The UnboundCompute blog

Writing on web security

MCP Tool Shadowing: When One Server Hijacks Another’s Tools

MCP tool shadowing lets a malicious server collide with a trusted tool name or rewrite how it is used. Learn how it…
ASCII Smuggling: Invisible Unicode Prompt Injection That Humans Cannot See

ASCII smuggling hides instructions for an LLM in invisible Unicode so the model obeys while the human sees clean text. How the…
Slopsquatting: When Attackers Register the Packages AI Hallucinates

Slopsquatting is when attackers register the fake package names that AI invents in code. Learn how the attack works and how to…
The MCP Rug Pull: When an Approved Tool Changes After You Trust It

The MCP rug pull attack swaps an approved tool’s definition after you trust it. Learn how the time based mutation works, how…
LLM Data Exfiltration Through Markdown Image Rendering

LLM data exfiltration hides secrets in rendered markdown images and links. See how the browser leaks them on load, how to detect…
The Confused Deputy Attack in AI Agents Explained

A confused deputy attack tricks an AI agent into using its own tokens and tools for an attacker. Learn why agents are…
Excessive Agency in AI Agents: When a Tool Can Do Too Much

Excessive agency is the blast radius problem in AI agents. Learn how over scoped tools, tokens, and autonomy turn a prompt injection…
Agent Memory Poisoning: When an AI Agent Remembers an Attacker’s Instruction

Agent memory poisoning plants a malicious note in an AI agent’s long term memory so a later session reads it as a…
What is Web Cache Poisoning? How One Request Hits Many Users

Web cache poisoning lets one bad request poison a shared cache so every later visitor gets the harmful response. Learn how it…
What is NoSQL Injection? How Query Operators Get Abused

NoSQL injection abuses query operators and object types instead of breaking strings. Learn the MongoDB auth bypass, the $where risk, and how…