{
  "format": "agent-article-v0",
  "article_id": "EA-014",
  "canonical_url": "/tools/ea-014-ai",
  "page_type": "failure_note",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-014-URL-692B612F0AC2",
    "EVD-EA-014-URL-33D25B306E1A",
    "EVD-EA-014-URL-5ACCE7F97D5F",
    "EVD-EA-014-URL-B2AC367DAF50",
    "EVD-EA-014-URL-430C5292E08D",
    "EVD-EA-014-URL-391B7B531F5F",
    "EVD-EA-014-URL-64AF1D1A2FD4",
    "EVD-EA-014-URL-6791CC4A561E",
    "EVD-EA-014-URL-04A101D0B399",
    "EA-014-R11-RESEARCH",
    "EA-014-R11-WEB-READBACK"
  ],
  "unknown_ids": [
    "EA-014-UNKNOWN-CURRENTNESS"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "UNKNOWN",
  "observation_status": "SPEC_ONLY",
  "freshness": "UNKNOWN",
  "last_verified": null,
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "COMM-014-EA0014",
    "SRC-EA-014-URL-692B612F0AC2",
    "SRC-EA-014-URL-33D25B306E1A",
    "SRC-EA-014-URL-5ACCE7F97D5F",
    "SRC-EA-014-URL-B2AC367DAF50",
    "SRC-EA-014-URL-430C5292E08D",
    "SRC-EA-014-URL-391B7B531F5F",
    "SRC-EA-014-URL-64AF1D1A2FD4",
    "SRC-EA-014-URL-6791CC4A561E",
    "SRC-EA-014-URL-04A101D0B399",
    "WEBBODY-EA0014-R8-567893FA"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-014-URL-692B612F0AC2",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://doi.org/10.6028/NIST.AI.100-2e2025",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-692B612F0AC2"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://doi.org/10.6028/NIST.AI.100-2e2025"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-33D25B306E1A",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://doi.org/10.6028/NIST.AI.600-1",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-33D25B306E1A"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://doi.org/10.6028/NIST.AI.600-1"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-5ACCE7F97D5F",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-5ACCE7F97D5F"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-B2AC367DAF50",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://atlas.mitre.org/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-B2AC367DAF50"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://atlas.mitre.org/"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-430C5292E08D",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-430C5292E08D"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-391B7B531F5F",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://openai.com/index/prompt-injections/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-391B7B531F5F"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://openai.com/index/prompt-injections/"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-64AF1D1A2FD4",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://www.anthropic.com/engineering/how-we-contain-claude",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-64AF1D1A2FD4"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://www.anthropic.com/engineering/how-we-contain-claude"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-6791CC4A561E",
      "evidence_class": "RESEARCH",
      "title": "locator:",
      "href": "https://modelcontextprotocol.io/specification/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-6791CC4A561E"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- locator: https://modelcontextprotocol.io/specification/"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-014-URL-04A101D0B399",
      "evidence_class": "RESEARCH",
      "title": "repository:",
      "href": "https://github.com/ethz-spylab/agentdojo-core",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-014-URL-04A101D0B399"
      ],
      "supporting_locators": [
        "Evidence and provenance",
        "- repository: https://github.com/ethz-spylab/agentdojo-core"
      ],
      "scope": "Evidence and provenance",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-014-R11-RESEARCH",
      "evidence_class": "RESEARCH",
      "title": "EA-014 監査済みresearch / canonical revision binding",
      "supports": [
        "評価の主語は「LLMを騙せるか」ではなく、敵対的入力が存在しても権限・秘密・外部side effectへどこまで到達できるかとする。"
      ],
      "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "COMM-014-EA0014"
      ],
      "supporting_locators": [
        "COMM-014-EA0014",
        "EA-014-R5-LEGACY-MIGRATION-20261008-R1",
        "content/staging/EA-014.md"
      ],
      "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。",
      "provenance_status": "AUDIT_PASS_CANONICAL_BINDING"
    },
    {
      "id": "EA-014-R11-WEB-READBACK",
      "evidence_class": "IMPL",
      "title": "EA-014 Web body identity / canonical readback",
      "supports": [
        "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。"
      ],
      "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。",
      "checked_at": null,
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "WEBBODY-EA0014-R8-567893FA"
      ],
      "supporting_locators": [
        "WEBBODY-EA0014-R8-567893FA",
        "content/staging/EA-014.md",
        "EA-014-R5-LEGACY-MIGRATION-20261008-R1"
      ],
      "scope": "R9/R10 canonical readback後のProduction生成時body identity。",
      "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "Public claim",
      "text": "Prompt injection / agent hijackingへの耐性はmodel-only refusalではなく、system containmentとrecoveryの問題として扱う。外部文書、Web、メール、RAG、connector、MCP/tool等のuntrusted inputがprivileged action/dataと同一decision loopへ入ることを前提に、least privilege、deterministic policy/approval、sandbox/egress/secret isolation、monitoring、kill/rollback、adaptive held-out evaluation、benign utility、UNKNOWN境界を維持する。\n\n完全防止、既知benchmark ASRからtenant/product保証への外挿、単一filter/system prompt/fine-tuning/detectorによるsecurity-boundary成立は主張しない。"
    },
    {
      "heading": "Evidence and provenance",
      "text": "### NIST AI 100-2e2025\n- class: official taxonomy / normative anchor\n- title: Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations\n- locator: https://doi.org/10.6028/NIST.AI.100-2e2025\n- edition: 2025\n- use: AML taxonomy、prompt injection / red-team threat-model context。\n- boundary: publication時に後継版有無を再確認する。\n\n### NIST AI 600-1\n- class: official risk-management profile / normative anchor\n- title: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile\n- locator: https://doi.org/10.6028/NIST.AI.600-1\n- use: red teamingをTEVV/risk-managementへ接続するcontext。\n\n### NIST CAISI AgentDojo evaluation\n- class: government evaluation evidence\n- title: Technical Blog: Strengthening AI Agent Hijacking Evaluations\n- locator: https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations\n- use: known attack setの低ASRをadaptive/held-out attack耐性へ外挿できない反証。\n- boundary: evaluation evidenceであり、universal product guaranteeではない。\n\n### MITRE ATLAS\n- class: living threat knowledge base\n- locator: https://atlas.mitre.org/\n- edition: living catalog; as-of 2026-09-11\n- use: context/tool/tool-data/tool-invocationを含むagentic attack surfaceの分類。\n- boundary: technique掲載は対象SUTでの成功証明ではない。publication時にedition/as-ofを再確認する。\n\n### OWASP GenAI Security Project\n- class: community/living risk catalog\n- title: LLM01:2025 Prompt Injection\n- locator: https://genai.owasp.org/llmrisk/llm01-prompt-injection/\n- edition: 2025; as-of 2026-09-11\n- use: direct/indirect injection、least privilege、human approval、external-content segregation、adversarial testingのcontext。\n- boundary: normative standardではなくrisk catalog。完全防止を示さない。\n\n### OpenAI guidance\n- class: provider-authored guidance\n- locator: https://openai.com/index/prompt-injections/\n- volatility: PRODUCT_VOLATILE\n- use: sandboxing、confirmation、scoped access、explicit task scope、red teaming等の多層防御例。\n- boundary: provider guidanceは特定tenantの実効防御を証明しない。\n\n### Anthropic guidance\n- class: provider-authored guidance\n- title: How we contain Claude across products\n- locator: https://www.anthropic.com/engineering/how-we-contain-claude\n- volatility: PRODUCT_VOLATILE\n- use: external resourceをsupply-chain riskとprompt-injection vectorの両方として扱うcontext。\n- boundary: provider guidanceは独立保証ではない。\n\n### MCP\n- class: interoperability specification\n- baseline: 2026-07-28\n- locator: https://modelcontextprotocol.io/specification/\n- boundary: security claimsはpublication時にcurrent normative textへ再照合する。MCP接続の存在はtool安全性を証明しない。\n\n### AgentDojo OSS\n- class: author-maintained OSS evaluation framework\n- repository: https://github.com/ethz-spylab/agentdojo-core\n- commit: UNKNOWN\n- boundary: executable harnessへ採用する前にexact commitをpinする。commit UNKNOWNのまま再現可能実装とは扱わない。"
    },
    {
      "heading": "Findings",
      "text": "評価の主語は「LLMを騙せるか」ではなく、敵対的入力が存在しても権限・秘密・外部side effectへどこまで到達できるかとする。\n\nDefense-in-depthは、input/content trust labeling、instruction/data separation、scoped identity/credential、tool allowlist/schema validation、deterministic policy gate、human approval、sandbox/filesystem/network/egress containment、secret isolation、runtime monitoring/anomaly detection、kill/rollback/recovery、adversarial regression evalへ分解する。\n\n既知attack回帰suiteとadaptive/held-out suiteを分離し、security指標と同時にbenign utility / false positiveを測定する。remote tool/resourceは承認後変更を前提に、server version、tool catalog/description、auth scope、network destination、output schema、ownerのdriftを再審査triggerにする。"
    },
    {
      "heading": "Proposed structures",
      "text": "以下はすべて PROPOSAL-backed structures であり、既存標準の必須schemaとして扱わない。\n\n### RED_TEAM_SUT_MANIFEST\nmodel/model ID、product mode、system-instructions hash、connected data sources、tools/connectors/MCP servers、credential principal/scope、sandbox/network policy、approval policy、logging level、version/date。\n\n### ATTACK_CASE\nasset、attacker access、ingress surface、trust boundary、precondition、malicious objective、required authority、attack steps、expected control、observed outcome、blast radius、detection signal、recovery、residual UNKNOWN。\n\n### CONTROL_MAP\npreventive / detective / containment / recovery controlsをattack surfaceとauthorityへ対応付ける。\n\n### RUN_RESULT\nattack-case ID、benign-task success、attack success、unauthorized read/write/send/delete、secret exposure、policy block、human-approval path、detector signal、time-to-detect、time-to-stop、recovery/rollback、residual artifact、cost。"
    },
    {
      "heading": "Evaluation",
      "text": "BENIGN_UTILITY、ASR_TARGETED、UNAUTHORIZED_EFFECT_RATE、SECRET_EXPOSURE_RATE、DETECTION_RATE、FALSE_POSITIVE_RATE、CONTAINMENT_RATE、RECOVERY_SUCCESS / MTTR、ADAPTIVE_ASRを別々に記録する。\n\nadaptive-ASRに固定のuniversal thresholdを置かない。acceptance thresholdは業務risk class依存としUNKNOWNを推測で閉じない。公開benchmarkをproduct/tenant保証へ昇格しない。"
    },
    {
      "heading": "Safe test boundary",
      "text": "実データ、production secret/PII、production credential、無許可external side effectを使用しない。synthetic/canary fixtureを基本とする。後続試験候補はsynthetic workspace、canary secret、bounded read/write/send tools、MCP/tool-poisoning simulation、adaptive held-out red team、recovery drillであり、production環境での攻撃payload corpus実行を本staging artifactは要求しない。"
    },
    {
      "heading": "Failure envelope",
      "text": "Prompt Injection完全排除の根拠は確立していない。human approval、sandbox、least privilegeはいずれも単独では万能ではない。filesystem/process containmentとSaaS/API privilege containmentを分離する。provider guidanceはtenant-specific effective control availabilityを証明しない。living catalogsはedition/as-ofを固定する。"
    }
  ],
  "human_url": "/tools/ea-014-ai",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-014-ai",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-014-ai"
}