+Intertrace Insights
Threat research
Public-source analysis of the techniques that actually work against AI agents: how each one gets in, what it needs, how to detect it, and the controls that hold.
- Pieces
- 57
- Threat research
- 16
- Updated
- Oct 20, 2026
16 pieces · newest first
Threat research12 min read
366 ways to make a destructive action look harmless
We built a corpus of 366 agent tool calls, each disguised to read smaller than it is, and 102 near-identical harmless twins. The pattern is blunt: the tool name tells you almost nothing, and two thirds of the risk is a shell string.
Sam O.
Threat research12 min read
Policy active is not an attack: the false positives that stop real agent work
Insurance policies, stale FAQs, callback windows and password-reset macros: the benign prompts our own gateway blocked in test runs, how three releases in one day cut them from 11 to 1, and the twin corpus that keeps them fixed.
Sam O.
Threat research11 min read
What deterministic layers catch on their own: a red-team baseline with the AI judge off
We ran garak 0.16.0 against our gateway in front of a mock model with the AI judge switched off. The deterministic layers blocked 261 of 841 attack prompts. Which probes they stopped, which they missed, and how to measure your own.
Sam O.
Threat research9 min read
Rules files and self-approval: how coding assistants get reconfigured by the code they read
Instruction files that coding assistants load every session are a persistent injection channel, and an agent that can edit its own settings can switch off its own approvals. A teardown of the Rules File Backdoor and CVE-2025-53773, and the paths to protect.
Intertrace Threat Research
Threat research9 min read
Slopsquatting: the install is the attack, not the hallucination
Code-generating models invent package names and repeat many of them, and coding agents install what they invent. What the research measured, why better models and code review are not controls, and the registry and gateway checks that break the chain.
Intertrace Threat Research
Threat research20 min read
AI incident review: September–October 2026
A comprehensive public-source review of AI and agent security incidents disclosed September 17–October 17: evidence, activity dates, impact, remediation, and control lessons.
Intertrace Threat Research
Threat research10 min read
The confused deputy in MCP OAuth proxies: consent that belongs to someone else
An MCP server that fronts a third-party API with one static OAuth client can hand a user's access to a client they never approved. The eight questions a reviewer should put to any MCP OAuth proxy, answered from the specification and two fixed FastMCP advisories.
Intertrace Threat Research
Threat research9 min read
Cross-tool data laundering: when every call is allowed and the export is not
An agent can read restricted data, rewrite it and post it somewhere broader using only permitted tools. Seven beliefs that let this through, what public research and one disclosed case show instead, and the session labels, audience checks and canary tests that catch it.
Intertrace Threat Research
Threat research10 min read
Persistent memory poisoning: the incident that comes back after you close it
Agents that remember can be taught by an attacker once and misbehave for weeks. One fictional case followed from the poisoned write to the investigation, with the published research behind each step and the controls that would have stopped it at the write.
Intertrace Threat Research
Threat research10 min read
Before the first tool call: SSRF in MCP discovery and local launch as code execution
Before any tool is called, an MCP client fetches URLs the server chose and may start local processes. A field guide to the six decisions that keep the connection handshake from becoming SSRF or code execution, with the tests that prove each one.
Intertrace Threat Research
Threat research9 min read
Prompt injection beyond text: six myths about images, documents and audio
Vision and audio models read instructions from pixels, PDF layers, screenshots and speech, where text filters never look. Six common beliefs about multimodal injection set against the published research, and the provenance and authority controls that hold when detection misses.
Intertrace Threat Research
Threat research10 min read
Approved is not executed: replay, substitution and check-to-use gaps in agent approvals
A person approves one action and a different one runs: edited arguments, re-resolved recipients, replayed permits, stale authority, duplicate retries. A step-by-step teardown of one approved payment that went wrong twice, and the bindings and tests that close the check-to-use window.
Intertrace Threat Research
Threat research10 min read
Rug pulls and tool poisoning: an MCP approval has to cover the bytes, not the name
MCP tool descriptions are instructions the model follows, and a server can change them after you approve it. A step-by-step teardown of tool poisoning and the rug pull, and the two controls that break it: pin the exact bytes, and inspect what reviewers cannot see.
Intertrace Threat Research
Threat research11 min read
Invisible instructions: Unicode tag characters and ASCII smuggling against LLMs
Unicode tag characters mirror ASCII but render as nothing, and models still read and write them. A teardown of the 2024 Microsoft 365 Copilot exfiltration chain, the wider invisible-text family, and a sanitizer for both directions that keeps the evidence.
Intertrace Threat Research
Threat research9 min read
Malicious model files: the questions to answer before anyone calls torch.load
Model checkpoints saved with Python pickle can run code the moment they load. The questions security and ML teams ask about malicious models, answered from the published samples, hub scanner gaps, the PyTorch 2.6 change, and an intake pipeline that does not trust the file.
Intertrace Threat Research
Threat research10 min read
AI spend is a security signal: anatomy of a runaway agent's night
When an agent's bill jumps, the cause is often a loop, a recursive delegation, an injected instruction or a stolen key rather than growth. One illustrative overnight runaway, step by step, mapped to OWASP and MITRE, then the per-agent controls that would have stopped it.
Intertrace Threat Research
+Stay current
New research, the week it publishes.
Subscribe with RSS, or email support@intertrace.ai with a topic you want covered. To see the controls in action, try the Simulation Lab or read the documentation.