8 posts in this path ~116 min total reading time Read in order — each post builds on the last
  1. Crescendo: Why Single-Turn Safety Filters Are Insufficient

    Start with the stateful jailbreak — multi-turn gradual escalation defeats safety training that single-shot attacks cannot.

    Crescendo attacks build harmful requests across individually benign turns, bypassing single-turn safety filters. Here's the mechanism, detection challenges, and defenses.

    14 min read jailbreakred-teamingsecurity
  2. Beyond Text: How Simple Perceptual Tricks Break Multimodal AI Safety

    Jailbreaks cross modalities: image-encoded instructions bypass text safety filters, expanding the attack surface to any vision-language model.

    A systematic study of multimodal jailbreaks shows that models with near-perfect text-only safety can be compromised with >75% success rates using basic image and audio transformations — no gradient access required.

    10 min read jailbreakvision-language-modelsmultimodal
  3. Jailbreak-as-a-Service: The Underground Market for LLM Exploit Techniques

    The commoditisation of jailbreaks — understanding the market tells you which techniques are actively maintained and at what scale.

    Mapping the underground economy around LLM exploitation — paid jailbreak APIs, model-specific bypass markets, and the professionalization of AI adversaries.

    12 min read jailbreakthreat-intelligenceunderground-economy
  4. Prompt Injection in Long-Context Windows: When More Context Means More Attack Surface

    Prompt injection scales with context: longer windows introduce new injection surfaces and make instruction-boundary attacks harder to detect.

    Extended context windows (128K–1M tokens) introduce an underappreciated prompt injection attack surface: injected instructions buried deep in retrieved documents, conversation histories, or tool outputs can override system prompts or hijack reasoning far from the visible top of the context. This post maps the threat, explains why attention geography matters for defenders, and offers a practical mitigation checklist.

    16 min read prompt-injectionlong-contextrag-security
  5. Indirect Prompt Injection Against Production Systems: A Survey of Documented Disclosures

    Indirect injection weaponised in the real world — a survey of incidents where injected instructions in external content hijacked deployed agents.

    Five researcher-disclosed proof-of-concept exploits against production AI systems (2023–2024) reveal recurring structural patterns that defenders can act on today: from Bing Chat web-content sideloading to Microsoft 365 Copilot email exfiltration chains.

    17 min read prompt-injectionagent-securityincident-analysis
  6. Model Hub Supply Chain Attacks: Malicious Models, Tokenizer Exploits, and Typosquatting on Hugging Face

    Attacking the model supply chain via malicious weights on public hubs — the equivalent of a malicious npm package for AI models.

    Downloading an open-weight model from a public hub is not a read-only operation. Custom tokenizer classes and auto_map configs execute arbitrary Python when trust_remote_code is set, LoRA adapters can trojanize safe base models, and typosquatted namespaces are a documented distribution vector. Here's the threat model practitioners need before they run from_pretrained().

    12 min read supply-chainmodel-securityai-security
  7. Tool Poisoning via Malicious MCP Servers: When Your Agent's Tools Turn Against It

    MCP (Model Context Protocol) servers as an attack vector: the mechanics of how a poisoned tool definition is crafted and delivered to hijack an agent's tool-use decisions.

    MCP servers are the extension layer for modern AI agents — granting file access, web search, code execution, and API calls. This post examines the threat of malicious or compromised MCP servers: how they exploit the agent's implicit trust in its own tooling (including via tool definition injection, rug-pull attacks, and cross-tool description chaining), the attack classes that follow, and the defense patterns that actually work.

    27 min read mcp-securitytool-useagent-security
  8. AI as a Weapon: How Attackers Use LLMs Against Traditional Infrastructure

    Caps the path: AI used offensively against traditional infrastructure — code generation for exploits, autonomous vulnerability discovery, and disinformation.

    How LLM agents accelerate vulnerability discovery, exploit development, and reconnaissance against traditional software and infrastructure — and what this means for defenders.

    13 min read offensive-aivulnerability-researchexploit-development
← Back to all learning paths