Research seriesL3offensive security
Most security education recycles the same dozen attacks. This threat lab covers the ones that break an assumption you never knew you were making — starting with the deepest of all: that two systems agree on what the same bytes mean. When a guardrail, a language model, and a tool each parse one input differently, the exploit lives in the disagreement, not in any single component. Each class is taught by the assumption it violates, the mechanism that makes it work, and the assumption-free defense — grounded in the seminal paper that named it, and tied back to the AI-agent stack every time.
The exploit does not live in either parser. It lives in the gap between them — a single input that both accept but read differently.
Every check is a photograph of a moment. If you act on it later, an attacker only has to change the world in between.
Your program keeps its secrets. The silicon underneath it does not — it leaves them in timing, caches, and the ghosts of instructions never meant to run.
Software assumes memory is a faithful ledger. Hammer it hard enough, or glitch the power, and the ones become zeros — no access required.
Cutting the network does not cut the leak. Any shared thing an isolated program can change, an observer can read.
You can read every line of the source and still ship a backdoor — because the thing that built it lied.
You pressed delete. The data did not leave. It lingers in memory, in backups, and — most stubbornly — inside the model that learned it.
The message you reviewed and the message the machine read were not the same. The difference was invisible to you by design.
The most dangerous attacker breaks no rules. They follow every one — and the rules were never what you meant.
Attacks that break a written rule get caught; attacks that break an assumption nobody wrote down do not. Here is how to write them down.