Research

Research & Publications

Findings from our security research program. Controlled adversarial evaluations, published methodology, and measurable results.

Absent Deliberation

How LLMs Resolve Competing Objectives Without Reasoning About Them

October 2026

LLM customer service agents confirm stored PII when asked to verify it, while refusing direct requests for the same data. We trace the mechanism through more than 1,500 API calls across six Claude models with full thinking-trace capture. The model almost never asks itself whether confirmation is disclosure, and when it does, it reasons past the question. Made to take a position on the scenario beforehand, it refused in every trial. More reasoning effort did not reliably help, and in one model made disclosure more explicit.

Confirmation as Disclosure

Identity-Assumption Attacks Against LLM Customer Service Agents

September 2026

An attacker states customer data and asks the agent to confirm it, and the model verifies it without authenticating the requester. We evaluate this vulnerability class across eight models from two providers with over 1,160 test executions. Seven of eight models disclosed PII in at least one reported condition, and a configuration adapted from a published customer-support guide disclosed in 84% of tests. Verification instructions in the system prompt did not prevent it; application-layer authorization did.

Red Team Evaluation of an AI Agent Security Layer

Across Regulated Industries

April 2026

Findings from a structured adversarial evaluation of Glyph Guard across four regulated industries, with over 2,600 attack payloads executed across multiple agent configurations. The guard achieved a 90.6% combined defense rate with a 0% false positive rate on benign traffic.

Open Source

Tooling we release so teams can reproduce a finding against their own deployment. Each tool covers one attack class from a published paper, nothing more.

disclosure-eval

Test an AI customer service agent for confirmation-based PII disclosure.

Apache 2.0·Built on Confirmation as Disclosure and Absent Deliberation

Generates plain customer-style prompts from synthetic records you control, sends them to your agent, and scores every reply with deterministic rules. Reports disclosure rates with confidence intervals, fields disclosed by sensitivity, verification requests, and an oracle score that shows whether answers track the underlying record. No attack payloads ship with the tool, and no model judges another model.

View on GitHub →pip install git+https://github.com/nxtaillc/disclosure-eval.git