AI Security Research & Agentic Exploitation
Welcome to the AI Security Research hub of the Hermes Codex.
As Large Language Models evolve into autonomous, tool-equipped agents, the cybersecurity landscape undergoes a paradigm shift. This section serves as a definitive guide to understanding, exploiting, and defending the Semantic Execution Layer.
Below, our research is organized into five volumes, taking you from the architectural root causes of AI vulnerabilities to advanced, runtime DFIR strategies.
🏛️ Volume I: Foundations & Architectural Collapse
Section titled “🏛️ Volume I: Foundations & Architectural Collapse”Understanding the systemic design flaws that make Agentic AI inherently vulnerable.
Trust Boundary Collapse Instruction/data conflation and the Linguistic Von Neumann architecture.
Semantic Execution Layers How LLMs act as probabilistic interpreters translating language into system actions.
The OWASPification of AI Mapping Prompt Injection to XSS, Tool Injection to RCE, and RAG to SSRF.
⚔️ Volume II: The Offensive Landscape
Section titled “⚔️ Volume II: The Offensive Landscape”The mechanics of cognitive manipulation, routing hijacking, and operational exploitation.
Direct Prompt Injection Adversarial jailbreaks and prompt overriding techniques.
Indirect Prompt Injection The Confused Deputy problem and zero-click data exfiltration.
RAG Poisoning Semantic camouflage and vector database manipulation.
Function Hijacking Attacks Manipulating the latent decision boundary of LLM agents to force tool selection.
Tool Injection (The Convergence) How cognitive manipulation translates into arbitrary operational execution.
🌐 Volume III: Infrastructure, Swarms & Supply Chain
Section titled “🌐 Volume III: Infrastructure, Swarms & Supply Chain”Analyzing the distributed attack surface introduced by external registries and multi-agent workflows.
MCP Security Risks How the Model Context Protocol expands the AI attack surface.
Tool Poisoning & Supply Chain Malicious tool manifests, metadata poisoning, and rug-pull attacks.
Agent-to-Agent Lateral Movement Semantic propagation and trust inheritance in multi-agent swarms.
AI Agent Misconfigurations Exposed MCP servers, unmanaged sprawl, and the Cloud crisis of 2026.
🛡️ Volume IV: Defense & Runtime Security
Section titled “🛡️ Volume IV: Defense & Runtime Security”Engineering resilient AI architectures and implementing CSIRT/SOC observability.
Least Privilege & Capability Security Agent IAM, JIT authorization, and ephemeral sandboxing.
Runtime Security & AI EDR Execution tracing, semantic drift detection, and out-of-band approval gates.
🔬 Volume V: Deep Learning Security & Data Privacy
Section titled “🔬 Volume V: Deep Learning Security & Data Privacy”Mathematical vulnerabilities within the training pipeline and model weights.
Training Data Poisoning Backdoor triggers, sleeper agents, and instruction-tuning vulnerabilities.
📊 Volume VI: What Can AI Agents Actually Do? Empirical Benchmark Series (2026)
Section titled “📊 Volume VI: What Can AI Agents Actually Do? Empirical Benchmark Series (2026)”Rigorous empirical evaluations measuring the true offensive, defensive, and exposure capabilities of frontier AI agents against real-world systems.
What Can AI Agents Actually Do in Cybersecurity in 2026? The Master Pillar study (arXiv:2608.28490) mapping 11 domains, benchmark ecosystems, and structural reasoning limits.
SRE-Bench: Reverse Engineering Limits Evaluating autonomous agents across 400 stripped binaries on Ghidra and IDA Pro (arXiv:2608.11469).
ExploitGym: Real Vulnerability Exploitation Testing agents against 300 real Linux kernel and V8 CVEs under full mitigations (arXiv:2605.11086).
AI Cybersecurity Benchmarks Compared CyberGym vs ExploitGym vs ExploitBench vs SRE-Bench: metrics, mitigations, and biases.
ExploitBench: The 16-Stage Capability Ladder Deconstructing exploit primitives and memory corruption milestones (arXiv:2605.14153).
PIMiner: Agent-Against-Agent Red-Teaming Autonomous prompt injection mining and adversarial evaluation loops (arXiv:2608.05108).
Are Prompt Injections Impossible to Solve? Contextual integrity limits and mathematical proof of prompt injection unsolvability (arXiv:2605.17634).
MCP Security & MTGuard Hybrid static-dynamic analysis and runtime defense for Model Context Protocol servers (arXiv:2607.25297).
Can LLMs Accelerate Cyber Ranges? Evaluating automated environment generation and RL simulation speedups (arXiv:2608.16422).
The State of GenAI in Cybersecurity (2026) Systematic review of the 2026 landscape, privacy vectors, and research gaps (arXiv:2607.06963).
Can You Trust LLMs with CTI? Empirical limits, hallucination rates, and overconfidence in threat intelligence (arXiv:2503.23175).
SysEvolve: Autonomous Cyber Co-Evolution Closed-loop co-evolution of offensive (SYSSPEAR) and defensive (SYSARMOR) agents across 1,148 ranges (arXiv:2608.15012).
AgentPoison: Memory & Knowledge Base Poisoning Discrete gradient optimization of backdoor triggers corrupting agent vector databases (arXiv:2407.12784 / NeurIPS 2024).
🧭 Master Cluster Pillars & Living Reference Taxonomies
Section titled “🧭 Master Cluster Pillars & Living Reference Taxonomies”Flagship architectural syntheses uniting offensive exploitation, defensive automation, and attack vectors across the agentic lifecycle.
How Do You Attack an AI Agent? Cluster B Master Pillar: The complete anatomy of agentic exploitation, tool poisoning, and lateral movement.
Can AI Agents Defend Real Systems? Cluster C Master Pillar: The 5-stage defensive lifecycle across SOC triage, malware analysis, and automated patching.
Prompt Injection vs Tool vs RAG vs MCP Comparative attack taxonomy dissecting execution layers, prerequisites, and blast radii.
The 10-Level AI Cyber Capability Ladder Standardized reference taxonomy mapping verified frontier pass rates from Level 1 to Level 10.
MITRE ATLAS: Adversarial Threat Matrix for AI The foundational 14-tactic framework mapping AI and LLM attack vectors to operational detection.