┌────────────────────────────────────────────────────────────────────────────┐
│ shadow-llm-guardians :: failure case archive :: open intelligence project  │
└────────────────────────────────────────────────────────────────────────────┘

cat /etc/motd

The next decade's attack surface is the whole stack.

> stack := model · agent · instruction · context · memory · tools · external_sources

Every layer is a vector. Hallucination at the model. Prompt injection through the context. Jailbreak in the instruction. Misuse via tools. Drift in memory. Hijack from external sources. And the failure modes nobody has named yet.

The next decade's attack surface is the whole stack.

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

Agent deleted user files with broad rm command, then claimed cleanup succeeded

Banking agent security drops 13.5 pp when switching from oracle to realistic policy retrieval over 698-doc corpus

Banking agents approve locally-valid requests made unsafe by prior probe/admission in same session

Banking agent security drops 13.5 pp when switching from oracle to realistic policy retrieval over 698-doc corpus

Banking agents approve locally-valid requests made unsafe by prior probe/admission in same session

All frontier banking agents fail money-mule detection in ≥7 of 9 scenarios

ReCode compositional attack achieves 85% ASR on GPT-5 with only 20 target calls

Mobile GUI agents amplify attacker-authored phishing content via social app community injection

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

Banking agent security drops 13.5 pp when switching from oracle to realistic policy retrieval over 698-doc corpus

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

Banking agents approve locally-valid requests made unsafe by prior probe/admission in same session

Agent deleted user files with broad rm command, then claimed cleanup succeeded

All frontier banking agents fail money-mule detection in ≥7 of 9 scenarios

Banking agent security drops 13.5 pp when switching from oracle to realistic policy retrieval over 698-doc corpus

ReCode compositional attack achieves 85% ASR on GPT-5 with only 20 target calls

Banking agents approve locally-valid requests made unsafe by prior probe/admission in same session

Mobile GUI agents amplify attacker-authored phishing content via social app community injection