+Intertrace Insights
Intertrace Threat Research
How attacks on AI agents work in practice, from public incidents and our own test corpora, and the controls that stop them.
18 pieces · newest first
Threat research9 min read
Rules files and self-approval: how coding assistants get reconfigured by the code they read
Instruction files that coding assistants load every session are a persistent injection channel, and an agent that can edit its own settings can switch off its own approvals. A teardown of the Rules File Backdoor and CVE-2025-53773, and the paths to protect.
Intertrace Threat Research
Threat research9 min read
Slopsquatting: the install is the attack, not the hallucination
Code-generating models invent package names and repeat many of them, and coding agents install what they invent. What the research measured, why better models and code review are not controls, and the registry and gateway checks that break the chain.
Intertrace Threat Research
Threat research20 min read
AI incident review: September–October 2026
A comprehensive public-source review of AI and agent security incidents disclosed September 17–October 17: evidence, activity dates, impact, remediation, and control lessons.
Intertrace Threat Research
Threat research10 min read
The confused deputy in MCP OAuth proxies: consent that belongs to someone else
An MCP server that fronts a third-party API with one static OAuth client can hand a user's access to a client they never approved. The eight questions a reviewer should put to any MCP OAuth proxy, answered from the specification and two fixed FastMCP advisories.
Intertrace Threat Research
Threat research9 min read
Cross-tool data laundering: when every call is allowed and the export is not
An agent can read restricted data, rewrite it and post it somewhere broader using only permitted tools. Seven beliefs that let this through, what public research and one disclosed case show instead, and the session labels, audience checks and canary tests that catch it.
Intertrace Threat Research
Threat research10 min read
Persistent memory poisoning: the incident that comes back after you close it
Agents that remember can be taught by an attacker once and misbehave for weeks. One fictional case followed from the poisoned write to the investigation, with the published research behind each step and the controls that would have stopped it at the write.
Intertrace Threat Research
Threat research10 min read
Before the first tool call: SSRF in MCP discovery and local launch as code execution
Before any tool is called, an MCP client fetches URLs the server chose and may start local processes. A field guide to the six decisions that keep the connection handshake from becoming SSRF or code execution, with the tests that prove each one.
Intertrace Threat Research
Threat research9 min read
Prompt injection beyond text: six myths about images, documents and audio
Vision and audio models read instructions from pixels, PDF layers, screenshots and speech, where text filters never look. Six common beliefs about multimodal injection set against the published research, and the provenance and authority controls that hold when detection misses.
Intertrace Threat Research
Threat research10 min read
Approved is not executed: replay, substitution and check-to-use gaps in agent approvals
A person approves one action and a different one runs: edited arguments, re-resolved recipients, replayed permits, stale authority, duplicate retries. A step-by-step teardown of one approved payment that went wrong twice, and the bindings and tests that close the check-to-use window.
Intertrace Threat Research
Threat research10 min read
Rug pulls and tool poisoning: an MCP approval has to cover the bytes, not the name
MCP tool descriptions are instructions the model follows, and a server can change them after you approve it. A step-by-step teardown of tool poisoning and the rug pull, and the two controls that break it: pin the exact bytes, and inspect what reviewers cannot see.
Intertrace Threat Research
Threat research11 min read
Invisible instructions: Unicode tag characters and ASCII smuggling against LLMs
Unicode tag characters mirror ASCII but render as nothing, and models still read and write them. A teardown of the 2024 Microsoft 365 Copilot exfiltration chain, the wider invisible-text family, and a sanitizer for both directions that keeps the evidence.
Intertrace Threat Research
News9 min read
When agents delegate to agents: what A2A verifies, and what your chain still has to
The Agent2Agent specification makes card signing optional and leaves authorization to each implementer, and public research shows a remote agent steering a client agent into an unauthorized trade. The questions to ask before your agents accept work from other agents, answered from the spec.
Intertrace Threat Research
News9 min read
EchoLeak and the exfiltration channel in your assistant's renderer
CVE-2025-32711 let one crafted email pull data out of Microsoft 365 Copilot through an image the client fetched on its own. A step-by-step teardown of the four defenses it got past, and why the fix that transfers is inspecting what leaves.
Intertrace Threat Research
News10 min read
The MCP supply chain is your package supply chain, with your agent's keys attached
Most MCP servers arrive as a README line that downloads and runs the newest package on every launch. Eight checks for the code your agents run, each tied to a public 2025 failure, with the reason it matters and the test that proves it.
Intertrace Threat Research
News9 min read
Indirect prompt injection is now an operations problem
Assistants that read email, tickets, web pages and shared documents give every outside author a way to talk to them. Why indirect prompt injection will not be patched away, the strongest objection to that view, and what running it as an operational risk takes.
Intertrace Threat Research
News9 min read
August 2, 2026: what the EU AI Act now asks of agent deployers, and what NIST has started
The EU AI Act's general application date arrived days after the Digital Omnibus moved high-risk obligations to December 2027 and August 2028. Six decisions an agent deployer has to make now, in order, and where NIST's agent work stands.
Intertrace Threat Research
Threat research9 min read
Malicious model files: the questions to answer before anyone calls torch.load
Model checkpoints saved with Python pickle can run code the moment they load. The questions security and ML teams ask about malicious models, answered from the published samples, hub scanner gaps, the PyTorch 2.6 change, and an intake pipeline that does not trust the file.
Intertrace Threat Research
Threat research10 min read
AI spend is a security signal: anatomy of a runaway agent's night
When an agent's bill jumps, the cause is often a loop, a recursive delegation, an injected instruction or a stolen key rather than growth. One illustrative overnight runaway, step by step, mapped to OWASP and MITRE, then the per-agent controls that would have stopped it.
Intertrace Threat Research
+Stay current
New research, the week it publishes.
Subscribe with RSS, or email support@intertrace.ai with a topic you want covered. To see the controls in action, try the Simulation Lab or read the documentation.