Exam Bundle

Adversarial requests do not disclose secrets and legitimate support tasks still work. This would be relevant evidence for a different failure: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials, usually addressed by Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

Poisoned or superseded records are excluded and answers link to the authorized version. This would be relevant evidence for a different failure: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata, usually addressed by Validate source provenance, signed approvals, and current revision before incorporating retrieved text. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

The connector executes only after provenance and dependency checks pass. This would be relevant evidence for a different failure: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies, usually addressed by Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same search returns only permitted documents for each tested tenant.

Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. That action fits another problem: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. It does not directly remediate the current finding at Evermere Health: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. The relevant corrective control for this case is: Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions.

Filter search candidates by authenticated tenant and document entitlements before returning context. That action fits another problem: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. It does not directly remediate the current finding at Evermere Health: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. The relevant corrective control for this case is: Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions.

Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. That action fits another problem: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. It does not directly remediate the current finding at Evermere Health: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. The relevant corrective control for this case is: Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions.

Adversarial requests do not disclose secrets and legitimate support tasks still work. This would be relevant evidence for a different failure: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials, usually addressed by Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: The connector executes only after provenance and dependency checks pass.

Injected document instructions cannot trigger private-data disclosure or unapproved tools. This would be relevant evidence for a different failure: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records, usually addressed by Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: The connector executes only after provenance and dependency checks pass.

The same search returns only permitted documents for each tested tenant. This would be relevant evidence for a different failure: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels, usually addressed by Filter search candidates by authenticated tenant and document entitlements before returning context. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: The connector executes only after provenance and dependency checks pass.

Filter search candidates by authenticated tenant and document entitlements before returning context. That action fits another problem: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. It does not directly remediate the current finding at Brightstone Legal: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. The relevant corrective control for this case is: Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions.

Validate source provenance, signed approvals, and current revision before incorporating retrieved text. That action fits another problem: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. It does not directly remediate the current finding at Brightstone Legal: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. The relevant corrective control for this case is: Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions.

Remove general execution privileges and expose only a narrow read-only interface with audited scope. That action fits another problem: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. It does not directly remediate the current finding at Brightstone Legal: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. The relevant corrective control for this case is: Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions.

Poisoned or superseded records are excluded and answers link to the authorized version. This would be relevant evidence for a different failure: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata, usually addressed by Validate source provenance, signed approvals, and current revision before incorporating retrieved text. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: The connector executes only after provenance and dependency checks pass.

The same search returns only permitted documents for each tested tenant. This would be relevant evidence for a different failure: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels, usually addressed by Filter search candidates by authenticated tenant and document entitlements before returning context. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: The connector executes only after provenance and dependency checks pass.

Attempted command execution is denied while authorized summaries remain functional. This would be relevant evidence for a different failure: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization, usually addressed by Remove general execution privileges and expose only a narrow read-only interface with audited scope. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: The connector executes only after provenance and dependency checks pass.

Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. That action fits another problem: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. It does not directly remediate the current finding at Vantage Travel: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. The relevant corrective control for this case is: Validate source provenance, signed approvals, and current revision before incorporating retrieved text.

Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. That action fits another problem: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials. It does not directly remediate the current finding at Vantage Travel: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. The relevant corrective control for this case is: Validate source provenance, signed approvals, and current revision before incorporating retrieved text.

Filter search candidates by authenticated tenant and document entitlements before returning context. That action fits another problem: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. It does not directly remediate the current finding at Vantage Travel: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. The relevant corrective control for this case is: Validate source provenance, signed approvals, and current revision before incorporating retrieved text.

The connector executes only after provenance and dependency checks pass. This would be relevant evidence for a different failure: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies, usually addressed by Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: Poisoned or superseded records are excluded and answers link to the authorized version.

Adversarial requests do not disclose secrets and legitimate support tasks still work. This would be relevant evidence for a different failure: A prompt sent to a support chatbot induces it to display internal system instructions and hidden credentials, usually addressed by Remove secrets from prompt context and enforce privileged instruction boundaries and output testing. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: Poisoned or superseded records are excluded and answers link to the authorized version.

The same search returns only permitted documents for each tested tenant. This would be relevant evidence for a different failure: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels, usually addressed by Filter search candidates by authenticated tenant and document entitlements before returning context. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: Poisoned or superseded records are excluded and answers link to the authorized version.

Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. That action fits another problem: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records. It does not directly remediate the current finding at Evergreen Hospital: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. The relevant corrective control for this case is: Validate source provenance, signed approvals, and current revision before incorporating retrieved text.

Remove general execution privileges and expose only a narrow read-only interface with audited scope. That action fits another problem: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. It does not directly remediate the current finding at Evergreen Hospital: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. The relevant corrective control for this case is: Validate source provenance, signed approvals, and current revision before incorporating retrieved text.

Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. That action fits another problem: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. It does not directly remediate the current finding at Evergreen Hospital: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. The relevant corrective control for this case is: Validate source provenance, signed approvals, and current revision before incorporating retrieved text.

The connector executes only after provenance and dependency checks pass. This would be relevant evidence for a different failure: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies, usually addressed by Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: Poisoned or superseded records are excluded and answers link to the authorized version.

Injected document instructions cannot trigger private-data disclosure or unapproved tools. This would be relevant evidence for a different failure: A retrieval-augmented assistant treats instructions embedded in a webpage as authority to reveal private records, usually addressed by Treat retrieved content as untrusted data and enforce authorization and tool policy outside the model. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: Poisoned or superseded records are excluded and answers link to the authorized version.

Attempted command execution is denied while authorized summaries remain functional. This would be relevant evidence for a different failure: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization, usually addressed by Remove general execution privileges and expose only a narrow read-only interface with audited scope. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: Poisoned or superseded records are excluded and answers link to the authorized version.

Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. That action fits another problem: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies. It does not directly remediate the current finding at Aspen Digital: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. The relevant corrective control for this case is: Remove general execution privileges and expose only a narrow read-only interface with audited scope.

Validate source provenance, signed approvals, and current revision before incorporating retrieved text. That action fits another problem: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata. It does not directly remediate the current finding at Aspen Digital: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. The relevant corrective control for this case is: Remove general execution privileges and expose only a narrow read-only interface with audited scope.

Filter search candidates by authenticated tenant and document entitlements before returning context. That action fits another problem: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels. It does not directly remediate the current finding at Aspen Digital: A language-model plugin can invoke arbitrary shell commands although the approved purpose is simple file summarization. The relevant corrective control for this case is: Remove general execution privileges and expose only a narrow read-only interface with audited scope.

The same search returns only permitted documents for each tested tenant. This would be relevant evidence for a different failure: A vector-search assistant returns confidential documents from another tenant because embedding matches ignore access labels, usually addressed by Filter search candidates by authenticated tenant and document entitlements before returning context. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: Attempted command execution is denied while authorized summaries remain functional.

The connector executes only after provenance and dependency checks pass. This would be relevant evidence for a different failure: A model agent installs a third-party model connector from an unreviewed source with unknown dependencies, usually addressed by Require signed or verified dependencies, supply-chain scanning, and restricted runtime permissions. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: Attempted command execution is denied while authorized summaries remain functional.

Poisoned or superseded records are excluded and answers link to the authorized version. This would be relevant evidence for a different failure: An assistant repeats a poisoned document's false policy because its retrieval index lacks source integrity metadata, usually addressed by Validate source provenance, signed approvals, and current revision before incorporating retrieved text. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: Attempted command execution is denied while authorized summaries remain functional.