Browse All

This article discusses 'software brain,' a way of thinking that sees everything through algorithms and automation, which has been amplified by AI development. Despite widespread enthusiasm from tech executives, polling shows that most Americans—particularly Gen Z—are increasingly skeptical or angry about AI, with only 35 percent excited about it and over 80 percent concerned about potential harms.

This paper presents MCCENet, a deep learning system that improves biometric authentication by combining two types of palm data: palm vein patterns and palm shape. The system uses hierarchical feature fusion (a technique that exchanges information between different data types at early processing layers) and multimodal contrastive learning (a training method that helps the AI learn similar representations for related data from different sources) to better recognize individuals, achieving better accuracy than previous methods tested across eight public datasets.

Honeywords are fake passwords (decoys) stored alongside real passwords to detect when password databases are leaked. This research reveals critical security flaws in honeyword schemes that generate decoys by sampling from actual user passwords (internal sampling), showing that attackers can distinguish real passwords from decoys with success rates of 3.82%–44.8% depending on their capabilities, which exceeds the intended security target of 2.50%.

Random prime number generators are essential for encryption and security protocols, but their output can become flawed and needs constant checking. This paper describes a machine learning approach that can validate quantum random number generators (QRNGs, devices that use quantum physics to create truly random numbers) by learning patterns in the prime numbers they produce and detecting when the output becomes biased (skewed toward certain values). The researchers tested their framework on both a quantum-based prime generator and a classical electronic noise generator, successfully identifying flawed configurations.

Face morphing attacks (blending two faces together to fool facial recognition systems) threaten security systems used at borders and for digital identity checks, and detecting them from a single image is difficult because there's no trusted reference image to compare against. This paper presents R-FLoRA, a new detection method that combines high-frequency image analysis (looking at fine details) with a frozen, large-scale vision transformer (a type of AI model trained on images) to spot morphing artifacts while keeping the overall understanding of the face intact. The method outperforms nine other detection approaches on multiple test datasets and works efficiently in real-world biometric verification systems.

This paper describes a new encryption method called FDXT that helps protect data privacy when searching encrypted files on untrusted servers. Previous methods like ODXT and SDSSE-CQ had weaknesses where attackers could leak information by analyzing search patterns and file sizes when users searched for multiple keywords together, but FDXT fixes these privacy leaks while maintaining similar or better performance.

SRAM PUFs (physically unclonable functions, which are hardware features that generate unique secret keys from a chip's manufacturing variations) suffer from reliability problems because bits can flip and change values unpredictably. This paper introduces TMVS (Threshold-based Majority Voting Scheme), a software-based method that reduces noise and fixes bias issues in SRAM PUFs while keeping the approach simple and avoiding the complexity of heavy error-correction codes.

A Chinese cybersecurity company called 360 Digital Security Group claims to have discovered 1,000 vulnerabilities (weaknesses in software that attackers can exploit) using AI tools, including some vulnerabilities found at the Tianfu Cup hacking contest. The article compares these claims to myths about Claude (an AI system), suggesting skepticism about the actual capabilities being reported.

Google announced new AI agents and security tools designed to help security teams keep pace with the increasing number of vulnerabilities and cyber threats. The company introduced three new agents embedded in Google Security Operations (for threat hunting, detection engineering, and gathering external intelligence), expanded the Wiz security platform to monitor AI development across multiple clouds, and created tools like AI-BOM (AI bill of materials, an inventory of all AI components used in an organization) and Agent Gateway to secure interactions between AI agents. These moves represent a shift toward automated, agent-based defense rather than relying solely on human analysts.

Google announced new AI agents and security tools designed to help security teams defend against AI-based attacks, particularly in response to threats like Anthropic Mythos. The company introduced three new agents within Google Security Operations to automate threat detection and response, expanded the Wiz platform to provide visibility across multiple cloud environments and AI development tools, and created new security measures like AI-BOM (a system that catalogs all AI components used in an organization) and Agent Gateway to govern how AI agents interact with each other and enforce security policies.

Trailmark is an open-source library that converts source code into a queryable call graph (a visual map of how functions and classes connect to each other) that AI systems like Claude can analyze directly. Rather than examining code as flat lists of findings, Trailmark lets AI reason about code structure as a graph, making it better at identifying security risks like whether untrusted input can reach vulnerable code.

Anthropic's Project Glasswing uses an AI model called Mythos that is extraordinarily effective at finding software vulnerabilities, discovering bugs that humans missed for decades and even chaining multiple bugs together into working exploits. However, the critical problem is that fewer than 1% of vulnerabilities Mythos finds are actually patched, revealing a massive gap between how fast AI can discover security flaws (machine speed) and how fast human teams can fix them (calendar speed, typically four days per cycle).

Researchers at Palo Alto Networks built an autonomous multi-agent AI system called Zealot to test whether AI could independently perform cloud attacks. The system successfully chained together multiple exploitation techniques (SSRF, credential theft, and data theft) against a test Google Cloud environment, demonstrating that AI acts as a force multiplier for known cloud misconfigurations rather than creating entirely new vulnerabilities.

Microsoft is integrating Anthropic's Mythos, an advanced AI model, into its Security Development Lifecycle to help find software vulnerabilities (security flaws in code) and strengthen code earlier in development. While this move signals that AI is becoming central to how major software companies build secure products, analysts note that powerful AI models like Mythos could also make it faster for attackers to find and exploit vulnerabilities, raising concerns about the dual-use nature of these tools.