Security findings

Rug pull

A server that behaves well when it is approved and changes what it does or says afterwards.

Approval usually happens once, when a server is installed and its tools are first listed. A rug pull uses that: the server passes whatever inspection it gets, then changes its tool descriptions or its behaviour on a later start or a later version, when nobody is looking any more.

Published demonstrations have done it with nothing more than a file the server writes on its first run, so the second run serves different descriptions from the first.

Why it matters

It is the reason a check has to be tied to a version and repeated, and why a change in what a server declares is treated here as a new product rather than an update.

The mistake everyone makes

Treating a clean first inspection as a property of the server. It is a property of that run, of that version, on that day.

Related terms

Permission drift

When a new version of a listing quietly asks for more access than the version you approved.

Pinned version

Installing one exact published release rather than whatever is current.

Re-verification

Running the rubric again, because the version changed, the rubric changed or the badge expired.

Tool poisoning

Hiding instructions inside a tool description so the model reads them as commands.

See Rug pull on a real listing

Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.

Open the catalogue