All items
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
12,081 items
Researchers study indirect prompt injection against blue-team LLM agents in Security Operations Centers, where malicious text in telemetry, tickets, retrieval results or memory can corrupt intermediate outputs such as severity labels, incident narratives and IOC sets. They introduce StateFence, a task-aware evaluation and defense framework that maps attacks into explicit, stealth, multi-hop and persistent SOC evidence attacks and routes defenses by the attacked state. Across controlled and public-SOC validation cases, StateFence reduces attack success while preserving task utility and avoiding the indicator loss caused by task-mismatched filtering.
South Korean President Lee Jae Myung unveiled the country's largest ever budget, raising 2027 spending 12.8% to 820.9 trillion won ($610.14 billion). It includes 21.3 trillion won for semiconductors, physical AI and AI data centers, plus 4.7 trillion won for developing a sovereign AI model.
Cisco Talos researchers describe VOLTA-AUTODOXER (aka VOLTA), a new Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, Slack and Outlook data, and Microsoft OAuth tokens. It bundles the stolen data with Gmail receipts and sends it to an LLM through OpenRouter, which ranks the victim's valuables by monetization tier and writes a target dossier. Exfiltration goes over Telegram at three stages.
OpenAI CEO Sam Altman made an unannounced visit to South Korea, meeting about 50 Samsung affiliate executives in Yongin and reportedly holding lunch talks with SK Group Chairman Chey Tae-won. The discussions reportedly touched on AI chips and data centers, though the participants gave no details.
OpenAI has appointed Dan Driscoll, former 26th Secretary of the United States Army, as Senior Counselor for National Security Modernization, a newly created role. He will advise on responsible use of advanced AI for national and cyber security, with a focus on working with U.S. allies.
Kyle Kingsbury argues that LLM use erodes trust in documentation, software and the organizations that produce them. He suggests engineers may begin to treat new software projects with suspicion, because signals once used to mark a mature system are now easier to counterfeit. He asks how maintainers can ensure correct software and accurate documentation, and how they can demonstrate that quality to users.
OpenAI confirmed it is bringing ChatGPT Work capabilities into regular Chat and combining usage allowances across ChatGPT and Codex. In an email to subscribers seen by BleepingComputer, OpenAI said a combined Chat and Work experience will first be tested with a small group of users in the coming weeks. Codex will remain a separate experience in the ChatGPT desktop app.
Northstar Security, a startup building AI agents for security teams, exited stealth with $7 million in seed funding led by Wing Venture Capital. The platform ingests data from existing security and IT tools to build a real-time Security Context Graph that maps how identities, assets, vulnerabilities and business systems connect, and it flags toxic combinations of issues that together expose critical systems.
Researchers propose LoFIT (Local Conditional Fit), a membership inference method for text-to-image diffusion models that measures the initial response of the denoising loss along normalized conditional prediction shifts. The method needs only forward queries to the denoiser, no target-model gradients. Across four datasets it improves membership discrimination on fine-tuned and pretrained models, and it separates members early in fine-tuning where the naive denoising-loss baseline stays near chance.
Researchers measured how MCP servers and host applications handle human approval for destructive tool calls, using source code from a 1,000-repository sample of the official MCP registry and 41 open-source hosts and agent SDKs. They found an estimated 90% of destructive tools lack server-side confirmation, and 60.7% of sampled server-application pairs have no enforced human approval by default. In 479 of 960 runs, four of five low-cost models executed an injected deletion through four agent SDKs.
Fix: Applications should therefore configure approval. The source estimates that prompting for every tool not annotated read-only or non-destructive would cut the unapproved share of pairs to 5.4%, while universal elicitation support would leave 56.7%.
Arxiv (cs.CR + cs.CL + cs.LG)Researchers tested whether a language model's own top-label confidence can flag prompt-injection hijacks in classifiers, using AG News topic classification across five systems, three served through a provider's API. Low confidence ranked hijacked answers above clean ones with AUROC 0.86-0.90 on four systems, but a threshold allowing at most 5% clean alarms missed most hijacks. On the API systems, the monitor missed 51-70% of plain-note hijacks and 99-100% when the injection claimed certainty, though ranking still reached AUROC 0.70-0.79.
LeanGuard is a runtime that checks each tool call an LLM agent proposes against a policy written in Lean4 before the call executes, using fail-closed evaluation over state predicates and scoped past-time temporal operators. On Tau-Bench with five Qwen models (0.8B-27B), unguarded agents executed at least 33 forbidden calls while LeanGuard executed none, and on DTap it cut direct prompt-injection success from 57.9% to 5.9%.
Researchers embedded canary identifiers in synthetic patient records and tracked tool invocations across five language models, four boundary levels, and seven attack frames for identifier-free clinical tasks. Three models invoked PHI tools unnecessarily, while Claude Opus 4.8 and GPT-5.5 did not. Stronger boundaries reduced this access, and a pre-execution gate given the task-necessity criterion nearly eliminated it.
Fix: A pre-execution gate given the task-necessity criterion, together with boundaries and access-log audits; the source states that output-only evaluation cannot verify minimum-necessary access and that these controls are required together.
Arxiv (cs.CR + cs.CL + cs.LG)This research paper proposes a three-layer security model for energy infrastructure and a hierarchical defense against adversarial attacks on Times-Series Large Language Models used for electricity-demand forecasting. The defense pairs a Multi-Agent Reinforcement Learning detector with signal repair at local control centers, plus an evidence-grounded LLM auditing agent with human-in-the-loop validation for Virtual Power Plants. The best MARL configuration reaches an F1 score above 0.91, signal repair cuts adversarial-to-clean Relative Squared Error by up to 83%, and detection and repair average 7.95 ms.
SANAI is a sensitivity-guided, bit-plane-selective scheme that protects quantized neural network weights against bit flips with zero additional parity-storage overhead. It hides parity inside the weights using keyed embedding, with spread-transform dither modulation binding parity to a secret key and keyed interleaving dispersing concentrated attacks across codewords. Across ten vision backbones and ten language models from 82M to 13B parameters, it stays within about one percentage point of clean accuracy at bit-error rates up to 12%, twice the maximum of prior embedded-ECC approaches.
Fix: SANAI is itself the proposed mitigation: it verifies weights on the load path with a streaming checker on an 8x8 systolic array, at 0.41% area overhead and no additional memory.
Arxiv (cs.CR + cs.CL + cs.LG)Researchers introduce ETUDE (Exploiting Tool Updates for Direct Execution), an attack that embeds malicious functionality into updates of initially benign tools while preserving their legitimate behavior. Because updated tool code runs outside the LLM's context window, the attack bypasses defenses limited to model-visible content. Across three attack workloads and seven agentic frameworks, including Gemini CLI, Codex CLI, and Claude Code, ETUDE reached a 97.6% ASR with a 95.9% legitimate task completion rate, and the authors found existing defenses insufficient.
The paper critiques AI surveys by using a case study on temporal features for trustworthy computer vision. It is published in ACM Computing Surveys, Volume 59, Issue 1, pages 1-35, January 2027. The source text provided contains only publication metadata, so the research question, method and findings cannot be stated from it.
The authors formulate a discrete-class text provenance framework that sorts human-AI co-authorship into distinct degrees of AI involvement, separating surface-level AI polishing from AI restructuring of discourse. They show that adversarial paraphrasing substantially degrades detectors trained only on benign data. Augmenting training data with adversarial paraphrases produces consistent robustness gains and good cross-generator transferability.
Fix: Augment detector training data with adversarial paraphrases generated by the state-of-the-art paraphrasing attack model.
Arxiv (cs.CR + cs.CL + cs.LG)A paper in Applied Soft Computing (Elsevier BV), published 2026-11-01 under DOI 10.1016/j.asoc.2026.116787, addresses prompt injection in LLM-driven hiring. The source text provided gives no further detail on the method or findings.
This survey reviews threats to autonomous edge agents built on LLMs and SLMs in cyber-physical systems and IoT, organizing them across Perception, Cognition, Actuation and Collaboration layers. It finds that several attacks have been demonstrated on physical platforms, including jailbreaking a deployed commercial robot, while multi-agent attacks run only in simulation and software. It identifies three edge-induced threats that no surveyed edge-deployable runtime mechanism addresses: energy-targeted resource exhaustion, quantization-specific evasion, and model provenance against supply-chain weight poisoning.