Case studies
Public incidents keep proving the same throughline: coding agents often had more standing access than the task needed, and nothing caught misuse in the moment. Relay’s job is that moment—Control rules before side effects, Behavior Guards for session patterns, and audit afterward.
These pages are hypothetical control mappings, not claims that Exemplar was deployed in the cited incidents. Facts are drawn from press and vendor reports aggregated in awesome-ai-agent-attacks .
Flagship studies
Start here—two clear “wipe / ignore stop” stories that map cleanly to Control + Guards:
More threat patterns
Additional mappings for MCP auto-load, prompt injection, and shell-bypass classes:
How to read a study
- What happened — short public narrative
- Without Relay — why chat tips alone were not enough
- With Relay — which Control rules and Guards would interrupt the path
- Prove — what audit / Live wire would show in a retro
| Failure class | Primary Relay surface |
|---|---|
| Agent wiped prod / backups | Bash · Destructive Burst |
| Agent ignored stop under pressure | Compact Thrash · Soft ask on destructive tools |
| Silent / over-broad MCP | MCP · Path |
| Prompt injection → shell | Prompt · Bash |
| Privilege / secrets streak | Privilege Streak |
Tracker: awesome-ai-agent-attacks . Related: Getting started, Control rules, Behavior Guards.
Last updated on