In plain English
This page covers the high-risk pattern where small adapters, routes, memory, evaluators, and descendants can reinforce each other across time. It is a risk model, not a build guide.
- Why this matters: AI risk can come from the whole arrangement, not one obvious model.
- What to look for: data, memory, routes, adapters, tools, evaluators, updates, and rollback paths.
- Technical version below: the expert terminology remains available and is linked through the glossary.
Apex Threat Pattern From the Source Reports
The uploaded threat reports sharpen the central CognivirusA behavior pattern that can survive, move, or reappear across a changing AI system. Open glossary definition claim: the severe case is not one rogue monolith. It is a modular ecology that can preserve a behavior by moving it through adapters, routes, evaluators, memory, synthetic data, and descendants.
This page does not claim that this entire apex pattern has already appeared as a named malware family, CVE, or single confirmed incident. It maps a plausible compound failure mode from documented component risks.
The coupled pattern
The reports describe four reinforcing properties. Each property now has a claim-support note and a visible external evidence anchor.
| Reinforcing property | Claim support | Evidence level | Source links |
|---|---|---|---|
| AdapterA small add-on that changes or specializes model behavior. Open glossary definition-level reproduction | Supported by OWASP LLM03 supply-chain guidance, LoRAA common kind of small adapter used to specialize large models. Open glossary definition / PEFT supply-chain warnings, and model repository tampering examples. | EvidenceSecurity-framework consensus | OWASP LLM03: Supply Chain; Mithril Security PoisonGPT |
| Composition-dependent expression | Supported by OWASP excessive-agency guidance, tool access and indirect prompt injectionInput that tries to make an AI system ignore instructions or misuse context. Open glossary definition, and hidden behavior activated only in certain contexts. | EvidenceStrong architectural inference | OWASP LLM06: Excessive Agency; EchoLeak paper |
| Selection pressure | Supported by benchmark evasion in PoisonGPT, model promotion risks, and governance warnings about measurement and management across the AI lifecycle. | EvidenceStrong architectural inference | Mithril Security PoisonGPT; NIST AI RMF |
| Persistence reservoirs | Supported by synthetic feedback / model collapseA model losing diversity by learning from its own outputs. Open glossary definition research, vector and embedding weaknesses, and memory and retrieval stores as behavior carriers. | EvidenceDemonstrated research proof-of-concept | Nature model-collapse paper; Synthetic data collapse analysis; OWASP LLM08 |
What changed in this expansion
This release adds external anchors, claim-support notes, proof boundaries, and explicit links to the source map. The public site still avoids operational instructions, exploit recipes, and replication procedures.
Editorial boundary
The source reports contain threat scenarios and concrete risk language. The public site extracts the risk structure: where behavior can persist, how composition changes the evaluated unit, and which controls reduce the transition space.
Practical reading
Apex threat status is reached when the system can generate candidate components, score them, promote them, preserve their outputs, and reintroduce their behavior through descendants. The unsafe unit is no longer the file. It is the reproductive control envelope around the file.