All items
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
12,081 items
CrowdStrike announced agreements to acquire AI agent observability firm Fiddler AI and AI security testing company Dreadnode, reportedly worth a combined $495 million. According to The Wall Street Journal, roughly $400 million is for Fiddler and about $95 million for Dreadnode. The deals are expected to close in the fourth quarter of CrowdStrike's fiscal year 2027.
Check Point Research analyzed the Haiou jailbreak bundle, a Chinese-language prompt package targeting OpenAI Codex that weakens model guardrails for hacking-related tasks. The bundle installs security-focused Skills and modifies Codex configuration files so that advertisements for the author's paid, OpenAI-compatible LLM gateway are injected into subsequent agent responses, which Check Point classifies as prompt adware. Researchers also observed the bundle on a misconfigured webserver alongside Cobalt Strike, the Ladon framework and the VulnClaw agent, used by a cybercrime actor.
MIT Technology Review's daily newsletter covers a new approach called "reverse game theory," which designs rules that incentivize powerful AI models to stick to instructions, with researchers believing it could align AI more closely with rules, though open questions remain about practical effectiveness. The same edition reports that President Trump's executive order directed agencies to rebrand AI as "Super Intelligence," a term that is becoming a political loyalty test.
Wiz describes how teams use its Green Agent to speed remediation of security issues, citing Fireblocks, Rogo, and project44 as examples. The piece argues that fixing vulnerabilities, such as the recent PHP2Shell zero-day, stalls on coordination between security, engineering, and cloud operations teams. Green Agent addresses this by identifying a Suggested Assignee for each issue and tracing risks from runtime to the code that introduced them.
CVE-2026-99256 affects the Linux kernel's dm cache device-mapper target. The background_work_lock was a rw_semaphore, but write locks on it have strict owner semantics, and nothing guaranteed that the process unlocking it was the one that locked it. Running 'dmsetup suspend <cache> && dmsetup resume <cache>' on a kernel built with CONFIG_DEBUG_RWSEMS triggers a kernel warning from cache_resume().
Fix: The fix replaces the rw_semaphore with a spinlock and a wait queue. The existing migration_wait queue and nr_allocated_migrations counter are repurposed as the background_work queue and counter.
The author, citing a 2021 essay and the 2022 book A Hacker's Mind, argues that AI systems can find vulnerabilities and exploits in legal systems much as they do in software. The source reports that the authors used LLMs to identify a substantial number of previously unrecorded vulnerabilities in the German legal system, sharing only those whose exploitation would not cause serious harm. They warn that cheap legal reasoning could jeopardize current legal systems, and that lawmakers would need to harden legislation, possibly using advanced AI themselves.
OpenAI describes how its models, including ChatGPT and Codex, help engineers with CAD, PCB design, simulation and manufacturing preparation. In a test, GPT-6 Astra designed the enclosure, printed circuit board and software for a device that lets users talk to Codex, with two team members finishing the design in under a week. A contract manufacturer built a prototype batch in under a month, but Astra did not consistently account for production limits, tolerances or assembly details.
Google Threat Intelligence Group (GTIG) warns of LLMjacking campaigns in which cybercriminals hijack enterprise cloud and model access and resell it through underground subscription services called LLM Mixers. GTIG reports that fake cloud charges can exceed $100,000 in a single day, and that cumulative charges reached $1 million in some incidents before access was revoked. The source text is cut off mid-sentence while describing a follow-on actor that exploited a user ID rebinding vulnerability in the LiteLLM gateway.
This study examines whether compiler miscompilations threaten the guarantees of zkVMs SP1 and Jolt, which prove that Rust programs compiled to RISC-V ran correctly. Of 88 assembled rustc and LLVM miscompilations, 48 caused a wrong output on SP1 and 46 on Jolt. An LLM agent found patches that look like ordinary optimisations and exposed a known bug in 12 of 366 project-bug pairs across 11 of 20 projects, at about $40 per project. Reviewing the zkVM or the guest source cannot catch such patches, because both are correct.
A China-linked group tracked as VAPOR PANDA used the AI-powered penetration testing framework ARTEX to target more than 200 organizations in at least 14 countries over 11 days beginning October 17, according to CrowdStrike, with post-exploitation activity confirmed at nine. Microsoft separately reported that another China-linked group, Storm-0940, used ARTEX to automate attacks that in some cases gained privileged cloud access in less than three hours.
A new alignment approach called "reverse game theory", also known as mechanism design, aims to design rules that make safe behavior the rational choice for AI agents, instead of trying to read their internal reasoning. A preprint by Stephen Morris, an MIT economist, with colleagues from Yale and Columbia proposes mechanisms to stop agents from sandbagging tests, such as rewarding a model for how well its answers predict a second model's output. The source is cut off mid-description of a second proposal by Elad Hazan of Princeton, which has models take turns as solvers and auditors.
CVE-2026-89229 is a path traversal flaw (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot). A malicious application installed on the same device can send a crafted ACTION_SEND intent whose ContentProvider-supplied file name contains '..' sequences, allowing it to write arbitrary files.
The NATO CCDCOE began Crossed Swords 2026 in Tallinn, Estonia, with more than 250 participants from over 40 countries practicing how to time cyber operations with kinetic and special operations action. This year adds a dedicated track on AI agents, which runs on locally hosted AI and, for the first time, OpenAI's Daybreak cyber defense offering.
Barracuda's Cybersecurity Skills Gap report surveyed 2,000 IT and security decision-makers and found that 67% say security teams are under pressure and struggling to scale to business needs. AI-related risks (68%) and advanced identity and phishing threats (67%) are the most common challenges. Separately, Pluralsight's Tech Skills Report 2026 estimates UK skills gaps cost 41% of cybersecurity professionals at least £380,000 a year.
This paper examines privacy evaluation of de-identified text, where a language model adversary guesses a protected attribute. The authors propose a prior-normalised clipped leakage score and show that rankings of text editors depend on the evaluation interface, including the queried person, answer options, prior, adversary model and scoring rule. In a stress test, an opposite-sex-writing editor misleads the adversary about most people yet ranks first under this score, while a relabelling-invariant AUC reading ranks it sixth of eight.
TraceRouter++ is a routing-level safety framework for large foundation models that traces causal routing pathways activated by harmful inputs and realigns their unsafe activation states. It uses sparse autoencoders, feature influence scores, and a constrained optimal transport soft realignment instead of rigid neuron suppression. The authors report improved adversarial robustness and a favorable safety-utility trade-off across LLMs, MLLMs, and diffusion models.
Existing prompt extraction attacks degrade on recent LLM services, whose system prompts are longer and more structured and whose raw outputs are often hidden behind post-processing. The authors propose ExtraHerO, which decomposes extraction into a hierarchical reconstruction guided by a structural prompt template and iteratively updates adversarial queries, with early stopping based on information gain. Across chatbots and agents, it reports average improvements of 12.5% (fidelity), 2.3% (functionality), and 6.0% (adversarial utility) on chatbots, and 12.2%, 34.3%, and 30.5% on agents.
Fix: zkVM projects should treat their compiler as part of their trusted base and track the known bugs of their toolchain.
Arxiv (cs.CR + cs.CL + cs.LG)This paper studies parameter poisoning in LLM agents, where an indirect prompt injection keeps the intended action but manipulates a tool argument such as a recipient. The authors propose AuthorityFlow, a three-stage defense that builds a task-specific trust hierarchy from the user query, traces each argument to its supporting information field, and flags low-trust influence. On their FactAuthBench evaluation, attack success falls from 93.06% to 9.03%, with 82.64% benign task utility retained versus 90.28% without defense.
Fix: AuthorityFlow: a three-stage parameter-level defense that constructs a task-specific trust hierarchy over information fields, traces each tool argument to its supporting field, and accepts a value only when that field is trusted to determine the parameter under the current task.
Arxiv (cs.CR + cs.CL + cs.LG)Researchers present a taxonomy of nine dimensions along which prompt injection attacks differ, covering the injected instruction, its relation to the user's task, and how it appears in the target system. Applied to six real-world vulnerabilities and nine benchmarks, the taxonomy shows most benchmarks cover only a small region of the space, and 13% of pairwise category combinations remain untested. The authors also show it can support automated benchmark annotation and targeted test generation.
Fix: Analysts quoted in the source recommend continuously measuring endpoint protection coverage and alerting when machines stop reporting, enforcing SAML signature validation, restricting cloud access privileges, regularly rotating credentials, monitoring unusual account activity, and improving asset visibility across systems.
CSO OnlineVeriSpoof is an audio language model that unifies five forensic tasks with shared weights: deepfake detection, generator attribution, recording-condition analysis, synthesized-span localisation, and source verification. On 14 Speech-DF-Arena test sets, VeriSpoof-Plus reaches 2.14% pooled EER, ranking third of 28 systems and first among open-weight systems, while VeriSpoof-Base reaches 4.43% EER. The authors release both models, inference code, a demo, and the VeriSpoof-Bench evaluation suite.