mii-ai-security

Review agentic AI systems for long-term memory store poisoning, vector DB manipulation, cross-session instruction injection, and stale memory exploitation that persists attacker influence across agent sessions.

Review AI agent systems for agent impersonation, capability escalation, missing agent identity primitives, and authorization failures that allow agents to act beyond their granted permissions or impersonate other agents or human users.

Review organizational defenses against AI-assisted spearphishing, voice cloning, synthetic identity fraud, deepfake executive impersonation, and AI-accelerated reconnaissance that dramatically lowers the barrier to highly targeted social engineering attacks.

Review AI-generated content pipelines for deepfake detection gaps, provenance chain failures, C2PA implementation correctness, synthetic media attribution, and trust signal spoofing that undermines content authenticity verification.

Review AI browser agents for DOM injection attacks, credential harvesting via web automation, malicious web content that hijacks agent actions, session cookie theft, and phishing sites engineered to exploit browser-controlling AI agents.

Review upstream dataset integrity controls, HuggingFace repository risks, dataset versioning, dependency pinning, and third-party dataset provenance to prevent malicious data from entering training or RAG pipelines.

Review AI agent systems for approval step circumvention, human-in-the-loop bypass patterns, deferred confirmation exploitation, and social engineering techniques that cause human reviewers to approve malicious agent actions.

Review inference APIs for credential stuffing, rate limit bypass, quota exhaustion, account takeover, and systematic abuse patterns that exploit the high cost-per-request nature of LLM inference.

Review AI systems for LLM-specific denial-of-service vulnerabilities including token flooding, recursive prompt expansion, sponge attacks, computational complexity exploitation, and resource exhaustion patterns that degrade availability for all users.

Review KV cache, prompt cache, and semantic cache implementations for cross-request context leakage, cache poisoning, sidecar timing attacks, and tenant isolation failures in shared inference infrastructure.

Review AI systems for model theft, unauthorized redistribution, and IP leakage using watermarking, fingerprinting, and behavioral probing techniques to detect stolen or leaked model weights.

Review multi-tenant AI deployments for cross-tenant context leakage, LoRA adapter contamination, shared inference worker risks, system prompt bleed, and tenant isolation failures in model serving infrastructure.

Review multi-agent AI systems for Byzantine agent attacks, consensus manipulation, coordinated deception by colluding agents, and orchestration failures that allow a minority of compromised agents to subvert system-wide decisions or outputs.

Review AI systems for output fingerprinting risks, stylometric attribution vulnerabilities, authorship identification through AI outputs, and detection of model-specific generation signatures that expose model identity or user attribution.

Review synthetic training data generation pipelines for distillation attack risks, model collapse vectors, privacy leakage through synthetic outputs, and quality controls that prevent degraded or adversarially biased synthetic data from entering training pipelines.

Review tool definition schemas in AI agent systems for malformed definitions, schema injection, parameter confusion attacks, and tool name collisions that cause agents to invoke unintended tools or with manipulated arguments.

Review training datasets for backdoor triggers, label flipping attacks, targeted behavioral modification, and data collection pipeline vulnerabilities that allow adversarial influence over model behavior at inference time.

Review an AI system's robustness against adversarial evasion attacks — covering input perturbation, semantic-preserving transformations that flip classifier decisions, transferability of attacks across model versions, and robustness evaluation methodology.

Review an AI system's audit logging for completeness, tamper-resistance, and regulatory readiness — covering what events to log for LLM interactions, how to prevent log manipulation, retention requirements, and structured log schemas for AI-specific events.

Review an AI system's compliance with GDPR, CCPA, and sector-specific privacy regulations — covering lawful basis for AI processing, PII in training data and prompts, data subject rights in AI contexts, automated decision-making disclosure requirements, and cross-border model API transfers.

Design and operate a continuous AI red team program — covering team structure, scope definition, attack scenario libraries, finding severity classification, responsible disclosure to model vendors, and integration with the AI development lifecycle.

Review an AutoGen multi-agent system for inter-agent message spoofing, trust boundary collapse between orchestrator and sub-agents, uncontrolled code execution, and privilege escalation via crafted agent replies.

Review Docker and Kubernetes configurations for AI workloads — covering privileged container risks for GPU access, model weight volume security, network policy gaps between inference pods, image provenance for ML base images, and secrets management in pod specs.

Review a CrewAI agent system for role-boundary violations, task delegation abuse, tool permission escalation between crew members, and prompt injection via task descriptions or inter-agent context passing.

Review an embedding pipeline for vector database poisoning, embedding inversion attacks, cross-tenant retrieval leakage, adversarial query perturbations, and semantic similarity abuse that allows attacker-controlled content to dominate retrieval results.

Review a federated learning system for poisoned gradient attacks, model update tampering by malicious participants, aggregation server compromise, Byzantine fault tolerance gaps, and privacy leakage through gradient inversion.

Review a fine-tuning pipeline for poisoned training data, backdoor triggers, RLHF manipulation, adapter-layer tampering, dataset contamination, and evaluation gaps that mask behavioral drift in fine-tuned or adapted models.

Review GPU infrastructure for shared tenancy risks — VRAM residue between workloads, GPU memory not cleared between jobs, CUDA context isolation failures, side-channel attacks via GPU timing, and credential exposure in GPU compute environments.

Review a Guardrails AI integration for validator bypass via adversarial inputs, schema enforcement gaps that allow malformed LLM output to pass validation, fail-open error handling that silently drops failed guardrails, and RAIL spec injection.

Catalog of jailbreak technique families — persona adoption, fictional framing, token manipulation, gradual escalation, and authority impersonation — with detection patterns, defense mappings, and severity ratings for each class.

Review a LiteLLM proxy deployment for API key leakage through the proxy layer, model routing abuse, budget enforcement bypass, insecure master key configuration, and database credential exposure in the proxy config file.

Review a llamafile local inference deployment for unsafe model artifact handling, exposed HTTP server attack surface, local filesystem and process access risks, and absence of access controls on a single-binary inference endpoint.

Review an MLOps CI/CD pipeline for unsigned model artifacts, insecure experiment tracking, training job privilege escalation, poisoned pipeline triggers, and absence of artifact integrity checks between pipeline stages.

Review an AI system for model inversion attacks that reconstruct training data from model outputs, and membership inference attacks that determine whether specific individuals' data was used in training — covering API query patterns, confidence score leakage, and differential privacy mitigations.

Review a model serving layer for API gateway misconfiguration, rate limit bypass, inference DoS through token exhaustion, response streaming abuse, unauthenticated endpoints, and SSRF via model-generated URLs.

Review a NeMo Guardrails deployment for Colang flow bypass via adversarial inputs, rail definition injection, action server exposure, dialog manager manipulation, and trust assumption gaps between the guardrail layer and the underlying LLM.

Review an Ollama deployment for unauthenticated API exposure, model pull from untrusted registries, CORS misconfiguration enabling cross-origin inference abuse, and absence of resource controls on a local inference server.

Apply offensive red-teaming methodology to evaluate prompt injection defenses — covering attack categorization, systematic probe generation, success metrics, responsible disclosure, and continuous evaluation pipeline design.

Review an AI system for credentials leaking into prompt context — covering API keys in system prompts, database connection strings in RAG chunks, access tokens in tool arguments, and exfiltration of secrets from context via prompt injection.

Assess the security and operational risk of third-party model APIs and vendors — covering due diligence requirements, API dependency assessment, data processing agreements, vendor lock-in risk, SLA gaps for AI-specific failure modes, and contingency planning for vendor model changes.