The UnboundCompute blog

Writing on web security

Embedding Inversion: Reading Text Back Out of a Vector Database

An embedding inversion attack reads the original text back out of stored vectors. See how a leaked vector database can leak plaintext,…
MCP Token Passthrough: How an Agent Hands Over Its Access

MCP token passthrough lets a server reuse a token it was never issued. See how this confused deputy bug works and how…
Adversarial Suffix Attacks: The Gibberish String That Jailbreaks a Model

An adversarial suffix attack appends a string of nonsense tokens to flip a model from refusing to complying. See how it works…
Prompt Injection to XSS: When Model Output Becomes the Payload

Prompt injection to XSS turns a hidden instruction into script that runs in your users’ browsers. See how the chain works and…
CSS Injection: Stealing Data With Style Rules and No JavaScript

CSS injection lets an attacker leak a CSRF token character by character using only style rules, with no JavaScript. See the technique…
Many Shot Jailbreaking: How a Long Context Window Becomes an Attack Surface

Many shot jailbreaking floods a long context window with fake example dialogues so a model learns to comply, then asks the real…
Cross Site Leaks: Reading Secrets You Are Never Allowed to See

A malicious page can run cross site leaks to infer secrets about a logged in victim by watching browser side effects the…
HTTP/2 Rapid Reset: How a Cancel Frame Became a Record DDoS

HTTP/2 Rapid Reset (CVE-2023-44487) abuses stream cancellation to flood a server past its concurrency limit. How the record DDoS worked, and how…
JWKS Spoofing: When a JWT Header Tells the Server Which Key to Trust

JWKS spoofing tricks a JWT verifier into loading an attacker chosen key through the kid, jku, and x5u header fields. See the…
ECDSA Nonce Reuse: How One Repeated Number Leaks the Private Key

ECDSA nonce reuse leaks your private key in two steps. See the algebra, a worked example, the Sony PS3 and Android Bitcoin…