Research

This roundup covers selected AI-related security incidents and exploit disclosures reported between July 1, 2026 and September 30, 2026. It maps each entry to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026, with published CVE references where available.

Yang, Yoon and Euom present VulnTACT, a method that predicts MITRE ATT&CK tactics and techniques for ICS threats from vulnerability information using domain-adapted large language models. The source text provided here contains only the publication metadata (December 2026, Journal of Information Security and Applications, Volume 103, authors), so the method's results and numbers are not stated.

This paper argues that attack success rate (ASR) alone cannot show whether a model actually engaged with a task under intent-obscuring prompts, since the same non-harmful outcome can reflect refusal, failure to recover the task, or an unrelated response. The authors pair ASR with an operative understanding rate (UR), which checks whether a response identifies the evaluated task and treats it as the task to be answered. Across interfaces, paired UR and ASR reveal large differences in recovery that similar ASR values hide.

Researchers introduce Learnable Trust-Boundary Delimiters (LTBD), a defense against prompt injection that uses a small number of learnable delimiters to separate trusted user instructions from untrusted external data, without changing LLM parameters. On AlpacaFarm, LTBD achieves 0.00% ASR, and on TaskTracker it achieves 0.11-0.19% ASR. The authors report that it outperforms inference-time defenses, is competitive with training-based approaches, and remains effective under adaptive attacks.

Researchers studied 200 CyberGym traces from four LLM agents (Codex, OpenCode, Cybench, and EnIGMA) to find where tokens go during vulnerability discovery without producing a working proof of concept. Code localization and understanding, plus vulnerability reasoning and trigger design, account for 60.4% of tokens and are the leading bottlenecks in failed runs. The authors then present AVRI, an interface built around a persistent Bidirectional Evidence Trace, which cuts total cost by 18.0% for Codex and 23.7% for OpenCode on 20 tasks while preserving success rates.

Collaboratively Guided Adversarial Robust Distillation (CGARD) transfers robustness from a teacher model to a compact student model by jointly optimizing student-adversarial and teacher-collaborative examples within the same perturbation neighborhood. The teacher-collaborative example is constrained to incur no greater cross-entropy loss under the teacher than the clean input. Experiments on CIFAR-10 and CIFAR-100, including white-box and black-box transfer evaluation, report consistent robustness gains over strong adversarial distillation baselines.

This paper characterizes statistical separability in third-party challenge-response identity verification (TP-CRIV) for probabilistic AI models, where repeated queries can yield different outputs. It relates challenge-wise behavior of matching and non-matching provers to verification-level separability, showing how the numbers of independent challenges and repeated responses affect detection performance and how the verification budget for a target AUC can be estimated. The approach is instantiated for LLMs with open-ended challenges, with experiments reporting close agreement between theoretical and empirical AUCs.

This paper investigates how prompt injection attacks can exploit both direct user inputs and inter-agent communication to leak sensitive information and trigger cross-agent infections. Its tests mainly highlight vulnerabilities in single-agent systems, and the authors extend the attacks to multi-agent frameworks to examine how weaknesses propagate across agents. The findings stress the need for more robust defenses as AI agents spread into real-world workflows.

NOMOS is a four-pass compiler that turns a natural-language policy into a deterministic tool-call gate for LLM agents. Static verification using only tool-schema checks repairs or rejects 37% of candidates on airline and 13% on retail, and the gate cuts violations of reference-encoded clauses on state-changing calls from 66.3% to 2.6% (airline) and 30.8% to 6.9% (retail). On AgentDojo's banking suite it reaches a zero attack success rate, and on the other three suites its ASR is at most 3.6%.

This critical review examines privacy risks from conversational LLM agents across five areas: data leakage and memorization, adversarial extraction and prompt injection, inference and re-identification, surveillance and profiling, and regulatory governance breakdown. It finds that technical mitigations such as differential privacy, federated learning and machine unlearning work to some extent in controlled settings but fail to fully protect conversational deployments, and it highlights risks that machine unlearning can leave traces exploitable by adversarial reconstruction.

This Perspective, published in Frontiers in Computer Science on 2026-10-08, argues that agentic AI safety should be treated as a software-architecture problem alongside model alignment and prompt-level defenses. It proposes a five-plane reference topology (intent, orchestration, execution, oversight, adaptation) with the invariant that deciding components should not directly act, and acting components should not act without supervision. The topology is realized in Polos, an open reference specification.

This paper studies a backdoor attack on AI-based network intrusion detection systems (NIDSs). The method uses the embedding space of a Graph Attention Network (GAT) to pick anomalous samples close to benign traffic, adds a benign-distribution trigger, and relabels them as benign before retraining TabNet, ACID, and AlertNet. Tests on NSL-KDD, CICIDS2017, and UNSW-NB15 show high attack success rates, but the gain over random selection is uneven and marginal or absent where the random baseline is already saturated.

Researchers propose a privacy-preserving large language model training approach, the trust-weighted and ethical gradient model, to address the privacy utility tradeoff in LLMs trained on personally identifiable information. The method combines trust-weighted memory, ethical gradient masking under a tracked (ϵ, δ) privacy budget, and an ethical boundary layer that screens risky outputs. Experiments on the Pile dataset report reduced PII leakage with baseline utility maintained, and the authors claim resistance to membership inference, extraction and linkage attacks.

Researchers present an ensemble defense that combines several backdoor detectors for deep neural network classifiers, so detection does not depend on a single backdoor mechanism. The ensemble also performs backdoor inversion, which indicates the nature of a detected attack. The paper also employs mixed clean/dirty-label backdoor poisoning, an X-to-X attack the authors describe as more surgical, evasive, and harder to detect than traditional dirty-label attacks.

Researchers study Speculative Rejection Attacks (SRAs), which append an adversarial suffix to attacker-controlled content so that draft and target models disagree more often in speculative decoding. Two attacks, Speedbump-P and Speedbump-D, optimise the expected length of the accepted speculative prefix, and in some cases slow inference below autoregressive decoding. The suffixes stay effective under sampling and transfer across drafters or target models sharing a drafter, showing the draft-target interaction is a realistic attack surface for inflating inference costs.

Researchers present BRANCH, a bypass method for guardrail systems built from multiple scanners that detect malicious instructions aimed at LLMs. The method uses a branching tree search that applies adversarial perturbations against individual scanners and selects techniques by overall improvement across all scanners. The authors report a 100% attack success rate across 6 guardrail systems in 120 scenarios, using 72% fewer queries and 4.5x less wallclock time than established techniques, and note that bypasses transfer to 29 unseen guardrails, including 8 commercial black-box ones.

The paper proposes a detector that identifies adversarial images for frozen vision-language models by profiling how an image responds to a set of general semantic prompts. The profile combines category-level statistics, prompt relationships, deviations from clean reference distributions, and stability under weak image transformations, and a lightweight classifier labels each input while the VLM stays fixed. Evaluated across multiple datasets, CLIP-style backbones and several attack families, the detector discriminates strongly in attack-specific settings and retains substantial performance on unseen attacks.

GraphRectify is a graph-based framework that transfers adversarial image detectors from one classifier backbone to another. It learns a structured representation of intermediate classifier features and adapts features from a new backbone to the detector trained on the original model. Across the evaluation matrix, it achieves higher aggregate ROC-AUC than training a detector from scratch on the new backbone, with the largest gains between different backbone families when sufficient data are available.