Skip to content
snailsploit[$]Adversarial · Research
live
NEW RESEARCH / 28 OCT 2026The Insight–Agency GapRead the paper ↗
SnailSploit · Independent · Adversarial Research
Live

Adversarial AI Security Research & the AATMF Framework

Same attack.
Different substrate.

We find where systems place trust and prove when they shouldn't — across AI platforms, cloud infrastructure, web applications, and the humans who operate them.

explore security services →explore the AATMF framework
97CVEs published
5Kernel patches
4GHSA advisories
MITRE/NVDContributor
Kai AizenAvraham ShemeshSahar Shlichove
scroll

Latest research.

Browse all research ↗
· Research Session 001

The Insight–Agency Gap

When a model recognizes an inconsistency, does its behavior actually change? Eight proposed failure modes examine the gap between expressed insight, reliable correction, and observable action.

Exploratory case study · Evidence limits stated · Replication framework included

Read the paper ↗Download manuscript ↓
The Insight–Agency Gap: expressed recognition and observable behavior require separate verification.
Premise Collision: The Poisoned Fact and the True OneWhere Is My NX Bit? Instruction/Data Separation and Agent Identity
01 · AI security research

AI Security Research.

All research →
published at snailsploit.com, hakin9 magazine, medium.
Premise CollisionWhen the poisoned fact and the true record are both in the window, the model arbitrates on weight, not truth. Measured: poison wins 44/48, and one memory note makes it total.
Where Is My NX Bit?Authentication ≠ authorization ≠ intent — why AI-agent identity can’t stop prompt injection, and what a real enforcement bit would need.
Return-Oriented PromptingThe agentic attack that supplies no instructions — it injects trusted facts and the model builds the malicious plan itself. Gadget taxonomy + why benchmarks miss it.
No Responsibility by DesignA composition vulnerability class — cross-thread container desync to host RCE. 7 primitives, 4 recycles, end-to-end.
Reverse-Engineering Claude’s Memory ArchitectureThe binaries, protobuf schemas, TLS interception, encryption model, and a CWE-522 credential extraction chain — extracted live from inside the Claude code sandbox.
SKILBin: AI Agent Skills as the New LOLBinA malicious skill harvests SSH, AWS, and Kubernetes credentials inside an Anthropic-signed process that no EDR flags — the LOLBin for the agent era.
Indirect Injection Was Never BlindThe streaming wire carries the tool call before the interface hides it — closed-loop indirect injection on the SSE stream.
Semantic-to-Metadata SmugglingSignal suppression at the multi-LoRA routing gateway — the confused deputy on the routing decision.
AI Red-Teaming Frameworks, ComparedAATMF vs MITRE ATLAS vs NIST AI RMF vs Google SAIF — what each is actually for, side by side.
Self-Replicating Memory WormAdversarial self-replicating prompt that survives across sessions and propagates via long-term memory writes — the AI-worm primitive applied to persistent agent state.
Memory Injection Through Nested SkillsSkill injection + memory poisoning = self-healing autonomous implant. Validated against DVWA and Juice Shop in agent harness.
Adversarial Prompting: Complete GuideEnd-to-end methodology covering direct, indirect, multi-turn, and agentic prompt injection.
Weaponized AI Supply ChainHow threat actors turned LLMs into attack infrastructure — from poisoned model to delivered payload.
MCP vs A2A Attack SurfaceComparative threat model: where Model Context Protocol and Agent-to-Agent diverge in trust boundaries.
The 30% Blind Spot — LLM Safety JudgesEmpirical study showing LLM-as-judge safety classifiers miss ~30% of adversarial output classes.
ChatGPT Canvas DNS ExfiltrationDNS exfiltration via rendered Canvas content — triggers lookups without outbound HTTP.
02 · frameworks

Frameworks & Tooling.

All frameworks →
AATMF v3.1Adversarial AI Threat Modeling Framework — 15 tactics, 240+ techniques, 2,152+ procedures, 4,980+ prompts. Mapped to NIST AI RMF and MITRE ATLAS.
AATMF Red Teaming ToolkitPython CLI for systematic LLM safety testing — three-layer eval pipeline, defense fingerprinting, decay tracking, attack chain planning.
LLM Red Teamer's PlaybookDiagnostic methodology for bypassing LLM defense layers — input filters → alignment → identity → output → agentic trust.
Claude-RedCurated offensive security skills library for the Claude skills system — 79 SKILL.md files spanning SQLi, shellcode, EDR evasion, exploit dev.
03 · Offensive tools

Offensive Tools.

All tools (incl. GitHub) →
MCP security analysis for Burp Suite — prompt injection and tool poisoning testing via Model Context Protocol.
AI-powered bug bounty automation — LLM analysis combined with traditional security scanning.
Red-team Kubernetes misconfiguration & attack-path scanner.
Autonomous credential intelligence platform for attack-surface recon.
Chrome MV3 extension — passive recon, security headers, IP intel, CPE→CVE enrichment.
Async directory & route discovery — HTTP/2, soft-404 suppression, JS/sourcemap mining.
Low-bandwidth stress testing — modernized Slowloris.
Structurally-aware code obfuscation engine.
Curated OSINT resource collection for offensive recon.
04 · about
About.
SnailSploit · 2026
We find where systems place trust and prove when they shouldn't — across AI platforms, cloud infrastructure, web applications, and the humans who operate them. Open frameworks for adversarial-AI red teaming. Systematic vulnerability research from application layer to kernel. Social engineering for the human layer.
— Same attack. Different substrate. Human or machine.
Identity
Independent Adversarial · Research group
Scope
AI security · Cloud · Web · Social engineering · Infrastructure · Kernel
Frameworks
AATMF · P.R.O.M.P.T · SEF
Published
Adversarial Minds · PenTest Magazine · Dark Reading
Contributor
MITRE / NVD · Linux kernel mainline
05 · team
Three researchers. One method.

Who we are.

06 · disclosures
97 CVEs · 4 GHSA advisories · 5 Linux kernel mainline patches. The work, not the titles.

Disclosures.

the book · free
Adversarial Minds.

The thesis behind everything we publish — why the same attack works on a human and a language model. The complete book, no gate, no email.

download the PDF ↓about the book →