updates

Author: ramkrishnsaini

content/blog-articles/ai-agent-prompt-injection-echoleak-camoleak-explained/meta.ts

@@ -1,5 +1,5 @@
 export const meta = {
-  slug: 'ai-agent-prompt-injection-echoleak-camoleak-explained',
+  slug: "ai-agent-prompt-injection-echoleak-camoleak-explained",
   title: 'Prompt Injection Is Now Remote Code Execution: EchoLeak & CamoLeak Explained',
   description:
     'EchoLeak and CamoLeak turned zero-click prompt injection into real data theft from Microsoft 365 Copilot and GitHub Copilot in 2025. Here is why injection is a control-flow bug, not a content bug — and what actually stops it.',

content/blog-articles/gtg-1002-ai-orchestrated-cyberattack-engineering-lessons/meta.ts

@@ -1,5 +1,5 @@
 export const meta = {
-  slug: 'gtg-1002-ai-orchestrated-cyberattack-engineering-lessons',
+  slug: "gtg-1002-ai-orchestrated-cyberattack-engineering-lessons",
   title: 'GTG-1002: What the First AI-Orchestrated Cyberattack Means for Engineers',
   description:
     'In November 2025 a coding agent ran most of a real intrusion campaign at machine speed. Here is what actually failed, what the disclosure does and does not prove, and the four controls that would have contained it — a plain-English lead-in to our deep GTG-1002 research.',

content/blog-articles/securing-ai-agents-production-checklist-2026/meta.ts

@@ -1,5 +1,5 @@
 export const meta = {
-  slug: 'securing-ai-agents-production-checklist-2026',
+  slug: "securing-ai-agents-production-checklist-2026",
   title: 'Securing AI Agents in Production: A 2026 Engineering Checklist',
   description:
     'A practical, evidence-based checklist for deploying autonomous AI agents safely in 2026: containment, deterministic tool permissions, scoped identity, deny-by-default egress, and monitoring — with links to the research behind each control.',

research-log/00-implementation-report.md

@@ -0,0 +1,70 @@
+# Implementation Report — Cluster 1: Autonomous AI Agent Security
+
+**Status:** Shipped · **Built:** 2026-09-11 → 2026-09-12 · **Build:** `npx next build` exit 0, tsc clean, eslint 0 errors.
+
+---
+
+## 1. Selected cluster & why
+**Autonomous AI Agent Security.** Chosen because it uniquely satisfies the "both/and" test — a **verified recent incident spine** *and* a **deep active arXiv literature** — and supports 11 non-overlapping publications with strong, durable search intent and direct ProxyTech commercial adjacency (agentic AI, AI security/governance, DevSecOps).
+
+## 2. arXiv papers used (all verified against their abstract page before citing)
+| Key | arXiv | Title (short) | Load-bearing metric |
+|-----|-------|---------------|---------------------|
+| gtg1002 | — (Anthropic) | Disrupting the first AI-orchestrated espionage campaign (GTG-1002) | 80–90% agent-executed; ~30 targets |
+| progent | 2504.11703 | Progent: Securing AI Agents with Privilege Control | ASR ↓ with utility retained |
+| oneday | 2404.08144 | LLM Agents can Autonomously Exploit One-day Vulns | **87% → 7%** (with/without CVE) |
+| zeroday | 2406.01637 | Teams of LLM Agents can Exploit Zero-Day Vulns | **4.3×** over single agent |
+| cvebench | 2503.17332 | CVE-Bench | **≤13%** real-world CVEs resolved |
+| agentdojo | 2406.13352 | AgentDojo | 97 tasks / 629 security cases |
+| ztidentity | 2505.19301 | Zero-Trust Identity Framework for Agentic AI | framework (no empirical) |
+| openididentity | 2510.25819 | Identity Management for Agentic AI (OpenID) | strategy whitepaper |
+| mcpglance | 2506.13538 | MCP at First Glance (1,899 servers) | 7.2% vuln / 5.5% tool-poisoning |
+| cybercapable | 2607.25379 | Cyber-Capable AI Agents | framing only — incident unverified, flagged |
+
+**Excluded fabrication:** `2604.23425` "frontier model escape" — surfaced by a research subagent, fetched, confirmed NOT a real paper, dropped.
+
+## 3. Incident / primary sources
+GTG-1002 (Anthropic, 2025-11-13/14, verified primary) · EchoLeak CVE-2025-32711 · CamoLeak CVE-2025-59145 · Copilot RCE CVE-2025-53773 · Cursor CurXecute/MCPoison CVE-2025-54135/54136 · postmark-mcp (Koi/Snyk) · mcp-remote CVE-2025-6514 (JFrog) · MCP Inspector CVE-2025-49596 (Oligo).
+
+## 4. URLs created (flat; `/research/` is the only hub)
+1. `/research/` — archive hub
+2. `/autonomous-ai-agent-security/` — **pillar** (series 01)
+3. `/ai-orchestrated-cyber-espionage-gtg-1002/` — **flagship** incident (02)
+4. `/ai-agent-prompt-injection-security/` (03)
+5. `/ai-coding-agent-security/` (04)
+6. `/mcp-server-security/` (05)
+7. `/ai-agent-sandbox-escape-security/` (06)
+8. `/ai-agent-containment-architecture/` (07)
+9. `/ai-agent-identity-and-access-control/` (08)
+10. `/ai-agent-tool-permissions-least-privilege/` (09)
+11. `/ai-agent-network-egress-control/` (10)
+12. `/ai-agent-autonomous-exploitation-benchmarks/` (11)
+
+Funnel blogs: `/blog/gtg-1002-ai-orchestrated-cyberattack-engineering-lessons/` · `/blog/ai-agent-prompt-injection-echoleak-camoleak-explained/` · `/blog/securing-ai-agents-production-checklist-2026/`
+
+## 5. Components created
+`components/research/`: `ResearchStyles.tsx` (rx- design system), `ResearchLayout.tsx` (client: masthead, research-profile grid, sticky TOC scroll-spy, progress bar, collapsible mobile TOC, series nav, related, restrained CTA), `ResearchArchiveExplorer.tsx` (client-side filtering only), `primitives.tsx` (ResearchBadge/BadgeRow, Cite, ResearchAbstract, ResearchBlock, ResearchFinding, ResearchQuestion, ResearchAnalysis, ResearchMetricStrip, ResearchPaperCard, ResearchTimeline, ResearchFailureMode, ResearchDecision, ResearchCounterfactual, ResearchLimitations, ResearchReferenceList, ResearchFigure).
+
+## 6. Data / files
+- New: `data/research/cluster.ts` (PUBLICATIONS + REFERENCES), `data/research/seo.ts` (metadata + TechArticle/BreadcrumbList JSON-LD), `scripts/gen-research-llms.mjs`, `scripts/_fix-research-internal-links.mjs` (one-off).
+- Modified (additive): `app/sitemap.ts`, `components/Footer.tsx`, `content/blog-articles/index.ts`, `public/llms.txt`, `public/llms-full.txt`.
+
+## 7. Diagrams
+Native HTML/CSS/SVG, each with `aria-label` text equivalent: agent loop, indirect-injection confused-deputy, coding-agent self-escalation chain, two MCP attack surfaces, standing-vs-scoped identity, GTG-1002 operated architecture, contained counterfactual, mediation-plane reference architecture, layered isolation rings, deny-by-default egress; plus timeline, metric strips, decision tables.
+
+## 8. SEO / schema
+Per page: unique title + meta description, canonical + hreflang, OG `article` (published/modified/author/section), Twitter card, **TechArticle** + **BreadcrumbList** JSON-LD, `CreativeWorkSeries`, `mainEntityOfPage`. Hub: **CollectionPage** + **ItemList**. Blogs: Article + FAQPage via existing pipeline. Sitemap + both llms manifests updated. Explicit independent-analysis disclaimer (no peer-review/arXiv/university claims).
+
+## 9. Internal-link structure (no orphans)
+Series prev/next + related + inline cross-links across all 11; hub → all + blogs; Footer sitewide → hub + 11; blogs → research (contextual) and hub → blogs (bidirectional); research → existing services (`ai-security-governance-job-support`, `agentic-ai-job-support`, `cybersecurity-devsecops-job-support-guide`).
+
+## 10. Verification
+`npx next build` exit 0; all 12 research routes + 3 blogs exported to `out/`; `tsc --noEmit` clean; `eslint` 0 errors (73 internal `<a>`→`<Link>`); `verify-content-urls.mjs` passes; footer section + blog→research links + sitemap entries confirmed in emitted HTML.
+
+## 11. Limitations / unverifiable claims (surfaced in-content)
+- GTG-1002 = single-source vendor disclosure, no independent IOCs; "80–90%" has no published methodology → OPEN QUESTION.
+- `2607.25379` references an unverifiable "July 2026 HuggingFace/OpenAI incident" → cited for framing only, flagged; incident not asserted as fact.
+- Sandbox-escape page marks autonomous novel-escape as unproven (no verified paper); grounds claims only in exploitation-given-knowledge.
+
+## 12. Publication coverage map (for future extension without cannibalization)
+- Pillar = whole-theme overview · Flagship = the incident · then attack surface (injection → coding agents → MCP) · then defenses (sandbox → containment → identity → tool permissions → egress) · then measurement (benchmarks). New pages should slot into one lane and cross-link, not overlap.

research-log/CHANGELOG.md

@@ -0,0 +1,31 @@
+# ProxyTech Research — Changelog (date-wise)
+
+Newest first. Append a dated entry every working session. Format: what shipped, sources verified, files touched, build status.
+
+---
+
+## 2026-09-12
+- **Funnel + de-orphan.** Added sitewide Footer section "ProxyTech Research — AI Agent Security" (hub + 11 pages) and `/research/` to footer resources.
+- **3 funnel blogs created** (`content/blog-articles/`): `gtg-1002-ai-orchestrated-cyberattack-engineering-lessons`, `ai-agent-prompt-injection-echoleak-camoleak-explained`, `securing-ai-agents-production-checklist-2026` — each links into the cluster; hub links back (bidirectional). Registered in `content/blog-articles/index.ts`.
+- **llms manifests** extended with a "Blog Lead-ins" subsection via `scripts/gen-research-llms.mjs` (idempotent).
+- **Lint hardening:** converted 73 internal prose `<a>`→`<Link>` across research pages (`no-html-link-for-pages`); removed unused imports. eslint 0 errors.
+- **Build:** `npx next build` exit 0. All 12 research routes + 3 blogs exported. tsc clean.
+- Created this `research-log/` folder (README, implementation report, changelog, incident tracker, next-cluster backlog).
+
+## 2026-09-11
+- **Cluster 1 shipped — Autonomous AI Agent Security.** See `00-implementation-report.md`.
+- Live arXiv + incident research via parallel agents; **independently verified** every load-bearing arXiv ID and the GTG-1002 primary source; **caught and excluded a fabricated paper** (`2604.23425`).
+- Built research data model (`data/research/cluster.ts`, `seo.ts`), design system (`components/research/*`), `/research/` hub, and 11 flat publications with diagrams, paper cards, failure modes, decision tables, references, and TechArticle/BreadcrumbList schema.
+- Wired `app/sitemap.ts`; injected cluster into `public/llms.txt` + `llms-full.txt` via new `scripts/gen-research-llms.mjs`.
+- Build passed (168→ pages superset; all research routes exported).
+
+---
+
+### Template for new entries
+```
+## YYYY-MM-DD
+- Incident/paper added: <name> (verified? Y/N, source URL) → fed into <publication or NEW /slug/>.
+- Pages created/updated: <slugs> (updated dateModified where content changed).
+- Files touched: <...>
+- Build: <status>. llms regenerated: <Y/N>.
+```

research-log/README.md

@@ -0,0 +1,37 @@
+# ProxyTech Research — Program Log
+
+This folder is the running record of the **ProxyTech Research** program (the `/research/` archive and its flat publications). It exists so we can continue day-by-day: log new incidents and papers as they appear, decide what becomes a publication, and pick the next cluster.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| [`00-implementation-report.md`](./00-implementation-report.md) | Full report of **Cluster 1 — Autonomous AI Agent Security** (what shipped, sources, files, verification). The source of truth for how the system is built. |
+| [`CHANGELOG.md`](./CHANGELOG.md) | **Date-wise** log of everything done/changed. Append a dated entry every working session. |
+| [`incident-research-tracker.md`](./incident-research-tracker.md) | Daily intake: new incidents + new arXiv papers, triaged (verified? which publication does it feed?). This is what we update daily. |
+| [`next-cluster-opportunities.md`](./next-cluster-opportunities.md) | Scored backlog of the **next clusters** to build, with candidate slugs. Pick from here when Cluster 1 is saturated. |
+
+## How the system works (so any session can continue)
+
+- **Data model:** `data/research/cluster.ts` — `PUBLICATIONS[]` (registry) + `REFERENCES{}` (verified source pool). `data/research/seo.ts` — metadata + JSON-LD helpers.
+- **Design system:** `components/research/` — `ResearchStyles`, `ResearchLayout`, `primitives.tsx`, `ResearchArchiveExplorer`. All classes are `rx-` namespaced; do NOT reuse blog/interview/KB/service layouts.
+- **Pages:** each flat publication is `app/<slug>/page.tsx` importing `ResearchLayout` + primitives. `/research/` is the hub.
+- **Discovery:** `app/sitemap.ts` (reads `PUBLICATIONS`), Footer "ProxyTech Research — AI Agent Security" section, `public/llms.txt` + `llms-full.txt` via `scripts/gen-research-llms.mjs` (idempotent, marker-wrapped).
+- **Funnel:** blog lead-ins in `content/blog-articles/` link into the cluster; hub links back to blogs.
+
+## Golden rules (do not break)
+
+1. **Verify every arXiv ID and incident against its primary source before citing.** A fabricated paper (`2604.23425`) was caught this way. Never trust a subagent-supplied ID.
+2. **Additive only.** Never remove existing links/pages/config. New publications and links only.
+3. **Separate paper claims from ProxyTech interpretation** (use `ResearchAnalysis` / `ANALYSIS` label). State limitations. No sensationalism. No peer-review/arXiv-affiliation claims.
+4. **Flat URLs** for publications; `/research/` is the only hub. Distinct research design — never the marketing look.
+5. After changes: `npx tsc --noEmit`, `npx eslint <new files>`, `npx next build`, then re-run `node scripts/gen-research-llms.mjs`.
+
+## Daily workflow
+
+1. Scan arXiv (cs.CR/cs.AI/cs.LG/cs.CL/cs.SE/cs.MA/cs.DC) + primary incident sources (Anthropic, OpenAI, Microsoft/MSRC, Google GTIG/Project Zero, Cloudflare, GitHub, Hugging Face, AWS, CISA, NIST).
+2. Add rows to `incident-research-tracker.md` (mark **verified?**).
+3. Decide: does it extend an existing publication (update `dateModified`), or justify a new one?
+4. If new page: add to `PUBLICATIONS`, add source to `REFERENCES`, create `app/<slug>/page.tsx`, add to `scripts/gen-research-llms.mjs`, sitemap is automatic.
+5. Append a dated entry to `CHANGELOG.md`.
+6. Build + regenerate llms.

research-log/incident-research-tracker.md

@@ -0,0 +1,41 @@
+# Incident & Research Tracker (daily intake)
+
+Log new incidents and arXiv papers here as they appear. **Verify before citing.** When an item is strong enough, promote it into an existing publication (bump `dateModified`) or a new one.
+
+Status legend: `NEW` (just logged) · `VERIFIED` (checked against primary source) · `USED` (cited in a page) · `DROPPED` (unverifiable/weak) · `WATCH` (promising, not yet actionable).
+
+## Incidents
+
+| Date logged | Incident / disclosure | Source (primary) | Verified? | Status | Feeds publication |
+|-------------|-----------------------|------------------|-----------|--------|-------------------|
+| 2026-09-11 | GTG-1002 AI-orchestrated espionage | anthropic.com/news/disrupting-AI-espionage | ✅ | USED | ai-orchestrated-cyber-espionage-gtg-1002 |
+| 2026-09-11 | EchoLeak (M365 Copilot, zero-click) | MSRC CVE-2025-32711 | ✅ | USED | ai-agent-prompt-injection-security |
+| 2026-09-11 | CamoLeak (GitHub Copilot Chat) | Legit Security / GitHub CVE-2025-59145 | ✅ | USED | prompt-injection; network-egress-control |
+| 2026-09-11 | Copilot RCE via prompt injection | Embrace The Red / MS CVE-2025-53773 | ✅ | USED | ai-coding-agent-security |
+| 2026-09-11 | Cursor CurXecute / MCPoison | Aim Security / Check Point CVE-2025-54135/54136 | ✅ | USED | ai-coding-agent-security |
+| 2026-09-11 | postmark-mcp malicious npm | Koi Security / Snyk | ✅ | USED | mcp-server-security |
+| 2026-09-11 | mcp-remote RCE | JFrog CVE-2025-6514 | ✅ | USED | mcp-server-security |
+| 2026-09-11 | MCP Inspector RCE | Oligo CVE-2025-49596 | ✅ | USED | mcp-server-security |
+| _add below_ | | | | NEW | |
+
+## arXiv papers
+
+| Date logged | arXiv ID | Title (short) | Verified? | Status | Feeds publication |
+|-------------|----------|---------------|-----------|--------|-------------------|
+| 2026-09-11 | 2504.11703 | Progent (privilege control) | ✅ | USED | tool-permissions; containment |
+| 2026-09-11 | 2404.08144 | One-day exploitation (87%→7%) | ✅ | USED | flagship; benchmarks; sandbox |
+| 2026-09-11 | 2406.01637 | Zero-day teams (4.3×) | ✅ | USED | flagship; benchmarks |
+| 2026-09-11 | 2503.17332 | CVE-Bench (≤13%) | ✅ | USED | flagship; benchmarks; sandbox |
+| 2026-09-11 | 2406.13352 | AgentDojo | ✅ | USED | prompt-injection; pillar |
+| 2026-09-11 | 2505.19301 | Zero-Trust Agentic Identity | ✅ | USED | identity-and-access |
+| 2026-09-11 | 2510.25819 | OpenID Agentic Identity | ✅ | USED | identity-and-access |
+| 2026-09-11 | 2506.13538 | MCP at First Glance (1,899) | ✅ | USED | mcp-server-security |
+| 2026-09-11 | 2607.25379 | Cyber-Capable AI Agents | ⚠️ partial | USED (framing only) | benchmarks — incident claim NOT asserted |
+| 2026-09-11 | 2604.23425 | "frontier model escape" | ❌ | DROPPED | fabricated — does not exist |
+| _add below_ | | | | NEW | |
+
+## Watchlist (candidate sources for future pages — verify when promoting)
+- Multi-agent / agent-to-agent attack propagation papers (cs.MA) — feeds a future `ai-agent-to-agent-attacks` page.
+- MCP-38 / OWASP Agentic Top 10 updates — feeds `mcp-server-security` refresh + a governance page.
+- New Anthropic/OpenAI/Google GTIG threat reports — feed flagship follow-ups.
+- Formal containment / capability-revocation papers — feed `containment-architecture` refresh.