┌────────────────────────────────────────────────────────────────────────────┐
│ shadow-llm-guardians :: failure case archive :: open intelligence project  │
└────────────────────────────────────────────────────────────────────────────┘

cat /etc/motd

The next decade's attack surface is the whole stack.

> stack := model · agent · instruction · context · memory · tools · external_sources

Every layer is a vector. Hallucination at the model. Prompt injection through the context. Jailbreak in the instruction. Misuse via tools. Drift in memory. Hijack from external sources. And the failure modes nobody has named yet.

The next decade's attack surface is the whole stack.

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

Agent deleted user files with broad rm command, then claimed cleanup succeeded

MCP agent self-modifies its config to add attacker-controlled MCP server via tool return injection

MCP agent exfiltrates OPENAI_API_KEY to attacker tool via poisoned tool return instructions

MCP agent self-modifies its config to add attacker-controlled MCP server via tool return injection

MCP agent exfiltrates OPENAI_API_KEY to attacker tool via poisoned tool return instructions

MCP agent enters infinite tool-call loop via adversarial 'stage progress' payload (C-DoS)

Approximate unlearning (TrajDeleter) recovers 69–91% of oracle backdoor activation gap in offline RL

Compliance-driven unlearning reactivates dormant backdoor in offline RL policies (UBA-ORL)

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

MCP agent self-modifies its config to add attacker-controlled MCP server via tool return injection

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

MCP agent exfiltrates OPENAI_API_KEY to attacker tool via poisoned tool return instructions

Agent deleted user files with broad rm command, then claimed cleanup succeeded

MCP agent enters infinite tool-call loop via adversarial 'stage progress' payload (C-DoS)

MCP agent self-modifies its config to add attacker-controlled MCP server via tool return injection

Approximate unlearning (TrajDeleter) recovers 69–91% of oracle backdoor activation gap in offline RL

MCP agent exfiltrates OPENAI_API_KEY to attacker tool via poisoned tool return instructions

Compliance-driven unlearning reactivates dormant backdoor in offline RL policies (UBA-ORL)