All items
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
12,081 items
This survey reviews threats to autonomous edge agents built on LLMs and SLMs in cyber-physical systems and IoT, organizing them across Perception, Cognition, Actuation and Collaboration layers. It finds that several attacks have been demonstrated on physical platforms, including jailbreaking a deployed commercial robot, while multi-agent attacks run only in simulation and software. It identifies three edge-induced threats that no surveyed edge-deployable runtime mechanism addresses: energy-targeted resource exhaustion, quantization-specific evasion, and model provenance against supply-chain weight poisoning.
CVE-2026-120338 (CVSS 10, critical) affects prefab-ui from 0.14.0 before 0.21.0. Its Generative UI sandbox runs caller-supplied Python in a Deno subprocess started with unrestricted --allow-read, --allow-write and --allow-net, and the Deno API remains reachable from Python through Pyodide's js module, letting callers read and write host files. The usual remote path is the generate_prefab_ui tool in FastMCP's GenerativeUI provider, which is exposed unauthenticated on servers with no authentication configured, and the flaw is reachable there.
Fix: Upgrade prefab-ui to 0.21.0 or later. The runner then revokes Deno filesystem read, filesystem write and network permission after startup and before it accepts generated code.
Beta9 workers before 0.1.756 run each tenant image build step with Buildah using BUILDAH_ISOLATION=chroot, without passing --isolation. This leaves the step sharing the worker pod's PID, network, IPC and user namespaces, running as uid 0 with CAP_DAC_OVERRIDE, so a tenant with any workspace token can reach the worker's filesystem through /proc/1/root in a single image build. The CVSS score is 9.9 (critical), and the issue was discovered by Natan Nehorai of the JFrog Security Research Team.
Parameter Labs found an attack chain against ChatGPT's artifacts feature, where HTML previews run in a sandboxed iframe. A sandboxed frame could call a postMessage() handler in the parent page, used by the MathLive library's virtual keyboard, that writes via innerHTML, letting it inject an unsandboxed iframe. Abusing a YouTube oEmbed endpoint allowed by CSP reflected JavaScript that executed, so a crafted ChatGPT share URL could exfiltrate another signed-in user's private data or act on their behalf. OpenAI closed the hole and paid a $5,000 bug bounty.
datasette-llm 0.1a9 now picks up the default model used by LLM, so Datasette Agent works without explicitly configuring a default model. Previously, users also had to set plugins.datasette-agent.default_model with the -s option.
OpenAI is seeking to raise up to $20 billion in a new funding round, down from an earlier target of up to $30 billion, according to CNBC. The round is still in progress and has not closed, and the Financial Times reported a $1.25 trillion post-money valuation target with investors from the United Arab Emirates leading alongside Coatue.
LearnHouse before 1.1.1 contains a missing authorization flaw in its assignment API, tracked as CVE-2026-120199. Authenticated users can supply another user_id to the submissions grade endpoint or query submission read functions, exposing other students' work, grades and instructor feedback.
Blockchain analytics firm Chainalysis disclosed a data breach after an external actor used "offensive agentic techniques" to access its internal systems and tools. Exposed customer data includes names, email addresses, user IDs, and organizational role labels, and the company says it found no evidence that investigation content, authentication credentials, or session tokens were accessed.
Chainalysis, an American blockchain analysis firm, said an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools this month. Non-sensitive customer data, including user IDs, full names, email addresses and organization role labels, was accessed, but investigation content, authentication credentials and session tokens were not.
A survey of 3,000 British singles by Match Group, owner of Tinder and Hinge, found that 39% had used AI in their dating lives. The article describes 27-year-old Sam from Stoke-on-Trent, who turned to Google Gemini after an ex mocked his appearance, and now uses AI for pep talks and to vet his messages.
Startups Dazzle, Duckbill and Wajo still use human workers to complete tasks that AI agents cannot reliably handle, such as phone calls, booking appointments and solving CAPTCHA tests. Dazzle routes certain tasks to human contractors, while Duckbill has released an API that lets companies building personal agents delegate tasks to human contract workers.
The VOLTA infostealer, surfaced by CAIRN research as VOLTA-AUTODOXER, is a self-deleting Windows infostealer that sends a structured evidence bundle on each victim to OpenRouter, using a hardcoded default model (anthropic/claude-opus-4.6) with fallbacks to moonshotai/kimi-k2 and google/gemini-2.5-flash. The model ranks the victim's monetizable assets and assesses their security posture, turning stolen credentials and sessions into a prioritized dossier.
A paper in Applied Soft Computing (Elsevier BV), published 2026-11-01 under DOI 10.1016/j.asoc.2026.116787, addresses prompt injection in LLM-driven hiring. The source text provided gives no further detail on the method or findings.
This research paper studies how prefill jailbreaks cause safety-aligned language models to continue an unsafe assistant prefix. Using the Jacobian lens, the authors track harmfulness and refusal signals through prefilling and generation, and identify refusal-state erosion, where the refusal signal declines to the benign baseline by the end of the prefill while the harmfulness signal stays above it. They introduce J-Anchor, a training-free inference-time defense that selectively restores weakened refusal in J-space, which substantially reduces attack success under fixed and deep prefill attacks across model families while largely preserving benign behavior.
Fix: J-Anchor: a training-free inference-time defense that uses the model's pre-attack harmfulness and refusal signals as a request-specific anchor and selectively restores weakened refusal in J-space during prefilling and decoding.
Arxiv (cs.CR + cs.CL + cs.LG)Fix: OpenAI closed the hole. No further mitigation is stated in source.
Simon Willison's WeblogResearchers report that visual-token compression in large vision-language models can unmask a hidden backdoor. The authors identify context stripping, where pruning removes clean visual tokens that otherwise suppress an embedded trigger. They propose StripWake, a projector-only backdoor that stays at 0.4% attack success rate under full-token inference on LLaVA-1.5-7B, yet reaches 94.0%-99.7% across five primary compressors without CIDEr loss.
This paper presents a use case for AppSec Core, a bounded application-security ontology, to make engineering-actionable requirements from scattered security authorities addressable as a typed working set. It shows two entry points: a forward path from a code change to its governing obligations, and an inverse path from a normative duty such as NIS2 to the engineering obligations it implies across domain slices.
Hush-Up is a stealthy availability attack against distributed LLM inference in which one malicious worker halts generation while evading attribution. The attacker profiles its local hardware error bound, then optimizes an adversarial perturbation on its output activations to maximize the end-of-sequence (EOS) token probability at the final layer. The authors report that the attack forces premature termination across diverse models and benchmarks and can evade or mislead existing verification defenses.
The paper introduces Pop Goes the Verifier, a data poisoning attack against VoicePop, a liveness detection technique in Automated Speaker Verification Systems that classifies low-frequency pop bursts from plosive phonemes using GFCC features and an SVM. The attack uses FastSpeech 2 with a modified HiFi-GAN vocoder to inject localized pop bursts at plosive locations, plus subtle Gaussian noise to reduce visibility. On ASVSpoof 2019, it achieves a moderate poisoning effect and resists signal-level inspection better than the prior SyntheticPop attack, which reduced accuracy to 14.01% with 20% poisoned samples but produced easily detectable artifacts.
The paper proposes Illusion, a proactive defense that conceals the communication topology of LLM multi-agent systems by injecting fake edges and fake messages. Low-impact candidates are chosen to preserve output-distribution equivalence and task accuracy. In experiments, edge-level F1 drops from over 0.87 to 0.62 and graph similarity from over 0.94 to 0.71, and the fake edges resist similarity-based and LLM-judge filtering, even under adaptive pruning.
Fix: The proposed mitigation is Illusion, a proactive topology obfuscation defense that injects fake edges and fake messages into LLM-MAS communication to present attackers with a deceptive topology.
Arxiv (cs.CR + cs.CL + cs.LG)Fix: Chainalysis advises customers to enable two-factor authentication (2FA) and to watch for unexpected password reset requests, authentication prompts, and scammers impersonating Chainalysis, particularly those offering fund recovery or recruiting services.
BleepingComputerFix: The company said it is patching vulnerabilities and hardening its systems in response to the incident.
The Hacker NewsThis survey, published in ACM Computing Surveys (Volume 59, Issue 1, pages 1-34, January 2027), reviews vulnerabilities and defenses in audio-visual attacks, spanning audio-only systems through multimodal models. The source text provided contains only the publication citation, so no further findings or methods are described.