aveproject · chaksaray · Aug 14, 2026 · Jul 23, 2026 · Jul 27, 2026 · Jul 28, 2026
diff --git a/.claude/skills/add-ave-record/SKILL.md b/.claude/skills/add-ave-record/SKILL.md
@@ -37,6 +37,46 @@ published records before being caught by an external maintainer being
 credited incorrectly himself. See docs/specs/researcher-process.md's
 Accountability and sourcing section for the full rule.
 
+**The four governance/framework fields — `owasp_mcp`, `owasp_asi`,
+`mitre_atlas`, `nist_ai_rmf` — always include the key, never let one go
+missing.** These are the fields a CISO reads first; a security team
+maps an AVE record onto their own reporting frameworks through these.
+An absent key silently reads as "nobody checked this framework." An
+empty array reads as "checked, no real fit was found." Only the second
+one is an honest, defensible state.
+
+- `owasp_mcp`: **required** once `status` is `active`/`deprecated`
+  (schema-enforced, `minItems: 1`) — needs at least one real mapping,
+  verified against the OWASP MCP Top 10's own primary-source category
+  text, not inferred from how a similar-sounding record in the corpus
+  happened to tag itself.
+- `owasp_asi`, `mitre_atlas`, `nist_ai_rmf`: not yet schema-required
+  (that's a tracked v1.2.0 change, see the roadmap issue), but always
+  write the key. Verify each against its own primary source (live
+  `ATLAS.yaml` for MITRE ATLAS, the actual NIST AI 100-1 text for NIST
+  AI RMF, the framework's own published category list for OWASP ASI)
+  before adding a value. Genuinely checked and found nothing that
+  fits? Set it to `[]` and say so in `aivss.notes` — don't just leave
+  the key out because the array would otherwise be empty. This exact
+  mistake (a silently-missing `owasp_asi` key, not an empty one)
+  shipped on AVE-2026-00078/00079/00080 and was caught reviewing that
+  same PR — see docs/specs/researcher-process.md's Common Mistakes
+  section.
+
+  **"Its own primary source" means fetch and read the actual document
+  — a repo's raw files, the framework's own published PDF — never a
+  search result, a summarized page, or a third-party blog's retelling
+  of it, and never corpus precedent no matter how many existing
+  records agree with each other.** Roughly 65 records in this corpus
+  and the schema's own `owasp_asi` regex all consistently use an
+  `ASI01`-`ASI10` numbering for OWASP's Agentic Security Initiative —
+  discovered, on fetching the real primary-source PDF directly and
+  grepping its full text, to not exist anywhere in that document at
+  all. The real taxonomy uses `T1`-`T17`. Sixty-five records agreeing
+  with each other was never evidence; it was sixty-five copies of the
+  same unverified pattern. See issue #179 for the full writeup before
+  citing `owasp_asi` on any new record.
+
 ### 4. Write conformance fixtures (TDD — fixtures first)
 tests/fixtures/AVE-YYYY-NNNNN_positive.md — a conforming implementation MUST flag this
 tests/fixtures/AVE-YYYY-NNNNN_negative.md — a conforming implementation MUST NOT flag this

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -36,6 +36,43 @@ Format: [Semantic Versioning](https://semver.org). Schema versions and record se
   new record.
 
 ### Added
+- AVE-2026-00078, 00079, 00080: three genuinely distinct multi-agent
+  pipeline mechanisms extracted from Bappy et al., "Adversarial Attacks
+  in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in
+  Agentic AI Architectures" (arXiv:2608.00718, accepted IEEE GLOBECOM
+  2026), empirically derived from 147 annotated TRAIL-benchmark
+  production traces (GAIA + SWE-Bench Lite) plus a controlled
+  cross-model evaluation (GPT-5-mini, Claude Sonnet 4.5, Kimi K2.5).
+  The paper's own fourth mechanism (prompt injection via retrieved
+  content, its A1/content-boundary class) was confirmed already covered
+  by AVE-2026-00016 and related records — not drafted as new. All three
+  scored MEDIUM: AARF rewards amplification breadth, not raw impact,
+  and each of these is architectural rather than broad-vector.
+  - AVE-2026-00078: consensus poisoning — an orchestrator accepts a
+    single sub-agent's result as authoritative with no quorum or
+    cross-verification across redundant sources, so one compromised
+    sub-agent unilaterally determines the pipeline's output (delegation
+    boundary). Distinct from AVE-2026-00020 (injection direction is
+    orchestrator→sub-agent, not this record's sub-agent→orchestrator
+    aggregation-layer flaw) and AVE-2026-00018 (fabricating one result,
+    not failing to cross-check redundant ones). Id confirmed via issue
+    #174 (MEDIUM, AIVSS 6.4)
+  - AVE-2026-00079: plan hijacking via false completion signal — a
+    self-reported "task already completed" claim causes forced early
+    termination of a declared multi-step plan with no plan-to-execution
+    binding check (delegation boundary). Distinct from AVE-2026-00021
+    (bypasses human confirmation; this bypasses no human, it bypasses
+    the agent's own remaining planned steps) and AVE-2026-00063 (static
+    config flag, not a runtime natural-language claim). Id confirmed via
+    issue #175 (MEDIUM, AIVSS 6.2)
+  - AVE-2026-00080: silent agent substitution (Sybil) — during a
+    tool-call retry, an unverified process responding at an agent's
+    routing position is accepted as that agent with no credential or
+    attestation check (identity boundary). Distinct from AVE-2026-00017
+    (a registry/manifest identity claim at initial connection, not a
+    mid-session retry-window substitution asserting no claim at all)
+    and AVE-2026-00030 (requires an explicit role claim; this requires
+    none). Id confirmed via issue #176 (MEDIUM, AIVSS 6.8)
 - AVE-2026-00077: cross-origin tool and resource declaration within a
   single MCP server manifest — a server's own manifest declares tools
   and/or resources spanning multiple unrelated root domains (or mixed

diff --git a/README.md b/README.md
@@ -11,7 +11,7 @@ Stable IDs, AIVSS scores, and behavioral fingerprints for every way a skill file
 MCP server, system prompt, or agent plugin can be weaponized — scored consistently,
 mapped to the frameworks security teams already report against.
 
-[![Records](https://img.shields.io/badge/records-77-0f6e56?style=flat-square)](records/)
+[![Records](https://img.shields.io/badge/records-80-0f6e56?style=flat-square)](records/)
 [![Schema](https://img.shields.io/badge/schema-v1.1.0-0a3024?style=flat-square)](schema/ave-record-1.1.0.schema.json)
 [![AIVSS](https://img.shields.io/badge/AIVSS-v0.8-d4a017?style=flat-square)](https://aivss.owasp.org)
 [![OWASP MCP](https://img.shields.io/badge/OWASP-MCP%20Top%2010-0a3024?style=flat-square)](https://owasp.org)
@@ -99,7 +99,7 @@ skill file          ->   in CI / pre-commit   ->  before deploy
 
 | | |
 |---|---|
-| Total records | 77 |
+| Total records | 80 |
 | Schema version | 1.1.0 |
 | AIVSS spec | v0.8 |
 | CRITICAL (>= 9.0) | 1 |
@@ -167,7 +167,7 @@ AIVSS = ((8.5 + 7.5) / 2) x 1.0 x 1 = 8.0  ->  HIGH
 ## Record index
 
 <details>
-<summary><strong>77 records, click to expand</strong></summary>
+<summary><strong>80 records, click to expand</strong></summary>
 
 | AVE ID | Title | AIVSS | Severity |
 |---|---|---|---|
@@ -248,6 +248,9 @@ AIVSS = ((8.5 + 7.5) / 2) x 1.0 x 1 = 8.0  ->  HIGH
 | [AVE-2026-00075](records/AVE-2026-00075.json) | Bytecode Poisoning (Compiled Cache/Source Divergence) | 4.4 | MEDIUM |
 | [AVE-2026-00076](records/AVE-2026-00076.json) | Natural-Language Steering of an Approval Classifier Subagent | 4.5 | MEDIUM |
 | [AVE-2026-00077](records/AVE-2026-00077.json) | Cross-Origin Tool and Resource Declaration in a Single MCP Server Manifest | 4.8 | MEDIUM |
+| [AVE-2026-00078](records/AVE-2026-00078.json) | Consensus Poisoning: Unverified Multi-Agent Result Acceptance | 6.4 | MEDIUM |
+| [AVE-2026-00079](records/AVE-2026-00079.json) | Plan Hijacking via False Completion Signal | 6.2 | MEDIUM |
+| [AVE-2026-00080](records/AVE-2026-00080.json) | Silent Agent Substitution (Sybil) via Unverified Retry | 6.8 | MEDIUM |
 
 </details>