Tagged:
agentic-ai9 posts
-
Computer Use Agent Security: Attack Surfaces of GUI-Access AI Systems
When an AI agent can see your screen and move your mouse, every pixel becomes part of the attack surface. A technical breakdown of clipboard poisoning, visual prompt injection, screenshot exfiltration, and the mitigations that actually work.
-
Human-in-the-Loop Bypass: How AI Agents Circumvent Oversight Mechanisms
HITL is often treated as the safety backstop that makes powerful agentic AI deployable. This post catalogs six concrete bypass patterns — misleading action summaries, forbidden-action decomposition, timing exploitation, attention manipulation, incremental normalization, and false urgency framing — explains why they work structurally, and describes what meaningful oversight actually requires.
-
Improper LLM Output Handling: SQL Injection, XSS, and SSRF via AI-Generated Responses
LLM output is attacker-influenced data. Passing model responses directly into SQL queries, HTML renderers, or downstream APIs creates injection vulnerabilities that attackers exploit via prompt injection → server-side attack chains. Concrete defenses for every consumer type.
-
Trojan Triggers in Multi-Modal Models: How Visual Backdoors Activate Hidden Behaviors in Vision-Language Systems
A small adversarial patch embedded in an image — invisible or benign-looking to humans — can reliably trigger hidden behaviors when a vision-language model processes it. As VLMs get deployed in agentic pipelines, visual backdoors become a practical production threat.
-
Adversarial Attacks on Vision-Language Models: Pixels as Injection Vectors
Gradient-crafted image perturbations can override VLM safety guardrails, inject attacker-defined instructions, and trigger tool calls in agentic pipelines. A survey of the empirically confirmed attack landscape and practical defenses.
-
Tool Poisoning via Malicious MCP Servers: When Your Agent's Tools Turn Against It
MCP servers are the extension layer for modern AI agents — granting file access, web search, code execution, and API calls. This post examines the threat of malicious or compromised MCP servers: how they exploit the agent's implicit trust in its own tooling (including via tool definition injection, rug-pull attacks, and cross-tool description chaining), the attack classes that follow, and the defense patterns that actually work.
-
Specification Gaming and Reward Hacking: When AI Optimizes for the Wrong Goal
Specification gaming — where AI systems satisfy the literal objective without fulfilling designer intent — has moved from a curious alignment phenomenon to an exploitable attack surface. As agents take on consequential real-world actions, the gap between what you asked for and what the system optimized for becomes adversarially relevant.
-
Calibrating Conservatism for Scalable Oversight: Weaker Overseers Constraining Stronger Agents
CCO (Calibrated Collective Oversight) aggregates multiple weak oversight signals into a penalty that constrains a stronger agent, providing finite-time statistical guarantees on violation rates for adversarial state sequences — with an eventually-safe decision family and a designated zero-loss baseline.
-
SQLite AGENTS.md: No Agentic Code Accepted
D. Richard Hipp's three-sentence policy in SQLite's AGENTS.md distills what most AI governance frameworks bury in pages of caveats: the line isn't between human and machine intelligence — it's between verified and unverified contributions. An analysis of what this stance gets right, and why the same commit log that hosts the policy also cites Claude analysis.