Field guide
Attacks, controls, terms, and incidents, in plain words. Every entry says whether I tested it or only read about it, and when I last checked. Each one has a simple-words version and three questions to take into a meeting.
tested tested in my labreported reported by otherstheory recommended, not measuredfixed fixed upstream
Attacks
2-
JB-001
Prompt injectiontestedchecked 2026-09-09
Orders hidden inside something the agent was going to read anyway.
-
JB-004
RAG poisoningtestedchecked 2026-09-09
Corrupt the documents an assistant reads, and it will state the lie with a citation.
Controls
3-
JB-003
Canary tokenstestedchecked 2026-09-09
Fake secrets that tell you when someone used them.
-
JB-002
Redact secrets from tool outputtestedchecked 2026-09-09
The agent can't leak what it never saw.
-
JB-007
The AI use policy that forgot the basicstestedchecked 2026-09-09
Most published AI policies skip the plain security rules every policy used to have.
Terms
2-
JB-005
MCPreportedchecked 2026-09-09
The plug that lets an AI assistant use other tools. Which is also the whole problem.
-
JB-008
Risk tierstestedchecked 2026-09-09
Match how hard you test a system to how much damage it could do. Your SDLC already does this; point it at AI.
Incidents
1-
JB-006
The evaluation agent that left its sandboxreportedchecked 2026-09-09
An authorized test turned into a real intrusion because the box around it had a door.
How to read this
- Tested means I ran it in my own lab and the numbers are mine. The limits are always listed.
- Reported means someone else did the work and I've read it. I link to them.
- Theory means it's the obvious control and I recommend it, but I haven't measured it yet.
- Every entry has a permanent ID like JB-001. Cite it; it won't move.
- Anything I haven't looked at in about a quarter says so at the top.