Research

This paper studies an authorization-grounded workflow attack on tool-using language-model agents in the OpenClaw Agent Security Attack Competition. The attack walks the agent through a denied document request, a normal approval token request to the local approval service, and supplying that token to the document service via authorized_by, succeeding on three Enterprise OA document targets. In 23 controlled local validation experiments, the original configuration reached the approval-token transition in 9/9 reruns and completed the exact target operation in 8/9 reruns.

ECHO is an optimization-based jailbreak attack that replaces the usual token-level compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor. It pairs this with five word-level perturbation operators and Keyword-Anchored Beam Search under a strict black-box threat model. Across five open-weight victims on AdvBench, it reaches up to 0.898 StrongREJECT mean score and 89.23% HarmBench success.

SAFE-Mem is a memory governance framework for LLM agents that tags each stored claim with kind, authority and scope labels to track provenance and permitted use. Its governance-aware retrieval matches query requirements against claim permissions, blocking unauthorized influence while keeping legitimate information. On MPBench and LoCoMo across four LLM backbones, it reports the lowest attack success among defenses that retain legitimate memory, at least 77% below the strongest of them, and up to 15% higher answer accuracy.

LENS is an LLM-based system that guides language models with exploitability-analysis discipline and protocol evidence to assess Diameter field-level exploitability. Across four LLMs it reached mean recall of 94.00% to 98.00%, precision of 78.73% to 88.94%, and accuracy of 84.00% to 92.00%. The authors report that over 25% of field paths in the S6a and Cx interfaces are exploitable, and they uncover 95 previously unknown vulnerabilities in EPC/IMS implementations and commercial deployments.

Researchers introduce KoLing, a bias-controlled adversarial benchmark of 50.9k instances for detecting LLM-generated Korean text, aimed at suppressing superficial shortcuts. They also propose KoLingProbe, an interpretable detector grounded in theoretical linguistics that models Korean-specific properties across multiple linguistic levels. They report that KoLingProbe substantially outperforms strong baselines on all detection tasks and stays robust to adversarial attacks.

This paper proposes EDIC, a decomposed reward framework that trains LLMs to classify each instruction embedded in external data as beneficial or harmful, then follow the former and reject the latter. A generative judge, initialized by SFT and refined with GRPO, attributes compliance per instruction to produce separate rewards. Across two backbones and five benchmarks, EDIC improves harmful-rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% on Qwen3-4B over the strongest prior defense.

Researchers show that reusing key-value caches built from reasoning traces, which can improve task performance much like RAG, opens new poisoning vulnerabilities in LLM systems. Their black-box attack, R$^2$ECAP, plants poisoned traces through a chat interface alone, and the retained trace keeps adversarial influence after the preceding trace's cache entries are discarded. It reaches up to 79% attack success rate on three open-weight LLMs and three datasets, and 46% in a realistic reasoning-trace retrieval system, while only 1% of its retained responses were flagged by a popular prompt injection detector.

GRAD is a defense for LLM agents against memory poisoning and decomposition attacks, which spread malicious evidence across multiple operations. It combines graph-based evidence aggregation across operations with an extensible set of detection experts that are added on frozen encoder snapshots and routed by graph signatures. Across Decomp, MCP, and MRT it reports AUROCs of 97.19%, 77.59%, and 86.60%, and its continual adaptation improves final accuracy by 13.08 percentage points over Replay.

Veil-then-Reveal (VtR) is a user-side framework that pseudo-anonymizes PII in prompts before they reach untrusted remote LLM providers, keeping plaintext PII on the user's device. It combines format-preserving encryption for structured PII, such as phone and credit-card numbers, with a keyed-hash dictionary and secure vault for semantic PII, such as names and organizations. On three datasets with 11,322 annotated PII instances, it reports 97.9% detection recall, 95.2% protection of detected values, and 99.9% round-trip restoration.

Anthropic's internal data, covering employment, AI use, output metrics and 17 employee interviews, shows slower hiring for junior technical roles even as the company grows. Output per employee rose as staff adopted AI agents, and by August interactive agent hours outnumbered employee hours 6 to 1. Hiring managers now put more weight on autonomy and judgment than on specific technical expertise.

Researchers introduce BadPatches, a routing-aware backdoor attack for patch-based mixture-of-experts (pMoE) vision models and MoE-based vision transformers. The attack places triggers inside targeted image patches so they reach the active experts, achieving over 83.2% attack success rate at a 0.01% poisoning rate and 96.8% at 0.05%, with clean accuracy preserved. The attack remains effective in gray-box settings, and the authors find that fine-pruning alone does not remove it, requiring a fine-tuning stage.

Anthropic gave Claude plain-language specifications for eight quantum circuits, spanning chemistry, optimization, physics simulation, and number theory, plus an automated evaluator that scores each design. Working largely on its own, Claude found circuits that improve on the best published ones, in some cases by an order of magnitude or more. The authors argue that such reductions in required quantum resources could bring practical quantum computers sooner than previously expected.

A survey in Artificial Intelligence Review reviews Retrieval-Augmented Generation (RAG) research through a structured review protocol, organized around system architecture and paradigm evolution from Naive RAG to Agentic RAG, evaluation methods and application evidence, and deployment and security challenges. It names prompt injection, data poisoning, retrieval hijacking, privacy leakage, and citation laundering as emerging risks.

This research proposes bounded continuation analysis (BCA), which models autoregressive generation as a stochastic process over token prefixes and computes the finite-horizon probability that generation reaches a harmful continuation. The authors argue that attack success rate misses harmful paths hidden beneath sampled refusals, and that BCA can distinguish models with identical measured ASR. Across four instruction-tuned LLMs and 100 JailbreakBench behaviors, they report that BCA quantifies hidden harmful behavior and guides red teaming.

LLM-Attacker is a red-team framework for evaluating privacy in split and distributed LLM systems, where input text stays on the client and intermediate representations go to a server. It records attacker access, datasets and scoring rules so that evaluations can be checked and compared, and it requires a linked undefended reference before a defence can pass. In a controlled GPT-2 experiment, returning gradients during training raised token recovery from 94.20% to 97.38% and exact-document recovery from 13.71% to 37.77%.

This research paper proposes Intact, a system that protects AI browsing agents from injected web content by running on an unmodified browser. Intact builds GenTree, a representation capturing provenance and web semantics, and passes the page to the LLM one element at a time while its harness limits each step to that element's capabilities. On 1,091 webpages with injected attacks, only 12.8% of attacks got through Intact's planner, compared with 73.1% for a conventional planner, while isolation disrupted functionality on 3.7% of tasks.