Get the app
extract 0 0 0

jdsalbego/ai-agent-threat-report

published by @jdsalbego

Alignment dataset tracked in the /datasets sub-catalog.

Lifetime downloads
48
Last 30 days
48
Likes
-
Size
2.7 MB
Created on HF
2026-09-26
Age
25 days ago

Description

The AI Agent Threat Report

This record holds the two volumes and the six public companion documents of The AI Agent Threat Report, Version 1.0, September 2026 edition, as published at clawsecure.ai/research/ai-agent-threat-report.

Author: J.D. Salbego, Founder and CEO, ClawSecure, with the ClawSecure RedTeam

Published: July 2026. Version: 1.0, September 2026 edition.

Canonical URL: https://www.clawsecure.ai/research/ai-agent-threat-report

Zenodo DOI:… See the full description on the dataset page: https://huggingface.co/datasets/jdsalbego/ai-agent-threat-report.

Tags

language:enlicense:cc-by-4.0size_categories:n<1Kmodality:documentlibrary:datasetslibrary:mlcroissantdoi:10.57967/hf/10613region:usAI agent securityindirect prompt injectionprompt injectionModel Context ProtocolMCPLLM securityred teamAI agentscoordinated disclosurefrontier models

README current version from Hugging Face

pretty_name: The AI Agent Threat Report
license: cc-by-4.0
language:

  • en
    tags:
  • AI agent security
  • indirect prompt injection
  • prompt injection
  • Model Context Protocol
  • MCP
  • LLM security
  • red team
  • AI agents
  • coordinated disclosure
  • frontier models

The AI Agent Threat Report

This record holds the two volumes and the six public companion documents of The AI Agent Threat Report, Version 1.0, September 2026 edition, as published at clawsecure.ai/research/ai-agent-threat-report.

Author: J.D. Salbego, Founder and CEO, ClawSecure, with the ClawSecure RedTeam

Published: July 2026. Version: 1.0, September 2026 edition.

Canonical URL: https://www.clawsecure.ai/research/ai-agent-threat-report

Zenodo DOI: https://doi.org/10.5281/zenodo.22978608

Contact: [email protected]

Abstract

The AI Agent Threat Report is ClawSecure's two-volume red-team study of indirect prompt injection, OWASP's number one threat to autonomous AI: hidden instructions planted in ordinary content that an AI agent reads and then obeys as commands. Volume 1 covers the MCP platform layer, with live exploit reproductions against Dropbox Dash, Notion, and Linear. In Volume 2, ClawSecure ran one identical hardened attack across 14 models from five frontier labs. This research was conducted from May through July 2026. Every company named received coordinated disclosure before publication.

Every number here is evidence-backed and reproducible, with the raw reproductions and a primary-source archive behind each claim.

Files

File Pages Bytes MD5 SHA-256
volume-1.pdf 63 555,809 c650f1a45cae65e134e1f01b3012c8c5 69019d8b76ea9fd2eec2d7b3520e80019861e21cf34217a5fc5e12acdc889e2b
volume-2.pdf 54 507,383 583ea767ed7737865f5fffae7ba3fa9e 3981150053d130bddf458cb3331e31a3c581443dc02556308ebd35090bcbbdf5
exec-summary.pdf 6 295,934 4a2bb40c7eab392f24ef708b2e4d923b b6f583acc99da8c09fc00418fc6fe1f88cafc7daefefe67ceb79f23db3a7cd8f
how-we-did-it.pdf 5 281,784 16d352bafb8d76b2a44d4ec13c54300f c6a48146d47fe0f8662d6b684e8f1a5ff7cd7699a7d1fa6292ab0beeb8e9035a
responsibility-gap.pdf 5 292,303 b70c712731ae088a37a007d13c1f72f2 7abc67880996ee4024a85609ca55cc77ee1c79ac52837a2cf7a79064a56b4218
three-broken-claims.pdf 2 283,176 6dfc0981fcf3f9db5b26595e8cd43433 78e5f476c93d4d5ffe927390a6822b79d3f8535972de9a5f9393f1f9e9b86322
cheap-tier-indictment.pdf 3 282,545 97060101e3c347de393373bb9c026fb6 e1c389dcdf602d03cd7d4896adc6ed159991212dc11c1ec8c78850440a98e9b0
evidence-locator.pdf 10 309,782 fc9194273e6f3d49ec3bb2eca3360222 7ed65e7aec58ce0943fc00a53482e5f73640e9b9e3aa3ae29a4f191c53ee57da

README history 3 revisions

Every night we snapshot the README of every dataset in the catalog. When the SHA changes we archive the new version and diff it against the last. This is the evolving thought record of the alignment-data field: what the author decided to say about the corpus, and how that framing shifted over time.

  1. 2026-09-26Add dataset card2483fd22.7 KB
    Loading...
  2. 2026-09-26Upload 8 filesce1ccaf0 B
    Loading...
  3. 2026-09-26initial commit8e4c5340 B
    Loading...

Used by abliterated models none yet

No abliterated models in our catalog have declared this dataset in their YAML metadata yet. This can mean the dataset is used but not declared, is used outside abliteration workflows, or is new. The link will populate automatically as models are indexed.

Community discussions 1 thread · 1 open · 1 comments

Threads posted by the community on Hugging Face: bug reports, questions about usage, pull requests on the README, license clarifications. Click any thread to expand and read the full conversation inline. Newest first.

  1. 2026-09-27[bot] Conversion to Parquetopen1 💬#1
    Loading...

Continue on Hugging Face →

Related datasets same stage · extract

Anthropic/hh-rlhf
2.1M dl 2442 likes 90.4 MB
Dataset Card for HH-RLHF Dataset Summary This repository provides access to two different kinds of data: Human ...
djain95/sae-jailbreaks-cache
468.6K dl 1 likes 30.6 GB
mosaicml/dolly_hhrlhf
309.5K dl 113 likes 23.7 MB
Dataset Card for "dolly_hhrlhf" This dataset is a combination of Databrick's dolly-15k dataset and a filtered subset of Anthrop...
Dahoas/full-hh-rlhf
266.3K dl 104 likes 129.8 MB
Dataset Card for "full-hh-rlhf" Anthropic's HH dataset reformatted into prompt, chosen, rejected samples.
mlabonne/harmful_behaviors
198.2K dl 169 likes 23 KB
mlabonne/harmless_alpaca
190.2K dl 51 likes 1.2 MB
walledai/AdvBench
176.3K dl 123 likes 38 KB
Dataset Card for AdvBench Paper: Universal and Transferable Adversarial Attacks on Aligned Language Models Data: AdvBench Datas...
JailbreakV-28K/JailBreakV-28k
116.4K dl 80 likes 288.8 MB
⛓‍💥 JailBreakV-28K: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks 🌐 ...

Read further

Community best practices (extraction)
5 rules the field converged on for building the pair.
Building your own extraction pair
When the reference pair is not enough. Sizing, framing, and evaluation.
Datasets that shaped abliteration
The five corpora that did most of the work.
Non-English abliteration communities
How Chinese, Russian, Japanese, and Korean practitioners build extraction pairs.

Metadata

License
cc-by-4.0

Download the dataset

0

Copy any of these snippets into your notebook or terminal. All three fetch directly from Hugging Face using your own credentials.

Recommended: datasets library (Python) 
from datasets import load_dataset
ds = load_dataset("jdsalbego/ai-agent-threat-report")
Raw snapshot (Python) 
from huggingface_hub import snapshot_download
snapshot_download(repo_id="jdsalbego/ai-agent-threat-report", repo_type="dataset")
git clone (requires git-lfs) 
git clone https://huggingface.co/datasets/jdsalbego/ai-agent-threat-report
Browse repository on Hugging Face ->
Catalog is the map. Apps are the tools.

Run models on your own machine, not in the cloud.

Every model page has an "Open in Abliteration" button that hands the model directly to the first-party desktop client, at the quantization your rig can actually run. No API keys, no subscription, no prompt leakage.

Get the app Browse the catalog
Open in Abliteration