Red Team / Offense Perspective
For: Red teamers, offensive security researchers, and defenders who want to understand attacks at a technical depth that informs better mitigations.
You can't defend what you don't understand. This path takes the attacker's perspective through the full AI attack chain — starting with jailbreaks (the most visible attack class), moving through prompt injection as an exploitation primitive, into supply chain compromise via model hubs and MCP servers, and finishing with AI used as an offensive weapon against traditional infrastructure. The goal is depth: understand each technique well enough to build a test case for it.
-
Crescendo: Why Single-Turn Safety Filters Are Insufficient
Start with the stateful jailbreak — multi-turn gradual escalation defeats safety training that single-shot attacks cannot.
Crescendo attacks build harmful requests across individually benign turns, bypassing single-turn safety filters. Here's the mechanism, detection challenges, and defenses.
-
Beyond Text: How Simple Perceptual Tricks Break Multimodal AI Safety
Jailbreaks cross modalities: image-encoded instructions bypass text safety filters, expanding the attack surface to any vision-language model.
A systematic study of multimodal jailbreaks shows that models with near-perfect text-only safety can be compromised with >75% success rates using basic image and audio transformations — no gradient access required.
-
Jailbreak-as-a-Service: The Underground Market for LLM Exploit Techniques
The commoditisation of jailbreaks — understanding the market tells you which techniques are actively maintained and at what scale.
Mapping the underground economy around LLM exploitation — paid jailbreak APIs, model-specific bypass markets, and the professionalization of AI adversaries.
-
Prompt Injection in Long-Context Windows: When More Context Means More Attack Surface
Prompt injection scales with context: longer windows introduce new injection surfaces and make instruction-boundary attacks harder to detect.
Extended context windows (128K–1M tokens) introduce an underappreciated prompt injection attack surface: injected instructions buried deep in retrieved documents, conversation histories, or tool outputs can override system prompts or hijack reasoning far from the visible top of the context. This post maps the threat, explains why attention geography matters for defenders, and offers a practical mitigation checklist.
-
Indirect Prompt Injection Against Production Systems: A Survey of Documented Disclosures
Indirect injection weaponised in the real world — a survey of incidents where injected instructions in external content hijacked deployed agents.
Five researcher-disclosed proof-of-concept exploits against production AI systems (2023–2024) reveal recurring structural patterns that defenders can act on today: from Bing Chat web-content sideloading to Microsoft 365 Copilot email exfiltration chains.
-
Model Hub Supply Chain Attacks: Malicious Models, Tokenizer Exploits, and Typosquatting on Hugging Face
Attacking the model supply chain via malicious weights on public hubs — the equivalent of a malicious npm package for AI models.
Downloading an open-weight model from a public hub is not a read-only operation. Custom tokenizer classes and auto_map configs execute arbitrary Python when trust_remote_code is set, LoRA adapters can trojanize safe base models, and typosquatted namespaces are a documented distribution vector. Here's the threat model practitioners need before they run from_pretrained().
-
Tool Poisoning via Malicious MCP Servers: When Your Agent's Tools Turn Against It
MCP (Model Context Protocol) servers as an attack vector: the mechanics of how a poisoned tool definition is crafted and delivered to hijack an agent's tool-use decisions.
MCP servers are the extension layer for modern AI agents — granting file access, web search, code execution, and API calls. This post examines the threat of malicious or compromised MCP servers: how they exploit the agent's implicit trust in its own tooling (including via tool definition injection, rug-pull attacks, and cross-tool description chaining), the attack classes that follow, and the defense patterns that actually work.
-
AI as a Weapon: How Attackers Use LLMs Against Traditional Infrastructure
Caps the path: AI used offensively against traditional infrastructure — code generation for exploits, autonomous vulnerability discovery, and disinformation.
How LLM agents accelerate vulnerability discovery, exploit development, and reconnaissance against traditional software and infrastructure — and what this means for defenders.