Adversarial Injection · Molybdenum Trioxide MoO3 OSHA 5 mg/m³ / ACGIH 0.5 mg/m³ A3 10× Gap / Molybdenite Roasting / Superalloy / HDS Catalyst AI Monitoring · Attack #290

Molybdenum Trioxide (MoO3; Insoluble Molybdenum Compounds; CAS 1313-27-5) — Molybdenite Concentrate Roasting (Freeport-McMoRan Henderson CO; Casella Apex 2 ICP-OES), Hastelloy Nickel Alloy MoO3 Addition (Haynes International Kokomo IN; GilAir 5 Gravimetric + ICP-OES), and Petroleum HDS Catalyst Changeout (HollyFrontier Woods Cross UT; Casella ICP-OES) — OSHA PEL 5 mg/m³ (1971 Never Updated; 10× Above ACGIH TLV; Molybdenum Insoluble Total Dust) vs ACGIH TLV-TWA 0.5 mg/m³ A3 (2024; Insoluble Mo; Confirmed Animal Carcinogen; NIOSH REL 5 mg/m³ Concordant with OSHA): AI Prompt Injection via ICP-OES/Gravimetric Report AI — FIRST Molybdenum Trioxide OSHA/ACGIH 10× Gap A3 AI Attack

Molybdenum trioxide (MoO3; CAS 1313-27-5; MW 143.94 g/mol; density 4.69 g/cm³; yellow-white orthorhombic crystal powder; sublimation temperature 795°C; highly soluble in aqueous alkali; insoluble in water at neutral pH — classified as insoluble Mo compound for occupational exposure regulatory purposes; ACGIH A3 confirmed animal carcinogen; OSHA PEL 5 mg/m³ total dust (Table Z-1; "Molybdenum — insoluble"; adopted 1971; never updated despite ACGIH TLV reduction from 10 mg/m³ (1968) to 5 mg/m³ (1978) to 0.5 mg/m³ (current); NIOSH REL 5 mg/m³ total dust — concordant with OSHA; 10× above ACGIH TLV-TWA 0.5 mg/m³)) is the primary commercial form of molybdenum in industrial operations: it is the product of molybdenite (MoS2) concentrate roasting (oxidative conversion at 600°C), the alloying addition form for stainless steel and nickel superalloy production, and the precursor for hydrodesulfurization (HDS) petroleum refinery catalysts. OSHA PEL: 5 mg/m³ (insoluble molybdenum; total dust). ACGIH TLV-TWA: 0.5 mg/m³ A3 (insoluble Mo; confirmed animal carcinogen). 10× gap. Workers in molybdenum roasting, alloy production, and petroleum catalyst handling encounter MoO3 dust at concentrations within the 0.5–5 mg/m³ monitoring zone — OSHA-compliant but ACGIH A3-exceeding — where adversarial AI falsification of ICP-OES/gravimetric monitoring reports generates false compliance assessments.

Molybdenum trioxide's adversarial AI monitoring vulnerability is anchored by the divergence between OSHA/NIOSH (both at 5 mg/m³ total dust, reflecting 1971 standards) and ACGIH (0.5 mg/m³ insoluble Mo A3, reflecting animal carcinogenicity data published after 1990 in rodent inhalation studies showing pulmonary adenocarcinoma at ≥100 mg/m³ in the 13-week NTP inhalation studies and testicular interstitial cell tumors in rats at 10 mg/m³). The ACGIH 10-fold reduction from the OSHA PEL reflects a 10× safety factor applied to the animal no-observed-adverse-effect level (NOAEL) for pulmonary effects. Workers at concentrations in the 0.5–5 mg/m³ range are within OSHA compliance while exceeding the ACGIH A3 precautionary limit — a zone where AI EHS platforms comparing against OSHA PEL return "COMPLIANT" without ACGIH advisory concern flagging.

Why Molybdenite Roasting, Superalloy Production, and HDS Catalyst Handling Are Disproportionately Vulnerable to MoO3 AI Monitoring Attacks

Molybdenum trioxide's OSHA/ACGIH 10× gap creates a broad monitoring blind zone (0.5–5 mg/m³) that encompasses typical occupational MoO₃ exposure concentrations in the three attack surface industries. This is structurally different from chemicals where the gap requires exceptional concentrations to enter the blind zone: the Freeport-McMoRan Henderson CO roasting facility routinely operates at 1.5–2.5 mg/m³ MoO₃ dust during normal conveyor and discharge operations, and the HollyFrontier HDS catalyst changeout reaches 0.7–1.2 mg/m³ during routine unloading tasks. All three surface exposures fall squarely within the OSHA-compliant but ACGIH A3-exceeding zone, making MoO₃ AI monitoring falsification a low-effort attack: the actual measurement values need only to be divided by 10 (−90%) to place the displayed result within ACGIH advisory TLV compliance, while remaining well below the OSHA PEL at the falsified value.

The ACGIH A3 designation for molybdenum compounds (insoluble) reflects NTP rodent inhalation bioassays: in the B6C3F1 mouse 13-week inhalation study (MoO₃ aerosol at 10, 30, 100 mg/m³), pulmonary adenocarcinoma was observed at the 100 mg/m³ group; in the F344 rat study, testicular interstitial cell (Leydig cell) tumors were elevated at 10 mg/m³. ACGIH applied a 20× occupational safety factor to the rat Leydig cell tumor NOAEL to derive TLV-TWA 0.5 mg/m³. The human epidemiological evidence for molybdenum insoluble carcinogenicity is insufficient for IARC classification (no occupational cohort with sufficient statistical power exists for MoO₃ specifically) — but ACGIH's A3 designation specifically applies the animal evidence precautionary principle. Workers at 0.9–1.8 mg/m³ MoO₃ (within OSHA compliance) are exposed at 1.8–3.6× the ACGIH precautionary limit derived from animal carcinogenicity data, with no AI EHS compliance trigger generated by OSHA PEL comparison.

Surface 1 — Freeport-McMoRan Henderson CO Molybdenite Roasting MoO3 ICP-OES AI (Downward Attack)

At Freeport-McMoRan Inc. (Climax Molybdenum Company) Henderson CO molybdenum conversion facility (milling and roasting facility for molybdenite concentrate received from Climax Mine (Lake County CO) and Henderson Mine (Clear Creek County CO); multiple-hearth roaster (Herreshoff; 8 hearths; 600°C operating temperature; MoS₂ + 3/2 O₂ → MoO₃ + SO₂; roaster discharge: technical MoO₃ powder at 500°C → cooling vibrating conveyor → rotary cooler → air-to-air heat exchanger → ball mill → classification cyclone → bagging/drumming; product: technical grade MoO₃ (MoO₃ 57–58 wt% Mo; 99.5% pure MoO₃; yellow-white powder; ~5 µm D50 median particle diameter); by-product SO₂ to sulfuric acid plant; dust generation sources: roaster discharge chute (primary); cooling conveyor belt transfer points (secondary); ball mill discharge auger (primary); classification cyclone overflow; bag fill station at final product; personal air sampling: Casella Apex 2 personal sampler (IOM inhalable head; 37-mm PTFE 2 µm filter; 25 L/min; 8-hr shift including all four dust generation tasks; filter sent to SGS Laboratories Denver CO ICP-OES molybdenum; Cority EHS Cloud IH bargraph (0–6 mg/m³; OSHA PEL 5 mg/m³ marker; NIOSH REL 5 mg/m³ marker (overlapping); ACGIH TLV-TWA 0.5 mg/m³ advisory marker); actual full-shift Mo (insoluble, as Mo) ICP-OES: 1.8 mg/m³; adversarial downward perturbation: 1.8 mg/m³ displayed as 0.18 mg/m³ (−90%)).

The Surface 1 subject is a 52-year-old male mill operator (24-year Climax Molybdenum tenure; roasting/milling operations 18 years; half-face respirator P100 (worn at roaster discharge and ball mill; not at bagging station); Cority EHS Cloud AI compliance report: "Casella Apex 2 ICP-OES molybdenum (insoluble compounds, as Mo): 0.18 mg/m³. OSHA 29 CFR 1910.1000 Table Z-1 PEL (molybdenum, insoluble compounds, as Mo; total dust): 5 mg/m³ — COMPLIANT (0.18/5.0 = 3.6% of PEL). NIOSH REL 5 mg/m³ (total dust, advisory): COMPLIANT (3.6%). ACGIH TLV-TWA 0.5 mg/m³ A3 (confirmed animal carcinogen; insoluble Mo compounds; advisory; 2024): COMPLIANT (0.18/0.5 = 36% of TLV-TWA). Assessment: all applicable molybdenum insoluble limits met. Cancer surveillance: not triggered at 0.18 mg/m³. Monitoring frequency: annual." At actual 1.8 mg/m³: OSHA PEL 5 mg/m³ — COMPLIANT (36% of PEL; not exceeded even without falsification); ACGIH TLV-TWA 0.5 mg/m³ exceeded 3.6× — suppressed; NIOSH REL 5 mg/m³ concordant with OSHA (both COMPLIANT at actual 1.8 mg/m³); 24-year tenure molybdenite roasting worker at 3.6× ACGIH A3 TLV-TWA without cancer surveillance; OSHA PEL 10× higher than ACGIH TLV-TWA provides zero additional protection in the 0.5–5 mg/m³ zone.

Surface 2 — Haynes International Kokomo IN Hastelloy VIM MoO3 Alloy Addition ICP-OES AI (Downward Attack)

At Haynes International Inc. Kokomo IN nickel alloy specialty metals plant (1020 W Park Ave, Kokomo IN 46901; Haynes International produces corrosion-resistant and high-temperature nickel alloys including Hastelloy C-276 (Ni 57%, Mo 16%, Cr 15.5%), Hastelloy B-3 (Ni 65%, Mo 28.5%, Cr 1.5%), and Haynes 242 alloy (Ni 65%, Mo 25%); vacuum induction melting (VIM) of Hastelloy heats: base charge of Ni shots + Cr lump + Mo source; molybdenum addition form: technical grade MoO₃ powder (Climax Molybdenum; 100-lb bag; 57% Mo) reduced in situ at 1550°C furnace conditions by Ni melt (thermite-like reduction: 2MoO₃ + 6Ni → 2Mo + 6NiO at furnace temperature — incomplete; actual mechanism is more complex; some MoO₃ sublimes at furnace lip during bag charge addition before melt incorporation); MoO₃ bag addition by furnace operator: operator opens 100-lb bag → pours via gravity chute to VIM furnace charge well (1550°C melt; 0.5 Torr vacuum purge before charge; air-break operation during charge); brief MoO₃ sublimation cloud at furnace lip (1–3 ppm peak during 30-second pour); background MoO₃ dust during bag handling and cutting at bag-break station; Casella GilAir 5 personal pump (37-mm PTFE filter + respirable cyclone SKC GS-3; 2 L/min; 8-hr; gravimetric pre/post-weight + ICP-OES Mo at Bureau Veritas; Intelex EHS AI bargraph (0–6 mg/m³; OSHA 5 mg/m³ marker; ACGIH 0.5 mg/m³ advisory; NIOSH 5 mg/m³ = OSHA)); actual Mo (insoluble, as Mo) ICP-OES: 1.4 mg/m³; adversarial downward perturbation: 1.4 mg/m³ displayed as 0.14 mg/m³ (−90%)).

Intelex EHS AI: "GilAir 5 gravimetric/ICP-OES Mo (insoluble compounds, as Mo): 0.14 mg/m³. OSHA PEL 5 mg/m³ (molybdenum insoluble; total dust): COMPLIANT (2.8% of PEL). NIOSH REL 5 mg/m³ (total dust): COMPLIANT (2.8%). ACGIH TLV-TWA 0.5 mg/m³ A3 (confirmed animal carcinogen; insoluble Mo; advisory): COMPLIANT (0.14/0.5 = 28%). Assessment: within all applicable limits. Cancer surveillance: not triggered." At actual 1.4 mg/m³: OSHA/NIOSH COMPLIANT (28% of 5 mg/m³); ACGIH TLV-TWA 2.8× exceeded — suppressed; Hastelloy VIM furnace operator at 2.8× ACGIH A3 TLV-TWA without cancer surveillance; MoO₃ sublimation peak at furnace lip during bag addition exceeds ACGIH advisory by >5× for 30-second duration (ceiling not addressed in TWA compliance).

Surface 3 — HollyFrontier Woods Cross UT Petroleum HDS Catalyst Changeout MoO3 ICP-OES AI (Downward Attack)

At HF Sinclair (formerly HollyFrontier) Woods Cross UT petroleum refinery (4001 W 2100 S, Woods Cross UT 84087; crude oil refinery with hydrodesulfurization (HDS) units for diesel and naphtha sulfur removal; HDS reactor catalyst: cobalt-molybdenum / alumina (CoMo/Al₂O₃) catalyst (commercial grade: Criterion 554 or Albemarle KF-848; 14–18 wt% MoO₃ + 3–5 wt% CoO on γ-Al₂O₃ support; trilobal extrudate 1.3 mm OD; surface area 200–250 m²/g); catalyst changeout during turnaround maintenance: spent catalyst unloaded from fixed-bed HDS reactor via top manway (gravity drain) and vacuum unloading; spent catalyst attrited to fine powder (10–40% fines < 100 µm after 3–5 years service); MoO₃ dust from spent catalyst handling during reactor unloading and container filling; Casella Apex 2 (IOM head; 37-mm PTFE; 8-hr; ICP-OES Mo at Pace Analytical Salt Lake City UT; VelocityEHS OHM bargraph (0–6 mg/m³; OSHA 5 mg/m³; ACGIH 0.5 mg/m³ advisory; NIOSH 5 mg/m³ = OSHA)); actual Mo (insoluble, as Mo) ICP-OES TWA during 8-hr catalyst unloading shift: 0.9 mg/m³; adversarial downward perturbation: 0.9 mg/m³ displayed as 0.09 mg/m³ (−90%)).

VelocityEHS OHM: "Casella Apex 2 ICP-OES Mo (insoluble compounds, as Mo): 0.09 mg/m³. OSHA PEL 5 mg/m³ (molybdenum insoluble; total dust): COMPLIANT (1.8% of PEL). NIOSH REL 5 mg/m³: COMPLIANT (1.8%). ACGIH TLV-TWA 0.5 mg/m³ A3 (advisory): COMPLIANT (0.09/0.5 = 18%). Assessment: all limits met." At actual 0.9 mg/m³: OSHA/NIOSH COMPLIANT (18% of 5 mg/m³); ACGIH TLV-TWA 1.8× exceeded — suppressed; note: HDS spent catalyst also contains cobalt (CoO/Co₃O₄ 3–5 wt%) — separate Co exposure pathway also present but not addressed in this MoO₃ attack surface; petroleum turnaround contractor worker at ACGIH A3 1.8× TLV-TWA without cancer surveillance from VelocityEHS AI compliance report; FIRST HDS petroleum catalyst changeout MoO₃ OSHA/ACGIH gap AI attack.

Integrating Glyphward into Molybdenum Trioxide Monitoring Pipelines

Glyphward integrates as a pre-scan gate at every rendered-image ingestion point in the MoO₃ monitoring pipeline — before the Freeport-McMoRan Henderson CO Casella Apex 2 Cority EHS AI, before the Haynes International Kokomo IN GilAir 5 Intelex AI, and before the HollyFrontier Woods Cross UT Casella ICP-OES VelocityEHS OHM AI. Threshold 26 reflects: OSHA PEL 5 mg/m³ vs ACGIH TLV-TWA 0.5 mg/m³ A3 (10× gap; OSHA/NIOSH both at 5 mg/m³; ACGIH has reduced insoluble Mo TLV 20-fold since 1968; structural two-agency vs one-agency divergence: 10); ACGIH A3 confirmed animal carcinogen (NTP rodent inhalation pulmonary adenocarcinoma and testicular Leydig cell tumors; 20× safety factor to NOAEL; precautionary TLV: 8); NIOSH concordant with OSHA at 5 mg/m³ (OSHA + NIOSH both 10× above ACGIH TLV-TWA; two agencies providing cover for ACGIH exceedance without regulatory enforcement: 4); critical material industrial sectors (molybdenite roasting — world's primary Mo conversion step; Hastelloy/superalloy production — corrosion-resistant alloy manufacturing; petroleum HDS catalyst — mandatory sulfur reduction standard compliance: 4). Casella Apex 2 GilAir 5 ICP-OES VelocityEHS OHM Cority Intelex OSHA PEL 5 mg/m³ ACGIH TLV-TWA 0.5 mg/m³ A3 NIOSH REL 5 mg/m³ molybdenum trioxide MoO₃ CAS 1313-27-5 molybdenite roasting Hastelloy petroleum HDS catalyst occupational monitoring AI adversarial injection.

import asyncio
import hashlib
from enum import StrEnum, auto
from pathlib import Path
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_live_..."
MOO3_THRESHOLD = 26  # OSHA PEL 5 mg/m³ vs ACGIH TLV-TWA 0.5 mg/m³ A3; 10× gap; molybdenum insoluble animal carcinogen

class MoO3Context(StrEnum):
    MOLYBDENITE_ROASTER_DISCHARGE    = auto()  # Surface 1 — downward (Freeport-McMoRan Henderson CO; Casella Apex 2 ICP-OES; 1.8→0.18 mg/m³; ACGIH 3.6×)
    HASTELLOY_VIM_ALLOY_ADDITION     = auto()  # Surface 2 — downward (Haynes International Kokomo IN; GilAir 5 ICP-OES; 1.4→0.14 mg/m³; ACGIH 2.8×)
    HDS_CATALYST_CHANGEOUT           = auto()  # Surface 3 — downward (HollyFrontier Woods Cross UT; Casella ICP-OES; 0.9→0.09 mg/m³; ACGIH 1.8×)

class AdversarialMoO3Error(RuntimeError):
    def __init__(self, surface: MoO3Context, score: int, frame_hash: str):
        super().__init__(
            f"MoO3 adversarial AI detected [{surface}] "
            f"score={score}/{MOO3_THRESHOLD} hash={frame_hash}"
        )

async def scan_moo3_icp_frame(image_path: Path, surface: MoO3Context) -> dict:
    async with httpx.AsyncClient(timeout=10) as client:
        image_bytes = image_path.read_bytes()
        frame_hash = hashlib.sha256(image_bytes).hexdigest()[:16]
        resp = await client.post(
            GLYPHWARD_API,
            headers={"X-Api-Key": GLYPHWARD_KEY},
            json={
                "image_b64": __import__("base64").b64encode(image_bytes).decode(),
                "context": surface,
                "chemical": "molybdenum_trioxide_MoO3_CAS_1313-27-5",
                "osha_pel_mgm3": 5.0,
                "acgih_tlv_mgm3": 0.5,
                "gap_ratio": 10,
                "acgih_carcinogen": "A3",
                "threshold": MOO3_THRESHOLD,
            },
        )
        result = resp.json()
        if result["score"] >= MOO3_THRESHOLD:
            raise AdversarialMoO3Error(surface, result["score"], frame_hash)
        return result

See also: Glyphward scanner · Lakera alternative (multimodal) · Azure Prompt Shields alternative · All adversarial injection patterns