AI Sec Watch

This week's cybersecurity news covers multiple incidents including breaches at telecom and retail companies, a German manufacturer forced into bankruptcy after a six-week cyberattack shutdown, and the discovery of CrashStealer, a new macOS malware (malicious software) that disguises itself as a crash reporting tool to steal user credentials and system data. Additional threats include Iranian actors using cellular and advertising data to track US military phones, and a vulnerability in an AI agent integrated with WhatsApp that allows remote code execution (running commands on a system from afar).

Vision-Language Pre-training Models (VLPMs, which are AI systems trained to understand both images and text together) are vulnerable to adversarial attacks (input tricks designed to fool AI systems). This research shows that simpler attack methods can actually work better than complicated ones, and proposes SimVLA (Simple Vision-Language Attack), a streamlined approach that improves how well attacks transfer between different models while using less computing power.

Researchers discovered a new backdoor attack called Spa that can secretly compromise federated learning systems (distributed AI systems where multiple parties train a model together while keeping their data private). Unlike previous attacks, Spa hides malicious code by blending it with the legitimate learning process and uses adaptive triggers that change over time to avoid detection and remain effective for hundreds of training rounds.

Vision Language Models (VLMs, which are AIs that process both images and text) are vulnerable to jailbreak attacks (techniques that trick an AI into ignoring its safety guidelines). Existing defenses either reduce the model's usefulness or slow it down significantly. SafeSteer is a proposed defense method that uses singular value decomposition (SVD, a mathematical technique for breaking down data into simpler components) at inference time (when the model is running, without changing its internal weights) to identify and remove harmful instructions while keeping the model's normal abilities intact, achieving over 60% reduction in attack success rates with minimal slowdown.

This research addresses a weakness in malicious JavaScript detection systems: they fail to reliably identify harmful code when it has been obfuscated (disguised through code transformation techniques to hide its true purpose). The authors propose SeGra, a new detection method that uses data flow features (how data moves through the program) and random walk techniques to better identify malicious JavaScript even in obfuscated code, achieving up to 99.5% accuracy on lightly obfuscated code and 67.1% on heavily obfuscated code.

Deep learning models that classify point clouds (3D data made of many points in space) are vulnerable to adversarial attacks (carefully crafted inputs designed to fool AI systems). This paper proposes PANDA, a two-stage defense that uses diffusion models (neural networks that gradually transform noisy data into clean data) to purify attacked data and then retrains the classifier to work well with the purified data, addressing limitations in existing diffusion-based defenses.

This podcast features an interview about agentic AI (AI systems that can autonomously plan and execute tasks) and governance challenges in cybersecurity. The discussion includes the MindStone Agent, an open-source project that adds persistent memory and identity to AI assistants, and demonstrates how autonomous AI agents can coordinate incident response (the process of identifying and fixing security breaches) and recovery with minimal human oversight.

Google Cloud has built an agentic defense platform (a system that uses AI agents to automatically handle security tasks) that incorporates technology from Wiz to detect and fix threats from AI-based attacks. The approach aims to automate both finding and responding to threats faster than attackers can operate.

The European Commission ordered Google to give rival AI assistants the same access to Android device features that Google's own Gemini assistant has, including the camera, microphone, screen contents, and the ability to control other apps in the background. Google must implement this by August 1, 2027, in Android 18, with some features (like always-on voice detection) delayed to Android 19 by August 1, 2028. The order also requires Google to share anonymized search data with competing search engines and AI chatbots for a cost-based fee.