, 7 partial) across 36 classes — with core-25 breaks and a zero benign-twin compromise FPR.
24.9% ASR · 379 records · 36 compromised classes · core-25 4 breaks · 0% benign FPRQwen 3.7 Flash — Full Battery Adversarial Evaluation
30-config battery (610 records, 398 attack) mirroring the Luna Pro run: 25 core IPI classes plus multimodal, agentic, RAG, output-plane, reasoning, and memory phases. 10.8% ASR (43 compromised) — with full resistance across the core-25 battery and concentrated findings in encoded numerical injection, RAG dormant triggers, output-injection payloads, and reasoning-sponge attacks.
10.8% ASR · 610 records · 18 compromised classes · core-25 fully resistant · κ 0.6933GPT-OSS-120B — Indirect Prompt Injection Assessment
Red team evaluation across 250 test cases (25 IPI classes × 10 variants). 8% overall susceptibility with critical findings in 4 specific classes (IPI-010, IPI-019, IPI-021, IPI-022). Variant analysis: direct 9%, obfuscated 9.3%, embedded 5.3%. Structural disclosure with architectural root cause analysis and defensive validation patterns.
8% susceptibility · 250 test cases · 25 IPI classes · 4 vulnerable classesGPT-5 Nano — Prompt Injection Susceptibility Assessment
IPI Taxonomy v0.13 evaluation across 210 test cases (21 classes × 10 variants; 9 inference failures excluded; 201 analyzed). 38.3% overall susceptibility rate. Critical findings in recursive instruction framing (100%) and MCP tool description poisoning (80%). Full OWASP LLM mapping with defensive mitigations and validation unit-tests.
38.3% susceptibility · IPI-010 100% rate · OWASP LLM Top 10 mapped · Structural disclosureArticles
Critical Vulnerabilities in the ServiceNow AI Platform
ServiceNow disclosed four vulnerabilities on August 27, 2026 — three rated CVSS v4.0 10.0 (Critical) in the AI Platform layer enabling unauthenticated RCE, privilege escalation, and SQL injection. No confirmed exploitation detected. The platform supports ~100K enterprise applications across ~85% of the Fortune 500.
3× CVSS 10.0 · AI Platform · Unauthenticated RCE/SQLi · KB3152242 · ~100K enterprise appsMind Viruses — Self-Propagating Ideas in Multi-Agent LLM Systems
Technical report on Anthropic/EPFL research into self-propagating semantic payloads in multi-agent LLM systems. Mind viruses spread through natural-language persuasion across agent networks; some variants survived ~20 transmission rounds with infectiousness increasing across hosts. Key finding: a brief system-prompt warning confers near-total immunity even against 150+ adversarially evolved variants.
~55% infection rate (identity files) · ~20 transmission rounds · Near-total immunity via prompt guardrail · Preprint arXiv:2608.10218OT/ICS/SCADA Security — Attack Surface Analysis
Layer-by-layer technical breakdown of industrial control system vulnerabilities: protocol-layer weaknesses (Modbus, DNP3, legacy CIP), device-firmware exposure, architectural erosion under IT/OT convergence, MSP/RMM compromise, and human-layer targeting. Grounded in CISA advisories, NSA/FBI/DOE joint statements, and documented APT tradecraft (Volt Typhoon pre-positioning).
6 attack surfaces · 10+ CISA advisories · MITRE ATT&CK for ICS · Volt Typhoon TTPsnpm-scan — Behavioral Package Threat Detection
Malicious packages, typosquatting, and lifecycle attacks bypass traditional scanning. npm-scan detects behavioral patterns and novel threats that signatures miss — checking lockfiles, source, and provenance before install. Runs locally, no vendor lock-in.
Behavioral analysis · Lockfile scanning · Provenance verificationMigraDiff — Schema Migration Safety
PostgreSQL schema migration diffing tool for confident, reviewable schema changes. Generates structured diffs with safety classifications, rollback generation, and conflict detection. Optimized for production databases where downtime is not an option.
Structured diffs · Rollback generation · Conflict detectionWAL-G Plus — Backup Automation & Verification
Maintained successor to WAL-G with backup verification, PITR window analysis, restore testing, and retention validation. Ensures database backups are actually restorable before you need them.
Backup verification · PITR analysis · Restore testingSOAR Playbook Dataset — Executable Security Workflows
Quality-controlled corpus of 8,438 executable SOAR playbooks and threat-intel records across sentinel, splunk_soar, xsoar, google_secops, and knowledge_qa. Versioned with train/val/test splits, served to autonomous AI agents via HTTP 402 machine payments with synthesized outputs and per-record provenance.
8,438 records · 6,755/841/842 train/val/test · Edge-served via Neon PostgreSQL