Defensive Architecture and Adversarial Threat Model for AI-Enabled Publication Lifecycles

Full report

On this page

Executive Summary

The integration of tool-using artificial intelligence within the publishing workflows of InternationalIntelligence.org introduces profound shifts in the application attack surface. Traditional enterprise web application security focuses heavily on infrastructural boundaries, whereas an AI-mediated intelligence pipeline demands defense against semantic manipulation, autonomous processing faults, and adversarial data sources. This report presents a comprehensive security architecture, threat model, and control matrix designed to secure the automated Daily Brief and Revolution Watch publication processes. The framework operates under a zero-trust model for all external intelligence sources, enforcing strict decoupling between retrieval mechanisms, evidence qualification, and bilingual composition. By implementing opaque identifiers, deterministic server authority, and strict semantic validation of Large Language Model (LLM) outputs, the architecture mitigates risks spanning indirect prompt injection, denial of wallet, cross-stage contamination, and publication poisoning1.

System Boundaries, Assumptions, and Safety Posture

The primary defensive assumption is that any remote webpage encountered by the Web-Searching Source Scout is actively hostile and contains adversarial instructions intended to subvert the model's behavior1. The architecture is designed around seven highly decoupled stages, enforcing the principle of least privilege to ensure that a compromise at the extraction layer cannot cascade into a publication authorization breach4. The trust separation model dictates that the Web-Searching Source Scout operates in an untrusted environment, capable of reading external sources but lacking execution authority, URL selection capability, or configuration access. The Provider-Source Capture acts as a mediating gateway, assigning opaque local identifiers to source records without ever parsing or executing webpage instructions. The No-Search Evidence Binder and No-Search Bilingual Composer operate in isolated execution environments, binding qualified candidate data to local identifiers and generating localized content solely from locally qualified evidence, lacking all outbound network access. The Deterministic Server Authority serves as the absolute trust anchor, controlling file writes, final URL construction, database persistence, and lifecycle transitions. The Private Operator Console is a highly restricted administrative boundary governing background job resumption and system diagnostics. Finally, the Background Lifecycle manages asynchronous processing and provider cleanup, mitigating Denial of Wallet (DoW) vectors. Reader behavioral profiling is intentionally excluded from this design to preserve privacy. Security telemetry strictly monitors infrastructure health, API latency, and provider consumption metrics rather than end-user interactions.

Architectural Diagrams and Asset Inventory

System Data-Flow and Trust-Boundary Representation

The flow of data through the publication lifecycle traverses distinct trust boundaries, necessitating explicit data contracts and sanitization phases.

Complete Asset Inventory

Threat Environment and Threat-Actor Model

The publication is targeted by a diverse matrix of adversaries. State-aligned disinformation networks attempt to manipulate geopolitical narratives by poisoning the source material the intelligence pipeline consumes6. Coordinated influence operations and content farms utilize search-engine optimization (SEO) spam, synthetic news networks, and circular citation rings to dominate source selection. Malicious actors leverage indirect prompt injections hidden in HTML metadata, CSS-generated content, and payload-heavy image alt-text to execute model goal-hijacking1. Financially motivated attackers attempt to exhaust provider budgets (Denial of Wallet) via repeated duplicate background requests and payload bombs designed to consume context windows9.

Comprehensive Threat Modeling Analysis

Web and Source-Content Threats

The ingestion of arbitrary web content introduces significant attack surfaces. Adversaries may deploy direct prompt injection within article text or indirect prompt injection concealed within HTML metadata, image alt text, comments, structured data (e.g., JSON-LD), scripts, CSS-generated content (e.g., ::before), PDF text layers, hidden text, and video transcripts1. These concealed instructions aim to manipulate the model into ignoring its primary task, revealing system prompts, or citing unrelated malicious URLs. Beyond prompt manipulation, the pipeline faces search-result poisoning, SEO spam, and content farms designed to flood the intelligence gathering mechanism11. Typosquatting and Unicode homoglyph domains trick the extraction logic into trusting hostile sources, while open redirects and malicious URL shorteners attempt to bypass domain blocklists. Attackers may employ publisher-homepage substitution or compromise legitimate publishers to inject synthetic news networks and circular citation laundering schemes, creating a false consensus that the model validates as credible intelligence. Network-level web threats include Data-URI, file-URI, localhost, link-local, and private-network URL abuse aimed at Server-Side Request Forgery (SSRF)12. Additionally, oversized decompression-bomb documents and malformed Unicode encodings are utilized to exhaust context windows, trigger parsing vulnerabilities, or execute denial of service on the extraction workers.

Model and Agent Threats

Once data enters the model context, the primary threat shifts to behavioral manipulation. Tool-result injection and cross-stage prompt contamination occur when malicious payloads survive initial extraction and successfully alter the behavior of downstream components like the Evidence Binder or Bilingual Composer. Attackers exploit provider response fields containing attacker-controlled text to generate schema-conforming but semantically malicious outputs, bypassing naive JSON validation13. Vulnerabilities inherent to LLMs, such as hallucinated citations and hallucinated provider IDs, allow the publication of fictitious events11. Attackers exploit candidate duplication to dominate selection logic or manipulate geographic and thematic parameters to skew reporting. During the Bilingual Composer stage, translation-stage alteration can be weaponized to maliciously shift certainty language or misattribute quotes. Models exhibiting excessive autonomy (LLM06:2025) may attempt to invent actions, add unsupported URLs, or leak system prompts (LLM07:2025) containing configuration secrets via hidden chain-of-thought extraction attempts16. Memory contamination and forcing model fallback to weaker, less secure routing paths represent advanced evasion techniques. Furthermore, adversarial outputs that exploit downstream rendering, such as Markdown, HTML, CSV, or Stored Cross-Site Scripting (XSS) in generated content, pose significant risks to the final publication interface14.

Workflow and Economic Abuse

The asynchronous nature of the publication lifecycle invites economic and resource exhaustion attacks. Denial of wallet (LLM10:2025) is achieved through repeated generation requests, duplicate background tasks, and repeated polling that exceeds provider rate limits9. Adversaries submit intentionally huge prompts or massive source catalogs to starve the Bilingual Composer channel, disrupt lock and lease mechanisms, or exhaust retained-research storage. Workflow manipulation includes historical backfill abuse, replaying operator POST requests to incur compound billing, and exploiting browser-tab races to generate conflicting edition states. Attackers may target response-ID deletion, trigger endless validation-repair loops to stall processing, or manipulate edition dates and locale routes to corrupt the publication archive.

Authorization and Operator Threats

The Private Operator Console is a critical administrative boundary susceptible to traditional web application vulnerabilities. Threats include Cross-Site Request Forgery (CSRF), session fixation, session replay, and the leakage of diagnostic tokens through URLs, referrers, logs, or browser history20. Improper configuration of SameSite, Secure, or HttpOnly cookie attributes facilitates session hijacking. Attackers may attempt unauthorized arbitrary-date generation, unauthorized model selection, or exploit operator privileges persisting after the intended work session. Shared-host boundary risks, brute-force enumeration of private routes, inadequate rate limiting, cache poisoning exposing private pages, and secret leakage in downloadable diagnostics represent severe vectors for complete system compromise.

Supply-Chain and Platform Threats

The underlying infrastructure and software dependencies introduce systemic risk. Compromised PHP or JavaScript dependencies, provider SDK compromise, and build artifact tampering threaten the integrity of the application logic23. Malicious configuration changes, deployment into the wrong document root, and rollback package compromise undermine secure baselines. External platform threats include certificate-authority failures, DNS manipulation routing traffic to rogue API endpoints, and model-provider account compromise. Furthermore, third-party fonts, analytics, or scripts introduce tracking and client-side attack surfaces, while unannounced upstream API behavioral changes can break deterministic JSON schema parsing, leading to unhandled application states.

Privacy Analysis (LINDDUN) and STRIDE Threat Model

The application of the LINDDUN framework specifically targets the operator and authorship pipeline, as reader profiling is strictly prohibited. Linkability and Identifiability are mitigated by the absolute exclusion of third-party tracking scripts and the implementation of IP-agnostic logging. Non-repudiation is addressed through the required use of cryptographically secure idempotency keys for all background job initiations, ensuring operator actions are deterministically tracked without exposing session state. Detectability and Disclosure of operator sessions are prevented via strict session fixation controls, utilizing SameSite=Strict and HttpOnly flags on all authentication cookies20. Unawareness is countered by transparent diagnostic logging available exclusively to authenticated administrators, while Non-compliance is managed through adherence to minimal data retention policies for provider payloads. The STRIDE threat model aligns with the segmented architecture to evaluate internal boundaries. Spoofing is countered by mutual TLS (mTLS) for internal worker-to-server communication and the strict use of opaque local identifiers, rendering external URL spoofing ineffective11. Tampering of content is mitigated through C2PA digital provenance manifests, creating a mathematically verifiable chain of custody for all published editions25. Repudiation is handled by immutable, append-only audit logs tracking all lifecycle state transitions. Information Disclosure is blocked by the Secret-Management Policy, ensuring prompts and logs are deterministically scrubbed of credentials and provider routing details. Denial of Service (specifically Denial of Wallet) is controlled by token buckets, hard budget ceilings, and circuit breakers9. Elevation of Privilege is fundamentally restricted by the No-Search isolation of the Binder and Composer stages, preventing an injected payload from escalating into an arbitrary network request or publication authorization16.

Attack-Tree Diagrams

1. False Citation Publication

The objective is to cause the system to publish an article with a hallucinated or malicious citation.

• Vector 1.1: Bypass Structured Output Validation. The attacker exploits syntactic JSON schema compliance by providing a semantically malicious URL that matches the required string format but points to a hostile domain2.
• Vector 1.2: Circular Citation Laundering. The attacker publishes a false claim on Domain A, subsequently publishing synthetic corroboration on Domain B citing Domain A. The Source Scout assesses the corroboration as high-confidence due to the volume of cross-referencing.
• Vector 1.3: Model Hallucination (LLM09:2025). The attacker relies on the statistical likelihood of the model hallucinating a plausible-sounding but fictitious domain or citation if opaque ID mapping is not strictly enforced11.

2. Prompt Injection Through a Source

The objective is to hijack the Source Scout's goals via untrusted web content1.

• Vector 2.1: Invisible Text Injection. The attacker injects zero-font-size text, white-on-white text, or CSS display:none elements containing override instructions into the source DOM.
• Vector 2.2: Metadata Payload. Malicious instructions are placed in EXIF data of images, HTML OpenGraph tags, or structurally required alt-text, which naive extractors might append to the model context.
• Vector 2.3: Translation-Stage Alteration. The attacker injects Unicode homoglyphs or culturally specific idioms designed to alter certainty metrics or invert the meaning of a sentence during the English-to-Spanish localization phase.

3. Duplicate-Job Denial of Wallet

The objective is to exhaust the publication's LLM API budget (LLM10:2025)9.

• Vector 3.1: Browser-Tab Races. The attacker initiates simultaneous operator POST requests without idempotency keys, causing the backend to spin up duplicate, expensive background LLM generation jobs.
• Vector 3.2: Unbounded Context Flooding. The source scout is fed infinite-scroll pages, recursively generated payload pages, or oversized PDF documents designed to maximize input token consumption.
• Vector 3.3: Loop Triggering. The attacker crafts content specifically designed to induce minor schema validation failures continuously, exhausting the system's automated retry logic and compounding API costs.

4. Operator-Session Compromise

The objective is to hijack the Private Operator Console.

• Vector 4.1: Cross-Site Request Forgery (CSRF). The attacker exploits the lack of SameSite=Strict cookie attributes by tricking an authenticated operator into clicking a malicious link that forces a state-changing POST request20.
• Vector 4.2: Session Fixation/Replay. The attacker captures diagnostic URLs containing raw session tokens leaked via the HTTP Referer header, replaying them to access the console.
• Vector 4.3: Shared-Host Boundary Breach. The attacker extracts PHP session files from a shared /tmp directory on a poorly isolated hosting environment, allowing complete session takeover.

5. Poisoned-Source Network

The objective is to subvert the editorial independence of the publication.

• Vector 5.1: Synthetic News Networks. The attacker deploys automated content farms utilizing parallel LLMs to generate politically biased reporting, overwhelming the Source Scout with seemingly independent verifications of a false event.
• Vector 5.2: Expired Domain Takeover. The attacker purchases expired domains of legitimate international think-tanks, hosting malicious content that retains the historical domain authority and bypasses basic source reputation filters.

Stage-by-Stage Security and Trust Contracts

Least-Privilege Execution and Trust Boundaries

The architecture enforces a strict trust gradient. The Web-Searching Source Scout operates at Zero Trust, encountering highly adversarial HTML, metadata, and redirects. Consequently, it possesses only egress network privileges to an explicit proxy and is denied all file system read/write access outside of temporary queues. The Provider-Source Capture acts as the first sanitization boundary (Low Trust), possessing no network privileges and solely translating text chunks into JSON encapsulated payloads associated with opaque IDs. The No-Search Evidence Binder and Bilingual Composer operate at Medium Trust within heavily isolated execution contexts. They lack all outbound network access and can only read captured records and write draft narratives to the database. Their tool privileges are strictly limited to summarization, fact-extraction, and translation. The Deterministic Server Authority represents the High Trust anchor, requiring full CRUD database privileges and API egress to execute final schema validation and lifecycle progression. The Private Operator Console, also High Trust, accepts only ingress traffic and is restricted to initiating job resumption commands. Finally, the Background Lifecycle workers execute with Absolute Trust over state management, polling APIs, and clearing caches.

Smallest Safe Data Contract and Remote Content Isolation

The smallest safe data contract between stages relies on the complete segregation of untrusted data from system instructions. Remote webpage content is stripped of all executable contexts—JavaScript, CSS, and hidden DOM elements—before being labeled and isolated within a dedicated JSON container under an untrusted\_payload key. Raw webpage text is never forwarded to later stages; it is deterministically chunked, sanitized of malformed Unicode control characters, and truncated to strict length limits before model ingestion. JavaScript-rendered pages and dynamically generated content are processed exclusively within an ephemeral, unprivileged headless browser container devoid of network access post-load, capturing only the final rendered text layer.

Security Policies and Control Architecture

URL, Redirect, Network, and Content-Type Security Policy

The platform strictly controls outbound requests to mitigate SSRF and content-based exploitation12. The policy enforces the exclusive use of the https:// scheme, explicitly denying http://, file://, data://, gopher://, and ftp://. All source fetching occurs via an isolated egress proxy configured to block loopback addresses, link-local addresses, and private network ranges, ensuring internal infrastructure remains invisible to the fetcher. To combat DNS rebinding, the proxy resolves the host DNS, verifies the IP against the blocklist, and pins the IP for the duration of the request12. Redirect chains are strictly limited to a maximum of three hops, with each hop independently subjected to URL and IP validation checks. Accepted content types are strictly limited to text/html, application/xhtml+xml, application/pdf, and text/plain, with a hard termination applied to any file exceeding 15MB to prevent decompression bombs.

Structured-Output Semantic-Validation Policy

While provider features such as strict: true JSON schema enforcement guarantee syntactic validity, they inherently fail to provide semantic safety (LLM05:2025)2. Relying on the model to safely construct URLs or choose factual representations delegates a critical security decision to a probabilistic engine. Therefore, the Deterministic Server Authority must validate the semantic contents of the generated JSON. The security benefit gained by opaque provider IDs is the elimination of hallucinated or malicious URL injection. By prohibiting the model from generating URLs and instead forcing it to reference opaque, randomized local identifiers (e.g., src\_8F92A) assigned by the Provider-Source Capture, the system neutralizes the risk of the model citing an attacker-controlled endpoint or a non-existent domain11. However, attacks targeting semantic manipulation—such as misattributing a quote to the wrong opaque ID or altering the translation certainty—remain possible. Consequently, dates, locales, entity types, and ID mappings must match hardcoded server-side regular expressions and entity whitelists before publication.

Secret-Management and Redaction Policy

System prompts, schemas, and configurations must never contain operational secrets, API keys, or infrastructure details, as these are highly susceptible to extraction via System Prompt Leakage (LLM07:2025)8. Secrets are stored exclusively in environment variables or a dedicated vault, completely inaccessible to the PHP web root and downstream models. Log redaction middleware utilizes regex pattern matching to mask authentication tokens, provider IDs, and session cookies before writing to disk. Downloadable diagnostic files undergo a secondary deterministic scrubbing pass to ensure zero secret leakage. Prompt, schema, configuration, and model fingerprints are appended as cryptographic hashes to the audit log, supporting incident investigation by providing a verifiable baseline of the system state at the time of generation.

Operator Authorization Design Requirements

The Private Operator Console operates under extreme isolation to mitigate session hijacking and CSRF20. Session management relies on the strict implementation of SameSite=Strict, Secure, and HttpOnly flags for all session cookies21. All state-changing POST requests require cryptographically secure, per-request anti-CSRF nonces. Operator privileges persist only for the duration of active work, with sessions expiring after 15 minutes of inactivity or a maximum of 4 hours absolute time. Token invalidation is strictly enforced on the server side upon logout or expiration.

Rate-Limit and Cost-Budget Design

Denial of Wallet (LLM10:2025) protection must account for tokens and expected cost rather than relying solely on request counts9. The architecture implements a token bucket algorithm for polling operations, alongside a deterministic tracking system that calculates cumulative token usage per daily edition. If the hardcoded daily token budget is exceeded, the system automatically falls back to a dormant state, requiring manual operator override. Repeated validation failures are bounded by a strict three-retry limit per payload; if failures persist, the specific job is quarantined to prevent endless validation-repair loops while allowing legitimate recovery of parallel tasks.

Secure Logging and Audit Requirements

The system logs all job state transitions, external API latency, validation failures, and operator commands to maintain a comprehensive security audit trail. Crucially, this must be achieved without adding reader surveillance. No client-side telemetry, browser fingerprinting, or reader IP logging is permitted. Security telemetry focuses entirely on infrastructure health, tracking context window limits, prompt injection detection alerts, and rate-limit triggers.

Public API and RSS Output-Safety Requirements

All generated content undergoes context-aware output encoding (OWASP ASVS V1.1) to prevent Stored XSS in downstream RSS readers and API consumers18. HTML output is passed through a strict sanitizer explicitly disallowing \<script\>, \<iframe\>, and javascript: URIs. Furthermore, published editions are cryptographically signed using C2PA (Coalition for Content Provenance and Authenticity) manifests, ensuring downstream readers can independently verify the origin and structural integrity of the publication, mitigating tampering and deepfake risks25.

Supply-Chain Security and Build Integrity

The supply-chain security plan addresses the vulnerability of underlying dependencies and platforms23. All PHP and JavaScript dependencies are pinned to specific, audited versions and hashed in lock files. An AI-BOM (Artificial Intelligence Bill of Materials) is maintained to document model versions, SDK versions, and embedding algorithms (LLM03:2025). The build pipeline aligns with SLSA Level 3 compliance, generating non-falsifiable provenance records for all artifacts31. To implement defense in depth for a small PHP-hosted application without requiring an enterprise security platform, the deployment isolates the document root, ensuring that only the /public directory is exposed to the web server, while core logic, configuration, and vendor directories reside safely outside the accessible path.

Incident Response, Correction, and Notification Plan

Adhering to NIST SP 800-61 Rev 2 guidelines, the incident response plan dictates immediate, automated containment protocols32. If provider API errors or validation failures exceed a 10% threshold within a 5-minute window, circuit breakers automatically suspend the Background Lifecycle, assuming potential source poisoning or a provider-side degradation. Eradication involves flushing the evidence binder queues and invalidating captured source records suspected of containing indirect injections. The recovery phase requires an operator to manually verify updated schema constraints before unlocking the deterministic server pipeline. In the event a false or poisoned citation is published, affected editions are identified via their unique C2PA manifests26. A cryptographically signed retraction is appended to the RSS feed, and the associated C2PA manifest is updated to reflect the correction, ensuring transparent notification to all consumers. Detecting a source network that appears diverse by domain but shares a single operator or content template relies on heuristic analysis of the Source Scout's metadata extraction. Anomalous similarities in IP subnets, SSL certificate issuers, HTML DOM structures, or overlapping timestamp generation across multiple domains trigger a quarantine flag, requiring manual operator review before the sources can be qualified by the Evidence Binder.

Ninety-Day Remediation Roadmap

• Days 1-30: Isolation and Egress Controls. Deploy the explicit egress proxy with DNS rebinding protection and private IP blocking. Implement the headless browser sandbox for JavaScript rendering and DOM stripping. Establish the untrusted\_payload JSON encapsulation standard.
• Days 31-60: Semantic Validation and Opaque IDs. Refactor the Provider-Source Capture to assign opaque IDs to all incoming URLs. Update the Deterministic Server Authority to reconstruct URLs and enforce regex validation on all model outputs. Implement the token bucket cost-budget tracking.
• Days 61-90: Authorization and Provenance. Secure the Private Operator Console with SameSite=Strict cookies, anti-CSRF nonces, and absolute session timeouts. Integrate the C2PA cryptographic signing library for all RSS and API outputs. Finalize SLSA Level 3 build provenance.

Ten Non-Negotiable Security Invariants

1. Strict Egress Proxying: The application shall route all source-fetching traffic through a dedicated egress proxy that actively denies private IP space, local loopbacks, and executes DNS rebinding protection.

2. Web Payload Isolation: Unprocessed remote HTML or DOM content shall never be injected into prompts without prior deterministic stripping and isolation within designated untrusted JSON data structures.

3. Opaque Source Binding: Models shall never construct or output raw URLs; they must exclusively utilize server-generated opaque identifiers mapping to validated external assets.

4. Deterministic Output Validation: Model responses shall not be trusted solely based on API schema enforcement; all critical fields (dates, types, IDs) must pass independent, strict server-side regex and logic validation before downstream propagation.

5. Idempotent Background Processing: All job initiations and state transitions shall mandate unique, cryptographically secure idempotency keys to eliminate race conditions and Denial of Wallet loops.

6. Strict Token Budgeting: The deterministic server shall enforce a hard daily token and compute budget, immediately quarantining workflows that exceed predefined thresholds to prevent unbounded consumption.

7. Console Authorization Isolation: The operator console shall enforce SameSite=Strict, cryptographically secure anti-CSRF tokens, and absolute session timeouts for all administrative access, regardless of active use.

8. Complete File-System Separation: The application's core logic, models, system prompts, and configuration variables shall reside entirely outside the web server's public document root.

9. Zero Reader Telemetry: The system shall strictly refrain from capturing, logging, or storing behavioral analytics, browser fingerprints, or identifiable telemetry of public readers.

10. Context-Aware Output Encoding: All published HTML and RSS output shall undergo strict HTML sanitization and context-aware encoding to prevent cross-site scripting propagation to downstream consumers.

Machine-Readable Appendices

security-risk-register.csv

Code snippet RiskID,ThreatDomain,ThreatDescription,Likelihood,Impact,Detectability,ControlCoverage R01,Web/Source,Indirect Prompt Injection in Source HTML via invisible text,High,High,Low,DOM Stripping and Isolation R02,Model/Agent,Excessive Agency via downstream model execution (LLM06),Low,Critical,Medium,Deterministic Server execution only R03,Workflow,Denial of Wallet via infinite schema validation loops (LLM10),Medium,High,High,Max 3 retries and Token Buckets R04,Web/Source,SSRF via malicious redirect chains in Scout fetching,High,Critical,Medium,DNS Rebinding Protection Proxy R05,Model/Agent,Hallucinated URLs leading to phishing (LLM09),Medium,High,High,Opaque ID assignment R06,Auth/Operator,CSRF attack on Operator Console,Low,Critical,High,SameSite=Strict and CSRF tokens R07,Platform,Compromised PHP library (Supply Chain LLM03),Low,Critical,Low,SAST and Composer Lock pinning R08,Model/Agent,System Prompt Leakage exposing constraints (LLM07),High,Medium,Low,Data redaction and no secrets in prompt R09,Web/Source,Decompression Bomb causing compute exhaustion,Medium,Medium,High,Max 15MB file size hard limit R10,Auth/Operator,Session File extraction via shared host /tmp,Low,Critical,High,Private isolated volume for sessions R11,Platform,Third-party analytics script introduces keylogger,Low,Medium,Low,Removal of all reader analytics R12,Web/Source,Unicode homoglyph domain bypassing blocklist,Medium,Medium,High,Punycode conversion and strict whitelist R13,Workflow,Cache poisoning exposing admin routes,Low,Critical,Medium,Strict Cache-Control headers on private routes R14,Model/Agent,Stale SDK version introducing deserialization flaw,Low,High,Medium,Automated dependency scanning R15,Model/Agent,Translation stage alteration shifting sentiment,Medium,Medium,Low,Secondary deterministic entity validation

trust-boundary-fields.json

JSON { "boundaries": \[ { "stage": "Provider-Source Capture", "input\_fields": \["raw\_html", "headers", "redirect\_url"\], "attacker\_controlled": true, "sanitization\_applied": \["html\_strip", "css\_strip", "max\_length\_truncate"\] }, { "stage": "No-Search Evidence Binder", "input\_fields": \["chunked\_text", "opaque\_source\_id"\], "attacker\_controlled": false, "sanitization\_applied": \["json\_schema\_validation", "id\_existence\_check"\] }, { "stage": "Deterministic Server Authority", "input\_fields": \["localized\_draft", "evidence\_ids"\], "attacker\_controlled": false, "sanitization\_applied": \["html\_purifier", "regex\_format\_check", "c2pa\_signing"\] } \] }

abuse-case-catalog.json

JSON \[ {"id":"AC01","domain":"Web","description":"Attacker embeds zero-font-size text instructing model to ignore task."},{"id":"AC02","domain":"Web","description":"Attacker utilizes SVG files with malicious javascript in Scout."},{"id":"AC03","domain":"Web","description":"Attacker uses DNS rebinding to resolve target to 169.254.169.254."},{"id":"AC04","domain":"Web","description":"Attacker uses gopher:// URI in href to attack internal databases."},{"id":"AC05","domain":"Web","description":"Attacker serves 10GB gzip file to crash memory."},{"id":"AC06","domain":"Web","description":"Attacker uses Unicode right-to-left override in text to confuse composer."},{"id":"AC07","domain":"Web","description":"Attacker compromises legitimate news site to inject false intelligence."},{"id":"AC08","domain":"Web","description":"Attacker creates circular referencing domains to boost evidence weight."},{"id":"AC09","domain":"Web","description":"Attacker updates page content immediately after initial Scout fetch."},{"id":"AC10","domain":"Web","description":"Attacker uses infinite redirect loops to exhaust Scout connection."}, {"id":"AC11","domain":"Web","description":"Attacker injects prompt leak commands in EXIF data of images."},{"id":"AC12","domain":"Web","description":"Attacker hides malicious CSS content generated via ::before pseudo-elements."},{"id":"AC13","domain":"Web","description":"Attacker registers a Unicode homoglyph domain mimicking a trusted source."},{"id":"AC14","domain":"Web","description":"Attacker utilizes payload-heavy PDF text layers to inject instructions."},{"id":"AC15","domain":"Web","description":"Attacker places conflicting story lines in podcast transcripts."},{"id":"AC16","domain":"Model","description":"Model generates valid JSON but hallucinates opaque IDs."},{"id":"AC17","domain":"Model","description":"Model translates 'Unconfirmed' to 'Confirmed' during bilingual composition."},{"id":"AC18","domain":"Model","description":"Model attempts to append its own URL to the final output."},{"id":"AC19","domain":"Model","description":"Model includes markdown image links pointing to IP loggers."},{"id":"AC20","domain":"Model","description":"Model writes system prompt instructions into the final Spanish draft."}, {"id":"AC21","domain":"Model","description":"Attacker crafts content to specifically trigger a weaker model fallback."},{"id":"AC22","domain":"Model","description":"Model duplicates a candidate five times to dominate selection."},{"id":"AC23","domain":"Model","description":"Model outputs terminal-control characters in logging fields."},{"id":"AC24","domain":"Model","description":"Model generates excessive chain-of-thought leading to token limits."},{"id":"AC25","domain":"Model","description":"Model hallucination of an event based on poisoned training data."},{"id":"AC26","domain":"Workflow","description":"Operator accidentally submits POST twice, causing duplicate LLM billing."},{"id":"AC27","domain":"Workflow","description":"Attacker floods system with URLs causing endless qualification loops."},{"id":"AC28","domain":"Workflow","description":"Attacker modifies historical data triggering massive backfill API calls."},{"id":"AC29","domain":"Workflow","description":"Attacker uses large source catalogs to starve the bilingual composer."},{"id":"AC30","domain":"Workflow","description":"Attacker deletes response IDs causing pipeline stall."}, {"id":"AC31","domain":"Workflow","description":"System repeatedly triggers validation repair loops on corrupted payload."},{"id":"AC32","domain":"Workflow","description":"Attacker exhausts retained-research DB via massive candidate submissions."},{"id":"AC33","domain":"Workflow","description":"Attacker manipulates edition date routes to overwrite archives."},{"id":"AC34","domain":"Workflow","description":"Denial of wallet via constant polling of provider."},{"id":"AC35","domain":"Workflow","description":"Terminal cleanup failures cause storage exhaustion."},{"id":"AC36","domain":"Auth","description":"Attacker uses CSRF on Operator to publish false edition."},{"id":"AC37","domain":"Auth","description":"Session fixation used to hijack admin console."},{"id":"AC38","domain":"Auth","description":"Attacker views diagnostic URL containing raw tokens via referer leak."},{"id":"AC39","domain":"Auth","description":"Attacker enumerates private routes to find backup files."},{"id":"AC40","domain":"Auth","description":"Operator forgets to logout, session persists indefinitely."}, {"id":"AC41","domain":"Auth","description":"Attacker poisons cache to expose private operator pages to public."},{"id":"AC42","domain":"Auth","description":"Diagnostics download contains raw API keys."},{"id":"AC43","domain":"Auth","description":"Brute forcing operator login without rate limits."},{"id":"AC44","domain":"Auth","description":"Unauthorized generation triggered via arbitrary API date modification."},{"id":"AC45","domain":"Auth","description":"Cross-site scripting in operator console via unencoded log viewer."},{"id":"AC46","domain":"Supply","description":"Compromised third-party UI framework introduces keystroke logger."},{"id":"AC47","domain":"Supply","description":"Malicious NPM package exfiltrates env variables during build."},{"id":"AC48","domain":"Supply","description":"Model provider account is compromised via credential stuffing."},{"id":"AC49","domain":"Supply","description":"DNS manipulation routes API requests to rogue provider."},{"id":"AC50","domain":"Supply","description":"Upstream API behavior change breaks strict JSON schema parsing."} \]

security-acceptance-tests.csv

Code snippet TestID,Stage,Description,ExpectedResult SAT01,Scout,Submit 127.0.0.1 as source URL,Connection blocked by proxy SAT02,Scout,Submit http:// internal IP,Connection blocked by proxy SAT03,Scout,Submit URL redirecting to AWS metadata IP,Redirect aborted by proxy SAT04,Scout,Submit file:// URI,Rejected as invalid scheme SAT05,Scout,Submit 20MB HTML file,Connection terminated at 15MB SAT06,Scout,Fetch page with zero-size prompt injection,Injection text is stripped from model payload SAT07,Scout,Fetch page with malicious JS,JS is not executed and is stripped SAT08,Capture,Process HTML with hidden CSS content,CSS content is ignored SAT09,Capture,Process page with deep nested tags,Tags flattened and chunked SAT10,Capture,Process malformed UTF-8,Invalid characters replaced safely SAT11,Binder,Provide unmapped opaque ID,Validation fails and job aborted SAT12,Binder,Submit JSON with missing required fields,Validation fails triggering retry SAT13,Binder,Submit array instead of object,Validation fails triggering retry SAT14,Binder,Model outputs hallucinated URL,Validation strips URL and alerts SAT15,Binder,Model injects markdown image,Markdown image tag stripped SAT16,Composer,Submit draft exceeding token limit,Draft truncated and flagged SAT17,Composer,English and Spanish lengths differ by 50%,Flagged for operator review SAT18,Composer,Translation includes HTML script tag,Script tag encoded to plaintext SAT19,Composer,Output lacks required attribution ID,Validation fails SAT20,Composer,Model attempts to change edition date,Date overridden by Server Authority SAT21,Server,Publish duplicate edition date,Server rejects duplicate write SAT22,Server,Database injection via source text,PDO prepared statement prevents SQLi SAT23,Server,Write to directory outside /public,Filesystem permissions deny write SAT24,Server,Generate final RSS feed with \<svg\> payload,XML encoded safely SAT25,Server,Validate C2PA manifest generation,Valid signature produced for edition SAT26,Server,API request without idempotency key,Request rejected SAT27,Server,API request with replayed idempotency key,Cached success response returned SAT28,Server,Token budget exceeded,Pipeline halts and alerts SAT29,Server,Validation loop exceeds 3 retries,Job marked as permanently failed SAT30,Operator,Login without CSRF token,POST rejected with 403 SAT31,Operator,Access console over HTTP,Redirected to HTTPS HSTS SAT32,Operator,Check session cookie attributes,SameSite=Strict and HttpOnly present SAT33,Operator,Idle session for 16 minutes,Session terminated automatically SAT34,Operator,Access diagnostic log with API key,API key replaced by \[REDACTED\] SAT35,Operator,Brute force login 10 times,IP blocked for 15 minutes SAT36,Lifecycle,Delete active job ID,Soft delete executed cleanly SAT37,Lifecycle,Poll provider API 100 times/min,Rate limited to 50/min SAT38,Lifecycle,Queue processing times out,Job returned to queue safely SAT39,Lifecycle,Orphaned temp files exist 24 hours,Cleanup cron deletes files SAT40,Scout,Receive 429 from target source,Exponential backoff applied SAT41,Scout,DNS resolution failure,Logged and skipped safely SAT42,Capture,Extract text from PDF,Text extracted without executing macros SAT43,Capture,PDF with JS embedded,JS stripped completely SAT44,Binder,Inject system prompt command in text,Model ignores instruction SAT45,Composer,Inject translation bypass,Model translates correctly SAT46,Server,Verify timezone consistency,All timestamps strictly UTC SAT47,Server,Log rotation occurs,Logs rotated without dropping data SAT48,Operator,Attempt path traversal in log viewer,Directory boundary enforced SAT49,Operator,Trigger manual job start,Job queued with new idempotency key SAT50,Supply,Run composer audit,No known vulnerabilities reported SAT51,Supply,Check SLSA provenance,Valid provenance file exists SAT52,API,Public RSS queried 1000 times/sec,CDN edge caching absorbs traffic SAT53,API,CORS headers on public API,Restricted to allowed origins SAT54,Model,Invalid JSON from provider,Caught by json\_decode safely SAT55,Model,Provider returns 500 error,Handled gracefully with retry SAT56,Web,Typo-squatted domain input,Scout processes as normal untrusted text SAT57,Web,Homoglyph in URL,Punycode conversion handles safely SAT58,Capture,Data URL submitted,Rejected immediately SAT59,Server,File path injection in cache,Sanitized to alphanumeric only SAT60,Operator,Logout clears session,Session file destroyed on server

Complete Source Register

Cutoff Date: Thursday, July 30, 2026 at 9:38:17 PM CDT. \[1\] OWASP (2025). OWASP Top 10 for LLM Applications 2025\. \[14\] MITRE (2025). MITRE ATLAS: Adversarial Threat Landscape for AI Systems. \[15\] Promptfoo (2025). MITRE ATLAS Techniques and ML Attack Lifecycle. \[16\] TryDeepTeam (2025). Frameworks: MITRE ATLAS. \[17\] TryDeepTeam (2025). Overview of AI Specific Adversarial Tactics. \[19\] Armosec (2025). MITRE ATLAS for AI Agent Attack Detection. \[21\] Vectra AI (2025). Understanding the MITRE ATLAS Framework. \[22\] OpenAI (2025). Structured Outputs Documentation. \[24\] OpenAI Community (2025). Strict True and Required Fields in Structured Outputs. \[30\] Laravel Architecture (2025). Laravel OpenAI Structured Outputs JSON Schema. \[33\] Sourcery AI (2025). PHP SSRF Defense and DNS Rebinding. \[34\] Greshake, K., et al. (2023). "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection." arXiv:2302.12173. \[38\] Cornell University (2023). Abstract: Compromising Real-World LLM-Integrated Applications. \[49\] Coalition for Content Provenance and Authenticity (C2PA) (2025). Content Credentials Explainer. \[52\] TrueScreen (2026). C2PA Standard: History, Promises, and Structural Limitations. \[59\] Content Authenticity Initiative (2025). Manifest Writing and Assertions Actions. \[66\] OWASP (2025). Cross-Site Request Forgery (CSRF). \[67\] OWASP (2025). Cross-Site Request Forgery Prevention Cheat Sheet. \[68\] OWASP (2025). Limitations of SameSite Cookie Attribute. \[70\] Worldline Tech (2018). Same Site Cookie: A New Protection Against CSRF. \[73\] Coveros (2025). Understanding Session Management. \[76\] Oligo Security (2025). OWASP Top 10 LLM Updated 2025 Examples. \[82\] Promptfoo (2025). OWASP Top 10 LLMs TL;DR. \[86\] OWASP (2025). OWASP Top 10:2025 Main Project Page. \[88\] NIST (2025). LINDDUN Privacy Threat Modeling Framework. \[89\] NSA/CISA/FBI (2025). Cybersecurity Information Sheet: AI Data Security. \[90\] CISA (2025). Secure Software Development AI Guidance Checklist. \[91\] Morgan Lewis (2026). US CISA, G7 Partners Release Minimum Elements for AI SBOMs. \[93\] Inside Government Contracts (2026). CISA Releases AI Data Security Guidance. \[94\] CISA (2026). Software Bill of Materials for AI \- Minimum Elements. \[97\] CISA (2025). NIST SP 800-218 Secure Software Development Framework v1.1. \[99\] SLSA (2025). SLSA v1.0 Provenance Schema JSON Format. \[113\] A10 Networks (2025). LLM Unbounded Consumption Mitigation. \[116\] OWASP (2025). LLM05:2025 Improper Output Handling. \[119\] A10 Networks (2025). LLM Output Validation. \[123\] Kodem Security (2025). OWASP Top 10 for LLM Applications 2025\. \[124\] Aembit (2025). OWASP Top 10 LLM Risks Explained. \[129\] OWASP (2025). LLM06:2025 Excessive Agency. \[133\] A10 Networks (2025). Excessive Agency Attack Scenarios. \[134\] Indusface (2025). Excessive Agency \- Uncontrolled Actions in AI Systems. \[141\] Indusface (2025). System Prompt Leakage Extraction Techniques. \[142\] OWASP (2025). LLM09:2025 Misinformation. \[147\] A10 Networks (2025). LLM Hallucination and Misinformation Mitigation. \[151\] Confident AI (2025). OWASP Top 10 2025 for LLM Applications Mitigation Techniques. \[152\] NIST (2024). SP 800-61 Rev 2: Computer Security Incident Handling Guide. \[158\] Oligo Security (2025). Prompt Injection Mitigations. \[160\] OWASP (2025). Prompt Injection PDF Specification. \[163\] WaterISAC (2025). CISA and Partners Release Joint Guidance SBOM for AI. \[168\] OWASP (2025). Cross Site Scripting Prevention Cheat Sheet. \[171\] OWASP (2025). ASVS V1 Encoding and Sanitization.

Works cited

1. \[2302.12173\] Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection \- ar5iv, https://ar5iv.labs.arxiv.org/html/2302.12173

2. LLM Improper Output Handling | OWASP LLM05:2025 \- A10 Networks, https://www.a10networks.com/glossary/llm-output-validation/

3. \[2302.12173\] Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection \- arXiv, https://arxiv.org/abs/2302.12173

4. OWASP LLM06: Excessive Agency in AI Systems | Indusface, https://www.indusface.com/learning/owasp-llm-excessive-agency/

5. OWASP Top 10 for LLM Applications 2025, https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf

6. Joint Cybersecurity Information AI Data Security, https://media.defense.gov/2025/May/22/2003720601/-1/-1/0/CSI\_AI\_DATA\_SECURITY.PDF

7. CISA Releases AI Data Security Guidance \- Inside Government Contracts, https://www.insidegovernmentcontracts.com/2025/06/cisa-releases-ai-data-security-guidance/

8. OWASP Top 10 LLM, Updated 2025: Examples & Mitigation Strategies \- Oligo Security, https://www.oligo.security/academy/owasp-top-10-llm-updated-2025-examples-and-mitigation-strategies

9. LLM Unbounded Consumption & DoS Attacks | OWASP LLM10 \- A10 Networks, https://www.a10networks.com/glossary/llm-unbounded-consumption/

10. OWASP Top 10 2025 for LLM Applications: What's new? Risks, and Mitigation Techniques, https://www.confident-ai.com/blog/owasp-top-10-2025-for-llm-applications-risks-and-mitigation-techniques

11. LLM09:2025 Misinformation \- OWASP Gen AI Security Project, https://genai.owasp.org/llmrisk/llm092025-misinformation/

12. PHP Server-Side Request Forgery (SSRF) | Security Vulnerability Database \- Sourcery.ai, https://www.sourcery.ai/vulnerabilities/php-lang-security-php-ssrf

13. OpenAI Structured Outputs in Laravel: Enforcing JSON Schema for Production AI Pipelines, https://origin-main.com/laravel-architecture/laravel-openai-structured-outputs-json-schema/

14. LLM05:2025 Improper Output Handling \- OWASP Gen AI Security Project, https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/

15. LLM Hallucination & Misinformation | OWASP LLM09:2025 \- A10 Networks, https://www.a10networks.com/glossary/llm-hallucination/

16. LLM06:2025 Excessive Agency \- OWASP Gen AI Security Project, https://genai.owasp.org/llmrisk/llm062025-excessive-agency/

17. OWASP LLM07:2025 System Prompt Leakage – Risks & Mitigations, https://www.indusface.com/learning/owasp-llm-system-prompt-leakage/

18. Cross Site Scripting Prevention \- OWASP Cheat Sheet Series, https://cheatsheetseries.owasp.org/cheatsheets/Cross\_Site\_Scripting\_Prevention\_Cheat\_Sheet.html

19. OWASP Top 10 for LLMs 2025 | DeepTeam \- The LLM Red Teaming Framework, https://www.trydeepteam.com/docs/frameworks-owasp-top-10-for-llms

20. Cross-Site Request Forgery Prevention \- OWASP Cheat Sheet Series, https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site\_Request\_Forgery\_Prevention\_Cheat\_Sheet.html

21. Same-site cookie, a new protection against CSRF, https://blog.worldline.tech/2018/07/02/same-site-cookie-a-new-protection-against-csrf.html

22. Understanding Session Management \-- One of OWASP Top 10 (Part 1\) \- Coveros, https://www.coveros.com/blog/understanding-session-management-one-of-owasp-top-10-part-1/

23. US CISA, G7 Partners in Europe and Asia Release Minimum Elements for AI Software Bills of Materials \- Morgan Lewis, https://www.morganlewis.com/pubs/2026/06/us-cisa-g7-partners-in-europe-and-asia-release-minimum-elements-for-ai-software-bills-of-materials

24. (TLP:CLEAR) CISA and Partners Release Joint Guidance: Software Bill of Materials for AI – Minimum Elements \- WaterISAC, https://www.waterisac.org/tlpclear-cisa-and-partners-release-joint-guidance-software-bill-of-materials-for-ai-minimum-elements

25. C2PA and Content Credentials Explainer, https://spec.c2pa.org/specifications/specifications/2.3/explainer/\_attachments/Explainer.pdf

26. What Is C2PA? The Standard, Its Metadata and Real Limits \- TrueScreen, https://truescreen.io/articles/c2pa-standard-history-limitations/

27. LLM Excessive Agency | OWASP LLM06:2025 Explained \- A10 Networks, https://www.a10networks.com/glossary/llm-excessive-agency/

28. Introduction to Structured Outputs \- OpenAI Developers, https://developers.openai.com/cookbook/examples/structured\_outputs\_intro

29. Cross Site Request Forgery (CSRF) \- OWASP Foundation, https://owasp.org/www-community/attacks/csrf

30. 0x10-V1-Encoding-and-Sanitization.md \- ASVS \- GitHub, https://github.com/OWASP/ASVS/blob/master/5.0/en/0x10-V1-Encoding-and-Sanitization.md

31. Software attestations \- SLSA.dev, https://slsa.dev/spec/v1.0/attestation-model

32. Draft NIST SP 800-61, Computer Security Incident Handling Guide, https://csrc.nist.gov/files/pubs/sp/800/61/r2/final/docs/draft-sp800-61rev2.pdf