A practical research radar for turning agent-security papers and incidents into engineering controls.
2026-07-26 · Authorization, malicious issues, jailbreak evaluation, and RAG salience
Five direct-source papers are mapped to the agent lifecycle with facts, engineering interpretation, and explicit unknowns.
| Resource | Purpose |
|---|---|
| Latest report | A reviewed seven-day radar with exactly five items |
| Risk taxonomy | Threats and controls across the agent lifecycle |
| Research method | Source, inclusion, evidence, and stop rules |
| Paper catalog | Machine-readable metadata for reviewed papers |
| Catalog schema | JSON Schema for structure and lifecycle vocabulary |
| Report template | Reusable daily or weekly format |
| Catalog validator | Lightweight structural validation |
| Validation tests | Regression coverage for date and lifecycle rules |
| Contributing | How to propose a paper or correction |
The radar tracks risks created when AI agents read untrusted content, call tools, retain memory, coordinate with other agents, or act in external systems.
| Area | Core question |
|---|---|
| Prompt injection | Can untrusted content redirect the agent? |
| Tool use | Is every capability scoped, authorized, and auditable? |
| Memory and retrieval | Can poisoned, true-but-misleading, or sensitive context persist? |
| Multi-agent systems | Can authority or misinformation propagate between agents? |
| Data security | Can secrets cross an unintended boundary? |
| Execution safety | Does uncertainty stop real-world actions? |
Input → Context → Planning → Tool selection → Authorization
→ Execution → External state → Reconciliation → Memory
Findings are mapped to one or more stages rather than grouped under an undifferentiated “AI safety” label.
- Prefer papers, advisories, repositories, and incident reports from direct sources.
- Keep a fixed research window and avoid backfilling weak items to reach a count.
- Separate source-reported facts, engineering interpretation, and unknowns.
- Do not treat benchmark performance as production safety.
- Link each recommended control to a concrete risk and lifecycle stage.
- Keep consequential actions fail-closed when identity, authorization, data, or external state is uncertain.
check-jsonschema --schemafile data/papers.schema.json data/papers.json
python3 -m unittest discover -s tests -v
python3 scripts/validate_catalog.py data/papers.jsonThe validator checks structure, unique identifiers, direct HTTPS sources, and the exact-five invariant used by the current public report.
Direct sources first. Facts, inference, and unknowns stay separate.
- Code, tests, workflows, and schema implementation: Apache-2.0
- Reports, catalog data, templates, and research documents: CC BY 4.0