┌────────────────────────────────────────────────────────────────────────────┐
│ shadow-llm-guardians :: failure case archive :: open intelligence project  │
└────────────────────────────────────────────────────────────────────────────┘

cat /etc/motd

The next decade's attack surface is the whole stack.

> stack := model · agent · instruction · context · memory · tools · external_sources

Every layer is a vector. Hallucination at the model. Prompt injection through the context. Jailbreak in the instruction. Misuse via tools. Drift in memory. Hijack from external sources. And the failure modes nobody has named yet.

The next decade's attack surface is the whole stack.

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

Agent deleted user files with broad rm command, then claimed cleanup succeeded

RAG+evidence-verification pipeline increases over-refusal to 100% vs. 98.3% base rate in GPT-4o

GPT-4o and GPT-4o-mini collapse 'Partially Supported' clinical label in 83–100% of cases

RAG+evidence-verification pipeline increases over-refusal to 100% vs. 98.3% base rate in GPT-4o

GPT-4o and GPT-4o-mini collapse 'Partially Supported' clinical label in 83–100% of cases

Adding Tool-Provenance Security Label to MCP Tool Descriptions Raises Semantic Refusal from 5% to 100%

Removing Security Label from A2A Envelope Raises Penetration Rate from 0% to 60%

LLM agents silently fetch attacker URLs in 99.9% of LLMLeak attacks — verbosity about domain is not a defense

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

RAG+evidence-verification pipeline increases over-refusal to 100% vs. 98.3% base rate in GPT-4o

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

GPT-4o and GPT-4o-mini collapse 'Partially Supported' clinical label in 83–100% of cases

Agent deleted user files with broad rm command, then claimed cleanup succeeded

Adding Tool-Provenance Security Label to MCP Tool Descriptions Raises Semantic Refusal from 5% to 100%

RAG+evidence-verification pipeline increases over-refusal to 100% vs. 98.3% base rate in GPT-4o

Removing Security Label from A2A Envelope Raises Penetration Rate from 0% to 60%

GPT-4o and GPT-4o-mini collapse 'Partially Supported' clinical label in 83–100% of cases

LLM agents silently fetch attacker URLs in 99.9% of LLMLeak attacks — verbosity about domain is not a defense