# AI, LLM, agent and MCP scopes

An AI finding needs an attacker-controlled input, a security boundary, a measurable unauthorized result and reproducible conditions. Offensive wording, hallucinations and a model repeating supplied text are not automatically vulnerabilities. A program may separately reward model-safety failures; check that scope explicitly. OWASP's AI Testing Guide covers broader trustworthiness properties as well as security, while its LLM Top 10 supplies a risk taxonomy rather than universal bounty eligibility. [AI Testing Guide](https://owasp.org/www-project-ai-testing-guide/), [LLM Top 10](https://genai.owasp.org/llm-top-10/)

## Scope decomposition

| Scope | Identity to pin | Boundary worth testing |
|---|---|---|
| Hosted inference/chat API | Endpoint, model identifier, project, API principal, version/date | Authentication, tenant objects, model access, quotas and output processing |
| RAG/document assistant | Tenant, collection/index, document IDs, source permissions | Ingestion ownership, retrieval filtering, citations, caches and revocation |
| Tool-using agent | Agent version, caller, available tools, execution identity | Instructions versus retrieved data, tool authorization and user approval |
| MCP implementation | Client/server package versions, protocol version, transport, OAuth issuer/resource | Token audience, per-request identity, tool/resource authorization and state ownership |
| Open weights/model artifact | Repository revision, weight digest, format, loader/runtime | Artifact provenance, parser behavior and loading-time code execution |
| Training/fine-tuning pipeline | Dataset/version, job/project, checkpoint destination | Poisoning, unauthorized training data and model/artifact publication |

These scopes are independent. A license to download weights does not authorize attacks on their hosting platform. An inference endpoint does not grant permission to extract unpublished weights or training data. A local loader finding may be an OSS vulnerability without affecting the hosted deployment; demonstrate the actual supported path.

## Staged playbook

**1. Establish the product contract and deterministic baseline.** Identify what the user intended, what the attacker can change and which tools the agent can invoke. Record model identifier, sampling parameters, system/application configuration where available, enabled connectors and versioned fixtures. Build two owned tenants and unique synthetic canaries. Set a small explicit trial count and request/token budget; a refusal screenshot is not a complete test outcome.

**2. Map every entry point and sink.** Entry points include chat, uploaded files, OCR/transcripts, repository text, retrieved web pages, vector results, tool descriptions and tool responses. Sinks include rendered HTML, SQL, shell arguments, network requests, document writes, permissions and external messages. Follow context through summarization and agent handoffs: security decisions must survive transformations, not just the initial prompt.

**3. Separate behavior steering from an authority violation.** Put a harmless instruction in one lower-trust fixture and have the owned victim account perform its legitimate task. First observe whether the instruction influences the answer. Then test whether that influence causes a restricted synthetic data read, changes a tool argument, or bypasses a required confirmation in a mocked action. An agent saying it sent a message proves nothing unless the tool/audit log shows the action. Excessive agency concerns the combination of tool functionality, permission and autonomy. [OWASP Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/)

Example proof design: tenant B owns a private document containing a random `B_PRIVATE_...` marker. Tenant A controls a shared document that the assistant is legitimately asked to summarize. If processing A's document causes B's assistant to retrieve B's private marker and expose it through an attacker-visible result, record that precise data boundary. Keep both identities under researcher control; use a stub outbox if the product action is a message. The marker must not appear in the attack text or baseline context, otherwise the experiment proves copying rather than disclosure.

**4. Audit RAG as an authorization system.** Trace tenant identity from the authenticated session into the query filter, document resolver and citation downloader. Compare direct document access with semantic retrieval; test renamed documents, deleted/revoked sources, shared-to-private transitions and cached answers. In local source review, look for optional client-supplied tenant filters and global fallback searches. Log retrieved document IDs and the final response independently: unauthorized retrieval remains important even when the final model declines to quote it, but externally observable impact must be stated accurately. [OWASP Vector and Embedding Weaknesses](https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/)

**5. Test tools below the model.** Repeat the controlled tool operation directly through its supported API with the same principal. Vary only owned object IDs, tenant IDs, destination accounts or a synthetic state handle. Verify server-side identity binding, schema validation, object ownership, canonical paths and approval state. A tool description saying “read only” does not implement authorization. Distinguish model-induced unauthorized behavior from a conventional backend authorization defect that the model merely exposes. [MCP Tools](https://modelcontextprotocol.io/specification/2026-07-28/server/tools)

**6. Audit MCP according to the deployed protocol era.** As checked on 2026-09-11, the 2026-07-28 specification removes the initialization handshake and protocol sessions; requests carry version/capability metadata, and `server/discover` advertises capabilities. Earlier deployments through 2025-11-25 can still use `initialize` and session IDs. Apply session-binding tests to those implementations and explicit state-handle ownership tests to modern ones. Mixing protocol eras creates false positives. [MCP changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog)

For OAuth, separate client → MCP and MCP → upstream credentials. Check issuer, audience/resource, expiry, scope and per-request validation with your own tokens. A token for one resource must not become a credential for another merely because the proxy accepts it. Inspect per-client consent where an MCP proxy uses a shared upstream OAuth client; previous consent to one client must not silently authorize a different client. [MCP Authorization](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization), [MCP security guidance](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices)

For HTTP transports, check invalid `Origin` rejection and whether header/body metadata disagree across a gateway and backend. Current Streamable HTTP requires version and method headers corresponding to the body, plus name/parameter headers where applicable. An authentication failure is not proof that Origin validation works; use an otherwise-valid request. In local stdio setups, inspect the executable/package provenance, inherited environment, allowed filesystem roots and process sandbox. Test OAuth metadata fetching with owned callback URLs, not actual cloud metadata or internal services. [Streamable HTTP](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http), [MCP security guidance](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices)

**7. Review weights and model-loading paths as software supply chains.** Pin repository revision, model hash, loader package and all custom-code dependencies. Inspect `trust_remote_code`, unsafe deserialization, remote archive extraction, template parsing and plugin discovery. Hugging Face custom models can require executing repository-defined model code; that is an explicit trust decision, not automatically a library vulnerability. PyTorch's restricted weight loading reduces attack surface but is not a complete hostile-file sandbox. Begin with static inspection; perform malformed-artifact tests only in an isolated disposable runtime without credentials. [Transformers custom models](https://huggingface.co/docs/transformers/custom_models), [PyTorch serialization](https://docs.pytorch.org/docs/stable/notes/serialization.html)

**8. Minimize and quantify.** Preserve full relevant inputs, retrieved content hashes, visible outputs and tool/audit events. Repeat fresh sessions with and without the candidate input, report successes/attempts and avoid presenting a stochastic result as universal. Keep the successful transcript, including the legitimate task; an attack string without the surrounding conditions is rarely reproducible. System-prompt disclosure should be assessed for exposed sensitive data or broken authorization, not presumed critical simply because instructions were revealed. [OWASP System Prompt Leakage](https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/)

## Hypotheses, controlled tests and evidence

| Hypothesis | Minimum controlled test | Evidence and interpretation |
|---|---|---|
| Retrieved instructions become tool authority | One attacker-owned document causes an owned victim's agent to invoke a mock restricted tool | Document hash, legitimate task, tool name/arguments, execution identity and stub audit event. An answer-style change alone is behavior evidence. |
| RAG applies tenant filtering only in the UI | Query A for a unique B-only marker through retrieval and citation paths | A token identity, B document ownership, retrieved IDs and final disclosure; include expected denied direct access. |
| Tool accepts caller-supplied ownership | Call the tool as A with B's synthetic object or workspace ID | Backend decision and canary result. Categorize underlying BOLA/IDOR independently of the LLM. |
| Agent approval binds to an obsolete action | In a local fixture, approve a harmless draft, then change its destination before execution | Approved argument digest versus executed argument digest and mock result. Do not send a real message. |
| MCP accepts a token for a different audience | Use a valid token issued to your own second resource against a harmless protected lab tool | Token claim summary, expected audience, request and unauthorized synthetic result; never publish token values. |
| State handles are bearer authorization | Supply your B-owned workflow handle while authenticated as A | Both authenticated identities, handle creation and B canary output. Legacy session behavior requires a version-specific test. |
| Gateway and MCP server disagree on routing identity | In a local fixture, vary one mirrored header against its body field | Request, gateway route, backend principal and result; mere protocol nonconformance is not automatically exploitable. |
| Model loading executes unintended code | Trace an externally reachable import path into an unsafe loader; reproduce using a benign local marker fixture | Digest, loader call, minimal input, isolated side effect and supported deployment path; do not load unknown artifacts on a credentialed workstation. |

## Checklist

- [ ] Hosted application, model, artifact, connector and provider scopes are distinguished.
- [ ] Attacker capability and the legitimate user's task are explicitly recorded.
- [ ] A/B tenants and private random canaries exist; canaries are absent from attacker input.
- [ ] Baseline requests establish expected permissions before adversarial input.
- [ ] Model version, runtime, sampling settings and trial budget are fixed and logged.
- [ ] Retrieval authorization, citations, caches and revocation are tested separately.
- [ ] Tool argument ownership and approval binding are checked below the model.
- [ ] MCP protocol era, transport, OAuth audience and upstream credentials are mapped.
- [ ] Model hashes, custom code and deserialization paths are reviewed in isolation.
- [ ] Success means an observable security consequence; hallucinated actions are excluded.
- [ ] Attempts/successes, evidence redaction and cleanup are documented.

## Command cheat sheet

These six commands are static/local inspection or protocol discovery against an owned fixture. Use a trusted Python 3.11+ interpreter for `file_digest`; isolated mode and disabled site initialization prevent imports from the working directory and site customizations. No model or repository code is executed by the first four. Local HTTP examples assume your intentionally unauthenticated loopback fixture; for an authenticated fixture, use its documented lab credentials. Inventory results do not establish tool-call authorization.

```bash
# 1. Find loader and execution sinks in a local source checkout.
rg -n 'trust_remote_code|torch\.load|pickle\.loads?|subprocess|shell=True' ./repo

# 2. Fingerprint one local weight artifact without loading the model.
python3 -I -S -c 'import hashlib; f=open("./model/model.safetensors","rb"); print(hashlib.file_digest(f,"sha256").hexdigest())'

# 3. Inspect JSON model configuration without importing custom model code.
python3 -I -S -m json.tool ./model/config.json

# 4. Generate a synthetic marker for your private test document.
python3 -I -S -c 'import secrets; print("B_PRIVATE_" + secrets.token_hex(16))'

# 5. Discover a local MCP server implementing the 2026-07-28 protocol.
curl -q --noproxy '*' --proto '=http' --silent --show-error --max-time 10 http://127.0.0.1:8000/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' -H 'Mcp-Method: server/discover' \
  --data '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{},"io.modelcontextprotocol/clientInfo":{"name":"bounty-lab","version":"1.0"}}}}'

# 6. List tool schemas, without calling a tool, on the same modern fixture.
curl -q --noproxy '*' --proto '=http' --silent --show-error --max-time 10 http://127.0.0.1:8000/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' -H 'Mcp-Method: tools/list' \
  --data '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{},"io.modelcontextprotocol/clientInfo":{"name":"bounty-lab","version":"1.0"}}}}'
```

References for command semantics: [ripgrep guide](https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md), [Python hashlib](https://docs.python.org/3/library/hashlib.html), [Python JSON](https://docs.python.org/3/library/json.html), [Python secrets](https://docs.python.org/3/library/secrets.html), [MCP changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog), [MCP HTTP binding](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http), [MCP tools](https://modelcontextprotocol.io/specification/2026-07-28/server/tools). Syntax was checked against documentation; these examples were not run against a live target.

## Close the persistence, retry and pipeline gaps

Run [AI state lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-state-lifecycle.html) after the initial prompting/tool tests. It covers thread/checkpoint ownership, memory provenance, delayed worker identity, MCP resumed-state controls, private caches and duplicate committed actions. A protected conversation read is not enough coverage for a separate resume or export endpoint.

| Pipeline handoff | Preserve and test |
|---|---|
| Upload → OCR/parser → index | Source owner, file validation and permission labels |
| Retrieval → summary → durable memory | Source provenance and ability to influence later authority |
| Human approval → background worker | Acting principal, argument binding, revocation and completion state |
| Model output → HTML/SQL/file/tool | Actual consumer validation and the final protected effect |
| Imported model → loader/runtime | Artifact digest, executable-code trust decision and isolation |

Reuse [file boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html), [source dataflow](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/source-dataflow.html), [browser trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) and [injection tracing](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/injection-tracing.html) at those ordinary software boundaries. Use [resource budgets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/resource-budget-controls.html) for bounded cost and fan-out checks.

For MCP 2026-07-28, session removal does not remove application state: MRTR returns state that must be validated when it affects protected decisions. Private cache results require separate authorization contexts, and state-bearing retries have additional cache restrictions. Test the deployed implementation rather than transferring these requirements to older protocol versions. [MRTR](https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr), [caching](https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/caching).

Training/fine-tuning remains a distinct track: identify who may supply a dataset, start a job, select its base model and publish the resulting artifact. Test A/B job and artifact ownership before poisoning hypotheses. A measurable output change is not automatically a security violation; use the program's integrity/confidentiality contract and a separate untouched dataset control.

## Sources

All accessed 11 September 2026. Match living documentation to the target version.

| Publisher | Source | Publication or version |
|---|---|---|
| OWASP Foundation | [OWASP AI Testing Guide](https://owasp.org/www-project-ai-testing-guide/) | 2025-11-26 (v1 announcement) |
| OWASP GenAI Security Project | [LLM Top 10](https://genai.owasp.org/llm-top-10/) | 2025 edition |
| OWASP GenAI Security Project | [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) | 2025 edition |
| OWASP GenAI Security Project | [LLM08:2025 Vector and Embedding Weaknesses](https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/) | 2025 edition |
| OWASP GenAI Security Project | [LLM07:2025 System Prompt Leakage](https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/) | 2025 edition |
| Model Context Protocol | [Tools](https://modelcontextprotocol.io/specification/2026-07-28/server/tools) | 2026-07-28 |
| Model Context Protocol | [Key Changes](https://modelcontextprotocol.io/specification/2026-07-28/changelog) | 2026-07-28 |
| Model Context Protocol | [Authorization](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) | 2026-07-28 |
| Model Context Protocol | [Security Best Practices](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) | 2026-07-28 revision |
| Model Context Protocol | [Streamable HTTP](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http) | 2026-07-28 |
| Hugging Face | [Customizing models — Transformers](https://huggingface.co/docs/transformers/custom_models) | Undated |
| PyTorch | [Serialization semantics](https://docs.pytorch.org/docs/stable/notes/serialization.html) | Undated living documentation |
| Andrew Gallant / ripgrep contributors | [ripgrep User Guide](https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md) | Undated living repository |
| Python Software Foundation | [hashlib — Secure hashes and message digests](https://docs.python.org/3/library/hashlib.html) | Undated living documentation |
| Python Software Foundation | [json — JSON encoder and decoder](https://docs.python.org/3/library/json.html) | Undated living documentation |
| Python Software Foundation | [secrets — Generate secure random numbers for managing secrets](https://docs.python.org/3/library/secrets.html) | Undated living documentation |
| Python Software Foundation | [Command-line options](https://docs.python.org/3/using/cmdline.html) | Living documentation |


## Shared investigation procedures

- [Object, function, and property authorization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authz-matrix.html) — Turn identities, tenants, objects, roles, and lifecycle transitions into a reproducible permission matrix.
- [Authentication, recovery, federation, and session lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) — Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
- [Trace input into queries, commands, and templates](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/injection-tracing.html) — Prove interpretation at a specific sink using small paired experiments instead of payload spraying.
- [Server-side fetching and network trust boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ssrf-boundary.html) — Separate an intended fetch from a request that reaches a prohibited destination, forwards authority, or exposes a protected response.
- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
- [REST, GraphQL, gRPC, WebSocket, and SSE permission parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) — Carry the same permission invariant across protocols, nested fields, streams, and alternate API versions.
- [OSS lab: pin, install, prove, reset](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/oss-lab-reproduction.html) — Turn an eligible release into a repeatable synthetic environment with preserved versions, realistic controls, and an explicit reset recipe.
- [Source review: entry point to protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/source-dataflow.html) — Trace attacker control and authorization through handlers, services, queues, and sensitive operations; promote only reachable violations of a stated invariant.
- [CI and releases: trace untrusted input into privileged work](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/supply-chain-ci.html) — Audit workflow events, shell interpolation, untrusted builds, artifact consumers, and release identity as one privilege chain.
- [Dependencies: from advisory match to reachable impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dependency-reachability.html) — Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.
- [Libraries and parsers: bounded fuzzing to a minimal reproducer](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/parser-fuzzing.html) — Build a realistic local harness, instrument the target, bound fuzzing resources, and turn unique faults into defensible library or consumer reports.
- [AI tools: input trust, execution identity and approvals](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-tool-trust.html) — Prove when lower-trust content changes a protected tool action, then locate the missing authorization or consent boundary.
- [RAG isolation: ingestion, retrieval, citations and revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/rag-tenant-isolation.html) — Trace document authorization through vector search, generated answers, citation downloads, caches and sharing changes.
- [OAuth, OIDC, and SAML: transaction binding and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) — Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.
- [Request values: duplicate parameters, parser conflicts and downstream queries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/request-value-parsing.html) — Trace the value a security layer validates through to the value the application or downstream service actually consumes.
- [Webhooks and integration events: authenticity, tenant binding and replay](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/webhook-event-integrity.html) — Verify the event signature, provider-to-tenant binding and durable worker effect together across retries and out-of-order delivery.
- [AI state: memory, resumed work, retries and private caches](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-state-lifecycle.html) — Test persistent context, task ownership, MCP request-state integrity, duplicate effects and caches across identities and time.
- [Resource budgets and sensitive business flows](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/resource-budget-controls.html) — Trace request fan-out, retries, recipient limits and tenant quotas using tiny local limits, recording stubs and measured downstream effects.

## Vulnerability reference

- [Broken object-level authorization (BOLA / IDOR)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bola-controlled-object-access.html)
- [Broken property authorization: private response fields](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bopla-private-response-property.html)
- [Authentication or MFA state bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authentication-incomplete-state-bypass.html)
- [Residual access after explicit session revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-revocation-residual-access.html)
- [OAuth login or account-linking confusion](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/oauth-login-account-linking-confusion.html)
- [JWT signature, issuer, audience, or token-purpose validation failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/jwt-signature-trust-failure.html)
- [SQL injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sql-query-structure-injection.html)
- [NoSQL operator or query injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/nosql-operator-contract-bypass.html)
- [OS command injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/os-command-argument-boundary.html)
- [Server-side template injection (SSTI)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/server-template-expression-injection.html)
- [Reflected or stored cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xss-reflected-stored-origin-execution.html)
- [Server-side request forgery (SSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ssrf-forbidden-destination.html)
- [Unsafe upload interpretation or placement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-upload-interpretation.html)
- [Path traversal outside an allowed root](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/path-traversal-controlled-canary.html)
- [XML external entity injection (XXE)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xxe-external-entity-resolution.html)
- [Archive extraction path escape](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/archive-extraction-path-escape.html)
- [GraphQL resolver or field authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/graphql-resolver-field-authz.html)
- [WebSocket message or subscription authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/websocket-message-authorization.html)
- [Hard-coded product credentials](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/hardcoded-credentials.html)
- [Dependency confusion and unintended package origin](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dependency-confusion.html)
- [Unsafe object deserialization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-deserialization.html)
- [JavaScript prototype pollution](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/prototype-pollution.html)
- [Out-of-bounds memory read](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-read.html)
- [Out-of-bounds memory write](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-write.html)
- [Integer overflow affecting allocation or bounds](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/integer-overflow.html)
- [Parser resource exhaustion and decompression amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/parser-resource-exhaustion.html)
- [Regular-expression denial of service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/regex-dos.html)
- [Untrusted executable, library, or module search path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/untrusted-search-path.html)
- [Indirect prompt injection into protected tool actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/indirect-prompt-tool-injection.html)
- [Agent tool accepts unauthorized object or tenant parameters](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-tool-object-authorization.html)
- [Agent approval is not bound to executed arguments](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-approval-argument-drift.html)
- [MCP proxy consent confuses different clients](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-proxy-confused-deputy.html)
- [MCP accepts a token for another resource](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-token-audience-confusion.html)
- [RAG retrieval or citation resolver crosses tenant boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/rag-cross-tenant-retrieval.html)
- [RAG cache or fresh retrieval ignores revoked access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/rag-cache-revocation-leak.html)
- [Exposed repository or history secret](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/exposed-repository-secret.html)
- [Sensitive data in errors, debug routes, or generated files](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sensitive-error-disclosure.html)
- [Predictable security token or capability identifier](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/weak-security-token-randomness.html)
- [Argument or option injection without shell interpretation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/process-argument-option-injection.html)
- [Parameter or JSON parser disagreement crosses a security check](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/request-parser-value-conflict.html)
- [Server-side parameter pollution in a constructed request](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/downstream-parameter-injection.html)
- [Unverified or tampered webhook causes a protected effect](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webhook-event-authenticity-failure.html)
- [Authentic integration event applied to the wrong tenant or object](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webhook-provider-tenant-binding.html)
- [Agent conversation, checkpoint or memory crosses ownership boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ai-persistent-state-ownership.html)
- [MCP resumed state changes authorization or request meaning](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-resume-state-integrity.html)
- [Private MCP result is reused across authorization contexts](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-private-cache-context.html)
- [Agent retry commits a protected single-use action twice](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-retry-duplicate-effect.html)
- [Untrusted model artifact reaches executable deserialization or custom code](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/model-artifact-unsafe-loading.html)
- [Unbounded resource allocation or request amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/resource-allocation-limit-failure.html)
- [Sensitive business flow exceeds its permitted frequency or allocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sensitive-flow-frequency-limit.html)