Research

Technical writing from our assessment work on autonomous systems: how authority flows through AI agents, tools, identities, and smart-contract control planes, and what an adversary can do with it. Methodology and the artifacts we hand over, plus security findings from independent research against real open-source AI software.

Atom feed

Featured

Agent Security19 min read

From Attack Success Rate to Agent Consequence Profile

What should an AI agent security assessment actually measure?

Attack success rate measures whether an agent can be manipulated. It does not describe what a deployed system lets the attacker cause once it is. This article proposes the Agent Consequence Profile, a deployment-level artifact that follows authority from the adversary's starting position through tools, memory, and enforcement points, and separates demonstrated, inferred, blocked, and untested claims.

Duc C. NguyenRead the article →

Research and methodology

Technical work explaining how Themis measures and reasons about the security of autonomous systems.

  1. Reading Authority Backwards

    Quantifying the failure modes of automated control-plane measurement in EVM DeFi

    Duc C. Nguyen3 min read

    Control-Plane Measurement
  2. From Attack Success Rate to Agent Consequence Profile

    What should an AI agent security assessment actually measure?

    Duc C. Nguyen19 min read

    Agent Security

Real-world security findings

Security failures we found while evaluating real, widely adopted open-source AI and agent software. This is independent security research against public projects, not customer work, and the affected projects are not Themis customers. Several are still under coordinated disclosure, so we describe each failure and its consequence without publishing details that would locate an unpatched instance. Each finding states the affected project's public GitHub adoption, from a multi-agent framework with 9k stars to platforms above 150k stars, measured September 2026.

  1. Agent tool abuse could cross a local-data boundary

    The problem was not prompt injection itself, but what the influenced agent was authorized to do

    Duc C. Nguyen3 min read

    Security Finding
  2. Execution control bypass in an extensible AI platform

    An in-process denylist failed to contain the runtime it was intended to restrict

    Duc C. Nguyen3 min read

    Security Finding
  3. Server-side request forgery in an AI workflow platform

    A user-controlled model endpoint inherited the server's network reach

    Duc C. Nguyen3 min read

    Security Finding