Vulnerabilities we found in real AI agents

How we disclose. TrustShell publishes its findings openly — this page is the disclosure. We're an independent researcher, not affiliated with any vendor, and we don't do private pre-notification; publishing here is how we inform users and defenders. We still don't hand out a weaponized exploit (the finding and the fix, not a copy-paste payload), and we hold our own findings to the same bar — if a claim doesn't reproduce, we retract it in public. Confirmed, refuted, or corrected: the exploit is the arbiter, not a vote.