Research Notes
Focused evidence, published with limits.
Published · 2026-08-18
ACE-RN-2026-020 · Misuse resistance
A system can score well on a one-sided harmful-prompt test by refusing every request while remaining unusable and leaving tool misuse, privacy leakage, or adversarial bypass untested
Published · 2026-08-18
ACE-RN-2026-019 · Data handling safeguards
A model's refusal to answer a probe is behavioral output evidence; it does not prove removal from parameters, adapters, retrieval stores, caches, memories, checkpoints, or derivative datasets
Published · 2026-08-18
ACE-RN-2026-018 · Cost and loop containment
Encrypted, encoded, hidden, or dynamically assembled content can carry instructions that are invisible to a human reviewer but become executable context when an agent decodes or consumes it
Published · 2026-08-18
ACE-RN-2026-017 · Data handling safeguards
A clean final response can coexist with personal or confidential data in tool arguments, observations, memory, errors, metadata, attachments, or intermediate agent messages
Published · 2026-08-18
ACE-RN-2026-016 · Misuse resistance
A final answer can look compliant while intermediate reasoning contains harmful instructions, deceptive intent, privacy-sensitive content, or a plan that later tool actions execute
Published · 2026-08-18
ACE-RN-2026-015 · Uncertainty disclosure
An opaque reasoning block can preserve confidentiality at rest yet remain replayable across users, sessions, or compatible models if it is not bound to owner and context
Published · 2026-08-18
ACE-RN-2026-014 · Misuse resistance
A black-box API can transfer useful reasoning capability through final answers and summaries even when it never returns the victim's private chain of thought
Published · 2026-08-18
ACE-RN-2026-013 · Human approval integrity
A click records an interface event but does not prove that the reviewer was authorized, saw the final action and evidence, understood the scope, or that the backend enforced the approved object
Published · 2026-08-18
ACE-RN-2026-012 · Decision evidence completeness
A plausible explanation generated after an answer can be insensitive to the factors that actually changed the model's decision and therefore cannot be treated as a causal record
Published · 2026-08-18
ACE-RN-2026-011 · Decision evidence completeness
Ordinary logs can omit relevant events, accept mutable free text, lack actor or policy context, and be rewritten by the same system whose conduct they are meant to establish
Published · 2026-08-18
ACE-RN-2026-010 · Decision evidence completeness
A DOI, URL, or paper can be real while the cited span does not entail the atomic claim, applies to a different population or date, or supports only a weaker qualified statement
Published · 2026-08-18
ACE-RN-2026-009 · Decision evidence completeness
A record that stores only approve or deny and a free-text reason cannot prove which inputs, policy version, alternatives, evidence artifacts, and authorized approver existed at decision time
Published · 2026-08-18
ACE-RN-2026-008 · Tool & data authorization
Tool descriptions, annotations, schemas, and returned metadata can contain attacker-controlled text that the model interprets as instructions rather than untrusted data
Published · 2026-08-18
ACE-RN-2026-007 · Tool & data authorization
An agent can expose too many tools, overly broad tool functions, or credentials whose effective permission closure exceeds the current task
Published · 2026-08-18
ACE-RN-2026-006 · Tool & data authorization
A tool being visible, schema-valid, and technically able to reach a record does not prove that the current principal authorized this concrete resource, parameter, purpose, and destination
Published · 2026-08-18
ACE-RN-2026-005 · AI identity attribution
Multiple agents using one API key collapse distinct software identities, tasks, principals, and authority boundaries into a single credential holder
Published · 2026-08-18
ACE-RN-2026-004 · AI identity attribution
An action can identify the immediate workload yet fail to preserve the human or service principal, delegation purpose, and actor chain on whose behalf the agent acted
Published · 2026-08-18
ACE-RN-2026-003 · Delegated authority containment
A bearer artifact can be copied from an authorized exchange and replayed by a different process, session, audience, or time window without re-establishing the authority that justified the original use
Published · 2026-08-18
ACE-RN-2026-002 · Delegated authority containment
A revocation accepted by the issuer can remain invisible to a cached resource server, regional gateway, derived credential, or already-running agent after the declared containment deadline
Published · 2026-08-18
ACE-RN-2026-001 · Delegated authority containment
A child agent can receive a credential whose effective resource, action, audience, tenant, time, or budget scope is broader than the authority its parent was allowed to delegate