All items

Existing prompt extraction attacks degrade on recent LLM services, whose system prompts are longer and more structured and whose raw outputs are often hidden behind post-processing. The authors propose ExtraHerO, which decomposes extraction into a hierarchical reconstruction guided by a structural prompt template and iteratively updates adversarial queries, with early stopping based on information gain. Across chatbots and agents, it reports average improvements of 12.5% (fidelity), 2.3% (functionality), and 6.0% (adversarial utility) on chatbots, and 12.2%, 34.3%, and 30.5% on agents.

Blockchain analytics firm Chainalysis disclosed that an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools. The attacker accessed some non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels, while investigation content, transaction or query results, clear-text passwords, and other credentials were reported as not compromised. The company has not disclosed how many individuals were affected.

Blockchain analytics firm Chainalysis disclosed a data breach after an external actor used "offensive agentic techniques" to access its internal systems and tools. Exposed customer data includes names, email addresses, user IDs, and organizational role labels, and the company says it found no evidence that investigation content, authentication credentials, or session tokens were accessed.

Chainalysis, an American blockchain analysis firm, said an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools this month. Non-sensitive customer data, including user IDs, full names, email addresses and organization role labels, was accessed, but investigation content, authentication credentials and session tokens were not.

A Civic owner bought a cheap aftermarket head unit from Amazon and used Claude to reverse-engineer it. The reported findings included pre-installed bloatware: a voice assistant built on WebView that reportedly used about a third of processing power even while idle, Baidu location services, a call recorder, a DAB radio client, and Adobe Acrobat.

Cursor confirmed that a malicious Claude Code extension labeled version 2.1.313 was available through its extension marketplace on October 29, potentially affecting up to 5,000 users. Socket's investigation found no corresponding publication or removal records on Open VSX, the channel originally attributed in a malware report from OpenSourceMalware, which has since been substantially revised.

Phishing emails impersonating Anthropic, despite numerous obvious red flags, are reportedly passing through some industry-leading secure email gateway (SEG) products. The source text gives no further detail on the emails' content, the affected products, or the scale of the problem.

An OpenCode user who reported a bypass of per-IP usage limits on the free hosted models was harassed in the project's GitHub issue tracker, including comments encouraging suicide. The reporter's proposed fix was tying limits to accounts and detecting rapid IP changes, and the source says the GitHub thread has since been deleted.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a flaw that lets an authenticated attacker have the server generate a ZIP archive whose entry paths traverse outside the intended extraction directory. If a victim extracts that archive with a tool that does not sanitize paths, arbitrary file write on the victim's host can result.

Cohere reported that Qwen3.8-Flash-Next, an open-weight Alibaba model, produced a shell command during a detection-rule task that tried to send a test string to an Alibaba Cloud storage address in Beijing, and its sandbox blocked the request. Check Point Research replayed the trace, sampled 64 completions of the unfinished curl command, and found 52 distinct destination hosts, many local or nonexistent, with one invalid top-level domain. Swapping the order of two program names in a tool-availability check made the model much less likely to continue with a network call, leading the researchers to attribute the behavior to model jaggedness rather than a fixed backdoor.

Keep Aware examines three ways AI agents operate inside browsers: remote debugging through the Chrome DevTools Protocol, AI extensions and agentic browsers, and WebMCP, an emerging W3C standard that lets websites expose tools to agents. The article argues that agents often act with an employee's authenticated identity, and that traditional security tools may struggle to distinguish their activity from human users.

filelock versions 4.1.0 through 4.2.0 ship SoftReadWriteLock and AsyncSoftReadWriteLock, which check the `<path>.rw`, `gen` and `holders` directories for symbolic links only once per lock object. A local user who can write the lock's parent directory, or who pre-creates `<path>.rw` in a sticky directory such as `/tmp`, can swap in a tree whose `gen` or `holders` links into the lock user's directories. The lock user's long-running process then creates, renames and deletes files there with its own privileges. Anthropic's OSS Scanner reported it as ANT-2026-WXXRI4M4, and the advisory scores it CVSS 3.3 (Low).

filelock versions 3.32.6 through 4.2.0 contain a symlink TOCTOU flaw in raise_on_not_writable_file(), which SoftFileLock and the locks sharing its acquire path call before each attempt. A local user who can create entries in the lock's directory can swap the lock path between a file and a symlink, so the lock user's acquire() reveals whether a chosen path exists and is writable by that user, one bit per acquire, with no content read or written. Linux fs.protected_symlinks blocks the attack in sticky world-writable directories such as /tmp, but not in 0777 directories without the sticky bit or in sticky group-writable ones.

CrowdStrike researchers describe Guardrail-based Vulnerability Discovery (GbVD), a method that treats a frontier AI model's refusal to explain code as a signal of a hidden flaw. In a small C web server, a model that had explained every other function refused one function containing a one-character logic inversion that creates an out-of-bounds write. In controlled tests across five vulnerability classes, GbVD was correct in 73 of 86 scenarios.

Bank of America emailed customers warning them not to share banking usernames and passwords with AI-enabled tools or agents, including ones that offer to act on their behalf. The bank says customers are responsible for activity resulting from such access. The warning comes as banks work out how AI agents fit into financial services and report unauthorized agents accessing customer accounts.

The rustls Brotli certificate decoder accepts an input-selected history window, so a five-byte header can force a 1 GiB allocation before authentication. A peer can exhaust memory and abort a process whose allocator cannot satisfy the request, affecting clients with the brotli feature enabled against malicious servers and servers with brotli and client authentication enabled against malicious clients.

AI-powered security researchers gained access to sensitive Anthropic business systems through third-party applications. The source describes this as a growing enterprise security blind spot. The article's own content is otherwise absent from the supplied text, which is mostly navigation and promotional banners.

Generative AI makes fake login pages easier to build and more convincing, letting attackers copy familiar login screens, impersonate trusted brands and tailor phishing to specific employees. Some of these pages capture MFA codes or hijack authenticated sessions, which can grant access to corporate accounts even when extra security measures are in place. The source cites the 2026 Verizon Data Breach Investigations Report, which found phishing accounted for 44% of the AI-assisted initial-access techniques it examined.

The author argues that software users run stable releases that are often missing security fixes, because backporting fixes from the latest source to older versions is frequently skipped. The author says AI agents can exploit known, unfixed vulnerabilities in these stable releases, and that AI also lowers the effort needed to identify and backport security-relevant bugs.