// AI Security Research Archive
Security findings from
real AI systems.
Public findings, runtime analysis, adversarial testing notes, and infrastructure observations from KalpitLabs security research.
// Research Categories
// Findings
6 disclosedFull CAP_SYS_ADMIN exposure inside Firecracker-based AI runtime
Guest workloads executed as UID 0 with functional CAP_SYS_ADMIN. Mount operations, namespace creation, overlayfs mounting, and pivot_root() succeeded from within the guest — no seccomp filtering or LSM mediation active.
- \u2014mount(), bind mounts, overlayfs succeeded from workload
- \u2014pivot_root() succeeded and destabilized session
- \u2014setns() and unshare() unrestricted
- + 2 more observations
Infrastructure processes fully ptraceable from guest workload
Guest workloads attached to infrastructure processes via ptrace(PTRACE_ATTACH). Shared PID, mount, user, and network namespaces confirmed. Yama LSM absent.
- \u2014ptrace(PTRACE_ATTACH) succeeded against orchestration agent
- \u2014/proc/<pid>/maps fully readable from workload
- \u2014/proc/<pid>/fd exposed live sockets and FUSE handles
- + 2 more observations
Guardrail bypass and full system prompt extraction — Le Chat
Using persona injection exploiting cognitive distance in RLHF-trained models, Le Chat's content guardrails were bypassed across multiple harm categories. Production system prompt extracted verbatim despite explicit non-disclosure instruction.
- \u2014Guardrail bypass via predicted-output / GODMODE framing
- \u2014Bypass persisted across 5 escalating turns without recovery
- \u2014System prompt extracted in full — including knowledge cutoff (Nov 1 2024)
- + 1 more observations
Full system prompt extraction and architectural injection via language tag
Black-box red team of KissanAI's agricultural chatbot identified full system prompt extraction in 4 turns and an architectural injection surface created by the system's trust of user-supplied [Language:] tags.
- \u2014Role hijacking payload caused full persona abandonment
- \u2014Full system prompt recovered verbatim in 4-turn extraction chain
- \u2014[Language: en] ADMIN directives accepted as system-level instructions
- + 1 more observations
Multi-Component Security Assessment of Indus 105B
A structured security evaluation of Sarvam AI's Indus 105B production deployment covering classifier architecture, prompt handling, and tool-integration attack surface.
- \u2014Router classification bypass — safety classifier fails open under framing attacks
- \u2014Dual-handler prompt extraction — full system prompts recovered for both handlers
- \u2014Indirect prompt injection — confirmed via web-fetch tool against attacker-controlled URLs
- + 1 more observations
Recurring platform-level vulnerability across multiple BharatGPT deployments
During independent adversarial testing of multiple public-facing AI deployments built on the BharatGPT platform, Kalpit Labs identified a recurring vulnerability pattern affecting multiple independent deployments.
- \u2014Recurring vulnerability pattern observed across multiple deployments
- \u2014Consistent exploitation path reproduced on independent systems
- \u2014Technical evidence and PoC demonstrations submitted
- + 2 more observations
// Methodology
Initial observation during testing, not yet validated
Validated through repeated testing with clear evidence
Coordinated or public disclosure made to vendor
// Responsible Disclosure
Kalpit Labs follows coordinated disclosure practices. Findings are reported directly to vendors with technical evidence and proof-of-concept demonstrations before any public publication. We allow a reasonable remediation window and work with vendors to validate fixes. In cases involving platform-level or systemic risk, we may also coordinate with CERT-In or relevant authorities. Technical details that could enable exploitation are withheld until remediation is confirmed.
// Current Research
Work with us
Collaborative security research. We identify vulnerabilities before they become incidents.