The primary source for the AG01 definition, attack categories, and mitigation framework used throughout this module. Peer-reviewed by NIST, Microsoft AI Red Team, and AWS.

First documented zero-click prompt injection exploit in a production agentic AI system. Microsoft 365 Copilot hijacked via a single crafted email, chaining four bypass techniques to exfiltrate mailbox data. Used in slides 01, 05, 13, 19, 26, 27.

Two zero-click exploit paths in Perplexity Comet agentic browser. Calendar invite triggers local file exfiltration and 1Password credential theft via indirect prompt injection using Hebrew/English obfuscation to evade guardrails. Used in slides 05, 15, 23, 26, 27.

Red team demonstration showing direct agent manipulation achieving broad platform access across McKinsey's internal AI platform in under two hours. Used in slides 05, 11, 26.

Detailed technical breakdown of the ASI01 attack surface, variant taxonomy, and defensive controls. Used in the research phase for slides 07, 09, 10, 12, 17.

Threat modeling walkthrough for ASI01, covering attack paths and the distinction between goal hijack and traditional prompt injection. Used for slides 07, 10.

Academic paper detailing the EchoLeak attack mechanism, bypass chain, and implications for production agentic AI security.

Technical breakdown of EchoLeak's four-stage bypass chain and the architectural implications for agent security design.

Analysis of why purpose-built agent security architecture is required — including the case for authenticated inter-agent messaging and behavioral monitoring. Used for MIT 04, MIT 06.

Practitioner overview of goal hijacking threat model, including least privilege and human-in-the-loop controls. Used for MIT 03, MIT 05.