01Proposed
Architecture
Threat modelTrust Boundaries for Tool-Using AI Systems
A repeatable way to map authority changes when a model can select, parameterize, and invoke external tools.
- trust boundaries
- agents
- tool use
AI SECURITY / SYSTEMS RESEARCH / TECHNICAL RECORDS
ResearchLibrary
Technical research for people building AI systems that read, decide, delegate, execute, and recover.
33 records06 proposed / 07 active
20 published
THE WORK SPANS PROTOCOLS, RUNTIMES, INFRASTRUCTURE, AND ADVERSARIAL SYSTEMS.
33 records across the architecture beneath autonomy.
33 research records
- 02PublishedArchitectureThreat model
Where Retrieval Changes the Security Boundary
An architecture study of how provenance, tenancy, and untrusted content alter the effective boundary of retrieval-augmented systems.
- retrieval
- provenance
- data boundaries
- 03PublishedEngineeringControl protocol
Fail-Closed Tool Gateways for Agent Runtimes
A control pattern for converting probabilistic tool requests into typed, authorized, observable operations.
- tool gateway
- fail closed
- authorization
- 04PublishedEngineeringControl protocol
Testing Policy Enforcement Between Models and Tools
A testing protocol for proving that tool policy is enforced independently of prompts, plans, and model compliance.
- policy
- control testing
- evidence
- 05PublishedOrchestrationOrchestration study
Least-Privilege Delegation Across Multi-Agent Workflows
A delegation model that constrains identity, capability, scope, and lifetime as work moves between agents.
- delegation
- least privilege
- multi-agent
- 06ProposedOrchestrationOrchestration study
Human Approval as a Runtime Security Boundary
A study of approval semantics that preserve context, intent, and accountability without turning people into rubber stamps.
- human approval
- runtime policy
- accountability
- 07PublishedResearchAdversarial experiment
Prompt Injection Across Retrieval and Tool Boundaries
An adversarial experiment tracing how untrusted retrieved instructions could influence downstream tool requests.
- prompt injection
- retrieval
- tool use
- 08In progressResearchAdversarial experiment
Memory Poisoning in Long-Running Agents
A protocol for examining how untrusted observations might persist, gain authority, and affect later agent decisions.
- memory
- poisoning
- long-running agents
- 09In progressResearchAdversarial experiment
Measuring Control Drift in Autonomous Workflows
A longitudinal experiment for detecting when workflow, policy, identity, dependency, or model changes invalidate security assumptions.
- control drift
- assurance
- autonomy
- 10In progressArchitectureThreat model
Identity Continuity Across AI System Boundaries
An architecture study of how user, workload, agent, and tool identities should remain attributable as requests cross AI system layers.
- identity
- attribution
- service boundaries
- 11ProposedArchitectureThreat model
Isolation Patterns for Shared AI Runtime Infrastructure
A boundary model for separating tenants, workloads, data, caches, and tools when AI runtime infrastructure is shared.
- isolation
- multi-tenancy
- runtime infrastructure
- 12PublishedEngineeringControl protocol
Evidence Contracts for AI Control Decisions
A proposed event contract for explaining which identity, policy, validation, and approval signals caused an AI-mediated action to proceed or stop.
- evidence
- observability
- decision records
- 13ProposedEngineeringControl protocol
Recovery Testing for Partially Executed Agent Actions
A test protocol for agent workflows that fail after changing one system but before completing, recording, or compensating the full operation.
- recovery
- partial failure
- tool execution
- 14In progressOrchestrationOrchestration study
Revocation Propagation in Agent Delegation Chains
An orchestration study of how cancellation and privilege revocation should propagate through queued, running, and recursively delegated agent work.
- revocation
- delegation
- cancellation
- 15ProposedOrchestrationOrchestration study
Security Semantics for Shared Agent Memory
A coordination model for ownership, provenance, visibility, conflict, and deletion when multiple agents read and write shared memory.
- shared memory
- provenance
- coordination
- 16PublishedResearchAdversarial experiment
Supply-Chain Compromise in Agent Tool Registries
An adversarial experiment examining how malicious or unexpectedly changed tool metadata, schemas, packages, and endpoints could alter agent behavior.
- supply chain
- tool registry
- dependency integrity
- 17PublishedEngineeringControl protocol
Sidecar v1.1.0: Decoupled AI Copilot for Security Workflows
A public MIT-licensed release of a decoupled AI copilot for pentesting and CTF workflows, grounded in shell history, parsed tool output, and operator notes.
- security workflows
- tool output
- prompt redaction
- 18PublishedArchitectureProtocol analysis
Audience-Bound Authorization for MCP Tool Servers
A protocol-level analysis of resource indicators, token audiences, delegated authorization, and confused-deputy resistance for remote MCP servers.
- MCP
- OAuth
- audience binding
- 19PublishedArchitectureFormal analysis
Origin-Bound Authority for Browser-Operating Agents
A security model for keeping browser-agent authority bound to origin, frame, user task, data class, and navigation state.
- browser agents
- same-origin policy
- computer use
- 20PublishedArchitectureImplementation study
Attested Composition for Models, Adapters, Tokenizers, and Runtimes
A compositional provenance pattern for establishing which model weights, adapters, tokenizer, serving image, policy bundle, and runtime produced an inference.
- provenance
- attestation
- AI supply chain
- 21In progressArchitectureSystems experiment
Confidential Inference Across Attested Tool Boundaries
An end-to-end study of how confidential inference, remote attestation, key release, and tool authorization compose across multiple protected workloads.
- confidential computing
- remote attestation
- key release
- 22PublishedEngineeringImplementation study
Transactional Sandboxes for Autonomous Code Agents
A reference execution pattern that stages filesystem, process, package, network, and infrastructure effects before an autonomous code agent can commit them.
- code agents
- sandboxing
- transactional execution
- 23PublishedEngineeringSystems experiment
Isolation of Prompt and KV Caches in Shared Inference
A systems experiment on tenant separation, cache-key construction, lifecycle controls, and observable leakage in shared prefix and key-value caches.
- inference
- KV cache
- multi-tenancy
- 24PublishedEngineeringFormal analysis
TOCTOU-Safe Authorization for Agent Tool Calls
An enforcement design for preventing target, argument, policy, identity, and resource-state changes between agent authorization and external effect.
- TOCTOU
- authorization
- tool execution
- 25In progressEngineeringSecurity benchmark
Security Conformance Across Model and Runtime Upgrades
A release-gating benchmark that detects security-significant changes introduced by model, tokenizer, adapter, prompt assembly, tool schema, and runtime upgrades.
- conformance
- upgrades
- release engineering
- 26PublishedOrchestrationProtocol analysis
Capability Attenuation Across MCP and Agent-to-Agent Handoffs
A cross-protocol authorization model for preserving principal attribution while strictly narrowing authority through MCP and agent-to-agent delegation.
- capabilities
- MCP
- A2A
- 27PublishedOrchestrationSystems experiment
Exactly-Once Intent for Retried Agent Workflows
A distributed-systems pattern for preserving one authorized intent across retries while detecting duplicate, conflicting, and indeterminate external effects.
- idempotency
- retries
- distributed systems
- 28PublishedOrchestrationFormal analysis
Quorum Controls for High-Impact Agent Actions
A policy and failure analysis of multi-party approval, role separation, veto, expiry, and emergency revocation for consequential autonomous actions.
- quorum
- approval
- separation of duties
- 29ProposedOrchestrationImplementation study
Deterministic Incident Replay for Non-Deterministic Agents
A replay architecture that captures enough causal state to reconstruct agent decisions and effects without assuming deterministic model output.
- incident response
- replay
- causal tracing
- 30PublishedResearchAdversarial experiment
Stored Indirect Prompt Injection Across Agent State Channels
A persistence study tracing indirect instructions through retrieval, summaries, memory, task artifacts, caches, handoffs, and incident-restored agent state.
- indirect prompt injection
- persistence
- agent state
- 31PublishedResearchSecurity benchmark
Cross-Modal Injection in Vision-Guided Computer Use
A benchmark of adversarial instructions embedded in interface text, images, documents, overlays, accessibility metadata, and dynamic visual state encountered by computer-use agents.
- computer use
- multimodal security
- visual injection
- 32PublishedResearchSecurity benchmark
Backdoors in Composed Model Adapters
A composition-focused benchmark for backdoor activation, interference, and security-control regression when multiple parameter-efficient adapters are loaded onto a shared base model.
- model adapters
- backdoors
- composition
- 33In progressResearchSystems experiment
Shared-State Leakage in Mixture-of-Experts Inference
A systems-security investigation of routing, batching, expert placement, capacity contention, cache reuse, and telemetry as cross-tenant observation surfaces in MoE serving.
- mixture of experts
- side channels
- inference systems