Trail of Bits AI and machine learning research
Original vulnerability research and audit engineering from a commercial security firm, with technical examples and project links.
AN INDEPENDENT MAP OF AI SECURITY
Find your next
good source.●
Original research, practical guides, and trusted starting points. A smaller, more useful way into AI security.
— sources— selected readings08 topics
A question, a topic, or the source you already know.
Curated links. Original publishers.
EXPLORE THE INDEX
A little direction goes a long way.
The directory could not refresh. Your previous results are still here.
GitHub Advisory Database
Search package security advisories and inspect identifiers, affected ranges and maintainer references; coverage extends beyond AI software.
MITRE ATLAS
An adversarial AI knowledge base of tactics, techniques and case studies for threat modeling and investigation.
Inside 90 days of attacks on AI infrastructure
Wiz reports observations from its AI-service honeypots, including exposed MCP services. Treat the telemetry as this vendor’s sampled observations.
OSV — Open Source Vulnerabilities
Structured open-source vulnerability records and package queries. Check ecosystem and version matching before applying a result.
OSV API Quickstart
Official examples for querying package versions or commit hashes. Useful when an agent needs structured vulnerability evidence rather than a web summary.
Wiz Research
Cloud-security vendor research covering AI infrastructure exposures and exploit chains. Separate disclosed observations from product marketing.
REST API endpoints for global security advisories
Official API documentation for retrieving and filtering global advisories, with affected-package data and source references.
Audit shows that safetensors is safe and ready to become the default
The project sponsor explains serialization risks and links the commissioned audit. Audit results apply to the reviewed scope and version.
Hugging Face Hub security documentation
Platform-maintainer documentation on model artifact scanning and repository security; useful when evaluating downloaded AI assets.
GenAI and Agentic AI Exploit Roundup Q3 2026
An OWASP-hosted editorial roundup linking reported incidents and research. The page states it is neither exhaustive nor an official OWASP publication.
NVIDIA Product Security
NVIDIA’s official security bulletin repository provides maintainer notices and machine-readable records for its products, including AI infrastructure.
1Password's AI patching benchmark is misleading
A Trail of Bits post presenting a critical examination of 1Password's AI patching benchmark and arguing that it is misleading.
OWASP GenAI Security Project Unveils 2026 Top 10 for LLM Applications, New Agent Control Standard and Sponsors as Community Tops 30,000 Members
OWASP GenAI Security Project announces its 2026 Top 10 for LLM Applications, a new Agent Control Standard, and additional resources for securing generative and agentic AI.
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz Research analyzes NordStellar data to map credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments.
A path we haven't mapped yet.
Try a broader topic or clear a filter.
“Newest” uses the original publication date. Undated guides remain available in curated order.
Directory revised
A USEFUL TOOL IN YOUR AGENT'S TOOLBOX
Let your agent start
with better references.
The same selected sources, with original links and clear dates.