Top GenAI security resources — September 2026

What it is

Beyond the three items already summarized, the roundup covers several distinct techniques the existing summary omits: an IDOR-to-persistent-prompt-injection bug bounty finding, Unsafe Semantic Distillation (a guard-model false-positive attack), a 12-control RAG threat model, a stateful multi-turn jailbreak defense, a document-poisoning robustness study with concrete numbers, and an adversary-emulation video on managed GenAI infrastructure abuse.

How it works

• IDOR → context poisoning: A chat backend stored threads server-side but trusted a client-supplied thread ID with no ownership check, granting read/write to another user's private thread. Because the thread replays as context on later turns, injected text became persistent assistant memory, steering unrelated recommendations with no further attacker interaction.
• Unsafe Semantic Distillation: Imperceptible perturbations on entirely safe images, aligned to distributional representations of unsafe content (not specific instances), make guard models reject legitimate requests — a false-positive/availability attack rather than a jailbreak. Reaches 84% attack success across four state-of-the-art guard models.
• Document poisoning robustness study: A 588-run factorial test corrupts only retrieved evidence (not the retriever) via entity swap, number swap, and negation across 0–3 of 3 passages. Accuracy falls from 77.9% (clean) to 43.5% (all three poisoned), with a sharp threshold once poisoned passages form a majority. The model abstains more under attack rather than fabricating, so hallucination rate drops while accuracy collapses — hallucination metrics would report this as an improvement.
• Stateful multi-turn defense: Three cooperating guards (one paces responses, one answers ambiguously to dead-end the attacker, one does forensic fingerprinting to refine the other two) with an escalating controller. Reports 69% average reduction in attack success and 198% increase in attacker token consumption; releases a 5,200-sample adversarial dataset across eight attack types.
• Adversary emulation video: Credential-based model invocation abuse (disabling invocation logging, reselling access — cited at up to $42,000/day in charges) and knowledge-base poisoning (enumerating managed KBs, uploading corrupted files to the backing object store).

What to do

• Re-check ownership on every path into the model that trusts a client-supplied identifier; treat stored conversation state as a write target, not just a read target.
• For RAG systems, use the published 12-control threat model (ingestion, parsing, vector retrieval, context assembly, tool execution, deletion) — the deletion and parser-hardening stages are flagged as commonly skipped elsewhere.
• Don't rely on hallucination rate or perplexity to detect RAG poisoning — both studies on this page show poisoning correlates with lower hallucination/perplexity, the opposite of the expected signal.
• For managed GenAI infra, map defenses to invocation logging/observability and access control to catch the credential-abuse and KB-poisoning patterns shown in the emulation video.

Caveats

The guard-model attack (84% success) and multi-turn defense (69% reduction) figures come from the respective papers' own evaluations, not independently reproduced. The red-team-program writeup is paywalled and covers safety harms, not security, per the page itself.