PhiloCyber AI Red Teaming Field Guide

Draft - technical review in progress. This source is not a published release. Protocol, CVE, source, editorial, and translation review remain in progress.

2026 edition. A stand-alone, provider-neutral reference for offensive testing of AI-enabled systems: LLMs, agents, multi-agent orchestrations, RAG pipelines, MCP servers, embeddings, ML models, and the infrastructure they run on.

This edition extends the prior material with attack families that matured through 2025 and into 2026: multi-turn and framing-based jailbreaks (Crescendo, Policy Puppetry, Deceptive Delight, Skeleton Key, Echo Chamber, controlled-release prompting), MCP-specific attacks (line jumping, tool poisoning and rug pulls, confused-deputy chains across agent-to-agent delegation), retrieval poisoning that targets the embedding space directly (PoisonedRAG, CorruptRAG, GASLITE, GragPoison) alongside zero-click exfiltration via automatically-rendered markdown/image output (in the style of the EchoLeak disclosure), multi-agent-system hijacking and agent-memory injection (MINJA), refined privacy attacks (Min-K%++, SPV-MIA, divergence attacks, Vec2Text/Zero2Text embedding inversion), and supply-chain threats spanning model and adapter registries (model jacking, LoRA/adapter sleeper-agent poisoning, slopsquatting, nullifAI and other picklescan bypasses). Current-generation infrastructure CVEs are covered where they intersect AI deployments, including CVE-2025-23266 (NVIDIAScape, NVIDIA Container Toolkit escape), CVE-2025-6514 (mcp-remote OS command injection), CVE-2025-53109 / CVE-2025-53110 (MCP filesystem path and symlink traversal), and ShadowRay-class exposure of unauthenticated Ray clusters.

All worked examples, case studies, and payloads use the reserved example domain northstar.example for the fictional target organization, Northstar Labs, and northstar-agent for its chatbot/agent assistant. Attacker-controlled infrastructure uses reserved .example names. Replace these identifiers with the actual engagement scope only in an authorized working copy.

Organized by attack surface rather than by course structure. Every chapter follows the same shape: Concept → Attack surface → Techniques → Detection & defense → Practice checklist → MITRE ATLAS references.

Table of contents

How to use this guide

For a RAG ingest: each chapter is 20-60 KB and formatted with hierarchical H1/H2/H3 headers so chunking on section boundaries produces coherent retrieval units. The atlas-mapping and glossary are compact reference tables suited to keyword-based retrieval.

For linear study: work chapters 00 to 15 in order. Chapters 04-13 assume the foundations, methodology, and reconnaissance material.

For a targeted lookup: the chapter titles map to attack surface. Prompt-injection questions go to chapter 04. RAG-poisoning questions go to chapter 06. Model-registry questions go to chapter 11. Cross-references between chapters are linked inline.

Prerequisite skills

Comfortable with:

• Traditional offensive security workflow (recon, exploitation, post-exploitation, C2, lateral movement)
• Python (reading model training and inference code)
• Basic linear algebra (vectors, dot products, gradients)
• HTTP/REST APIs, JSON schemas, containers, Kubernetes fundamentals
• MITRE ATT&CK familiarity

Not required:

• ML research background — key ML concepts are introduced in Chapter 01 at the depth needed for offensive work.

Scope

This guide focuses on offensive operations against AI-enabled systems in authorized engagements. Defensive content is included where it directly informs attacker decisions (which controls exist, how to evade them, which mitigations block which techniques). It is not a defensive playbook or a research paper — external references are cited when readers should go deeper.

References

• MITRE ATLAS — Adversarial Threat Landscape for AI Systems
• OWASP Top 10 for LLM Applications
• OWASP Top 10 for Agentic Applications 2026
• OWASP ML Top 10
• Google Secure AI Framework (SAIF)
• Anthropic — Code execution with MCP