Skip to content

266 results for β€œNIST”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types266Articles86Papers82Repos40Write-ups33
Advisories11Threads4Other3Courses2Tools2Videos2Talks1
β€œNIST”
latent.spacearticle🧠 AI

Agents Prompt People: Using Agents for Long-Horizon Financial Work

Latent Space podcast write-up of an AI Engineer New York interview with Aman Singh, lead AI Engineer at Arca, an AI-native wealth management firm. Arca runs agent tasks lasting up to ten days, uses a per-client memory system, and owns its harness, which routes tasks to models (mainly Claude) by internal benchmarks. Safety rules are deterministic, trading stays with human advisors, and a meta-agent uses advisor feedback and traces to improve the harness.

ClaudeLLM
ArcaAman SinghAnthropic+6

agents, ai-infraΒ· Published and added 31 Oct 2026

en.cryptonomist.charticleπŸ›‘οΈ Security

Anthropic security breach exposed salaries and messages, not model weights

Anthropic security incident in which researchers from the startup Cathedral reached Anthropic's commercial, HR and IT systems through vulnerable third-party administrative applications. Exposed data included salaries, job offers, meeting transcripts and Slack messages; Anthropic says customer prompts, source code and model weights were not accessed. Anthropic cut access the same day and kept the apps disabled until vendors patched. The companies dispute whether Cathedral reported all its activity.

AnthropicSlack
CathedralDOGEExternal Researchers Program

Threat IntelΒ· Published and added 30 Oct 2026

rekt.newsarticle🧠 AI

Rekt - News or Hype?

Rekt's "News or Hype?" compares four October 2026 AI headlines with their sources. These are Justin Drake's "bunker mode" ECDSA warning, Anthropic's Claude tracing NIST curve seeds to lrand48, OpenAI's agent spending Sepolia ETH from a default-mnemonic account, and Wiz's "AI uncovers" PHP RCE claim of 70% reach. It ends with four questions for checking claims.

ECDSABitcoinEthereum+11
CVE-2026-109618CVE-2026-109619Justin Drake+17

ai-safety, agents, ai-policyΒ· Added 30 Oct 2026

github.comrepo🧠 AI

Show HN: I Turned DOOM into a Transformer

Doomformer compiles integer neural networks into ZDoom maps that run in ViZDoom. Voodoo dolls do the arithmetic, and sector light levels and plane heights hold the values. Python reads every value back and compares it with a NumPy integer reference at tolerance 0. It runs MNIST (97.16 % on all 10,000 digits, every pass exact), small transformers, a learning perceptron and a SUBLEQ machine. It is about 23,000 times slower than NumPy on a small MLP.

ViZDoomZDoomACS+10
DoomformerDOOMFreedoom+6

research, inferenceΒ· Added 30 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

world2vec: Mechanistic world models through latent dynamics learning

world2vec is a method for learning mechanistic world models from observations and actions alone, without reward information. Its latent dynamics reproduce the true system over long prediction horizons using at least one order of magnitude fewer parameters than DreamerV3, TD-MPC2 and LeWM. The authors report state-of-the-art control of continuous environments from pixels and accurate system identification across a benchmark of 71 attractors.

world modellatent dynamics learning
world2vecDreamerV3TD-MPC2+2

researchΒ· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Efficient Scalable Oversight via Rewinding

Rewindable interactive proofs (RIPs) are a new model of relativizing interactive proofs for scalable oversight, in which a weak verifier can rewind an AI prover to an earlier saved state. The paper builds an RIP for computations robust to changes in a small fraction of oracle answers. The honest prover runs in linear time, the verifier runs in nearly linear time in the input length after one-time preprocessing, and no cryptography is used. A preliminary MNIST experiment shows an RIP can be faster than a deployed proof system.

rewindable interactive proofsdebaterelativizing interactive proofs
arXivMNIST

research, ai-safetyΒ· Added 31 Oct 2026, published 29 Oct 2026

wiz.iowriteupπŸ›‘οΈ Security

The Rise of Agentic Attacks: What They Look Like, and Where They're Headed

Wiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.

WizKubernetesAWS+2
ARTEXHermesStorm-0940+12

Threat Intel, Blue Team & Detection, AI Security, Cloud & InfraΒ· Published and added 29 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CVE-2026-41709 is a low-severity insufficient-logging flaw in VMware ESXi that lets a logged-in administrator perform operations without audit entries. CISA added it to the KEV catalog, and CrowdStrike reported that China-nexus actor Warp Panda used it as a zero-day against US organizations, including law firms, to cut audit visibility. The article also covers exploitation of vCenter bugs CVE-2026-59309 and CVE-2026-59310 and lists the fixed ESXi builds.

VMware ESXiVMware vCenterCrowdStrike
CVE-2026-41709CVE-2026-59309CVE-2026-59310+10

Threat IntelΒ· Published and added 29 Oct 2026

spm.threat-modeling.comtoolπŸ›‘οΈ Security

CISO Security Program Management 2026

Security Posture Management is a web tool that maps 30 CISO-accountable security topics across the five NIST Cybersecurity Framework functions. It tracks current maturity, KPIs, risks and audit findings per topic. It also records target maturity, target dates, accountable owners and review dates, flagging topics unreviewed for 6 months as due and 12 months as overdue. Initiatives link to topics and risks with owner, budget, dates and expected maturity uplift.

NIST Cybersecurity Framework

GRCΒ· Added 29 Oct 2026

divagr.comwriteup🧠 AI

Qwenputer: A functioning, deterministic RISC-V CPU inside Qwen3.5

Qwenputer is a stock Qwen3.5 4B with a 32-bit RISC-V CPU (RV32IM plus Zba and a bignum unit) compiled directly into added layers, with no training. Gated DeltaNet states act as exact RAM via gate 1, beta 1 and one-hot keys. It scores 97.5 to 100% on DeepMind arithmetic sets, and 100% on NUPA long-integer arithmetic. It also has an experimental in-model filesystem. The checkpoint is 18.8 GB and needs the RvChat driver.

Qwen3.5Gated DeltaNetRISC-V+6
QwenputerQwenModelScope+6

research, modelsΒ· Published and added 29 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian, was sentenced in the US to 70 months for conspiracy to commit computer fraud over Nefilim and Hive ransomware attacks. He was arrested in Spain in June 2024, extradited in April 2025 and pleaded guilty in December 2025. He joined Nefilim in June 2021 under a 20% revenue share and hit seven victims with Hive. The State Department offers up to $10 million for Nefilim administrator Volodymyr Tymoshchuk.

NefilimHiveArtem Aleksandrovych Stryzhak+4

Threat IntelΒ· Published and added 28 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CVE-2026-92885 is a critical (CVSS 3.1 9.8, CWE-287) authentication bypass in the Qode Membership WordPress plugin, versions through 2.0.6.2. A misspelled variable in the Facebook token-verification guard skips provider checks, so an unauthenticated attacker with a public nonce can get a session cookie for an existing account, including an administrator. The post gives the fix (2.0.6.3, bundled in Bridge 30.9), KEV/EPSS/SSVC status, and a SOC log-correlation and remediation plan.

WordPressQode MembershipBridge+3
CVE-2026-92885CWE-287Wordfence+4

AppSec, Identity & Access, Blue Team & DetectionΒ· Added 31 Oct 2026, published 28 Oct 2026

endorlabs.comarticle🧠 AI

ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs

ADLC compliance is Endor Labs' interpretation of how NIST SSDF (SP 800-218), the OWASP LLM and Agentic Top 10 lists, and the EU AI Act apply to software built with coding agents. It splits requirements into a code surface and an action surface (shell, files, MCP calls, package installs). It gives a four-step EU AI Act scoping path and says that system prompt rules and agent self-reports are not audit evidence.

CursorClaude CodeModel Context Protocol+3
Endor LabsNISTOWASP+3

ai-policy, coding-agentsΒ· Published and added 28 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs

ADLC compliance guide from Endor Labs that maps agentic development to NIST SSDF (SP 800-218 v1.1), the OWASP LLM Top 10 2025 and Agentic Top 10, and the EU AI Act as amended by Regulation (EU) 2026/1744. It splits controls into a code surface and an action surface (shell, file access, MCP calls, package installs). It gives a four-step AI Act scoping path, the new Annex III date of 2 December 2027, and evidence guidance. It states the crosswalk is the vendor's interpretation, not legal advice.

Endor LabsModel Context ProtocolClaude Code+3
NIST SSDFNIST SP 800-218NIST SP 800-218A+13

GRC, AI Security, Supply ChainΒ· Published and added 28 Oct 2026

endorlabs.comarticleπŸ›‘οΈ Security

The ADLC maturity model: 5 stages of agentic development security | Endor Labs

The ADLC maturity model is a proposed five-stage framework from Endor Labs for scoring security controls over coding agents, from unmanaged experimentation to continuous verification. Each stage has requirements on two tracks, agent actions (shell commands, MCP calls, package installs) and agent output (code, dependencies, secrets). It sets stage 3 at deterministic hooks that block actions, gives evidence-based assessment questions, and lists traps such as relying on prompt-level rules.

Endor LabsAURIModel Context Protocol+2
ADLC maturity modelOWASP SAMMOWASP Top 10 for LLM Applications+5

AI Security, GRC, DevSecOpsΒ· Published and added 28 Oct 2026

decrypt.coarticle🧠 AI

OpenAI Proves ETH Is False, and Crypto Twitter Has Questions

Decrypt reports that OpenAI published a 67-page paper (dated 17 October 2026, revised 25 October) claiming its AI found a deterministic subexponential-time algorithm for counting 3-SAT solutions, which would refute the Exponential Time Hypothesis. The proof was formalized in Lean. Impagliazzo, Paturi and Ryan Williams are reviewing it independently and say this is not certification. Anthropic posted a Claude-credited 3-SAT paper on 26 October.

LeanGitHubClaude
OpenAIAnthropicDecrypt+7

research, modelsΒ· Published and added 27 Oct 2026

jfrog.comarticleπŸ›‘οΈ Security

The Impact of AI on CVEs: Industry Challenges

Part 1 of a JFrog Security Research series on how AI has changed CVE research. It shows rising CVE volumes since 2021, curl ending its bug bounty in January 2026, GNOME cutting disclosure from 90 to 30 days, and NIST narrowing NVD enrichment in April 2026. It documents severity inflation in 27 libcurl CVEs and 54 of 55 fabricated SQLite advisories.

NVDCVSScURL+3
CVE-2026-46529severity inflationAI slop+12

AI Security, AppSecΒ· Added 28 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🧠 AI

OpenGray: a benchmark for evaluating the decisions of radiotherapy planning agents

OpenGray is a benchmark that adds tasks with known correct decisions to the OpenKBP-Opt head-and-neck dataset, including two overlap contradictions with provably incompatible dose goals and a feasible control. Four planning systems, from a rule-based script to a full LLM agent, were tested on 30 patients with Terra and Ministral 3 8B. Decision accuracy reached 95.4% and 92.1%, yet only 50% and 25% of overlap contradictions were escalated. SAGE logs of 39 radiosurgery runs showed an agent that lacked an action for stopping.

LLM
OpenGrayOpenKBP-OptSAGE+3

evals, agents, researchΒ· Added 28 Oct 2026, published 27 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

AI Agents Found a Way Into Anthropic's Business Systems in Under 12 Hours

Decrypt reports that Cathedral, a startup founded by four former DOGE staffers, says its AI agents found paths into Anthropic's sales, HR and IT systems in under 12 hours through unnamed third-party administrative and sales software. Anthropic says no customer conversations, source code or model weights were reached, and that Cathedral overstated the impact and did not disclose all its activity. The testing ran through a bug-bounty-style program.

AnthropicClaudeClaude Code+1
CathedralDOGEWashington Post+1

AI Security, Threat Intel, Offensive SecurityΒ· Published and added 26 Oct 2026

arxiv.orgpaper🧠 AI

SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments

SymLift is a compile-free vulnerability detection framework for code fragments that lack project context. A fine-tuned LLM reconstructs control-flow, data-flow, memory and resource relations as a constrained LLVM-like IR, and a deterministic parser turns it into facts for Datalog rules that give findings with derivation traces. SymLift-Qwen-7B reaches 94.41% Target-F1 on FormAI and 91.66% micro-averaged Target-F1 on MegaVul.

LLMQwenDatalog+3
SymLiftSymLift-Qwen-7BFormAI+2

research, trainingΒ· Added 28 Oct 2026, published 25 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Maximum-Likelihood Decoding of Gabidulin Codes Is NP-Hard Even in Dimension One

Philippe Gaborit proves that maximum-likelihood decoding of Gabidulin codes is NP-hard even for dimension one: deciding rank distance at most n-2 from the code {Ξ»g} is NP-complete. The reduction is deterministic, so Rank Syndrome Decoding and Rank Minimum Distance for F_{q^m}-linear codes are NP-complete under deterministic reductions, where the earlier reduction was randomized. It goes through a new pivot problem, Twisted Square Membership.

Gabidulin codes
Philippe GaboritGuruswami-Vardy theoremTwisted Square Membership+2

otherΒ· Added 26 Oct 2026, published 25 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Revisiting AES Key Wrap: Forgery Bounds, Structural Observations, and Recommendations for the Revision of NIST SP 800-38F

Revisiting AES Key Wrap is an ePrint paper (2026/2636) by John Preuß Mattsson, expanded from technical comments to NIST on the SP 800-38F revision. It shows the stated forgery probabilities ignore adaptive attacks and gives corrected bounds for KW, KWP and TKW. It also shows KW lacks beyond-birthday-bound security, since a forgery leaks a plaintext prefix and an encryption-only distinguisher exists.

AES Key WrapAES
NISTNIST SP 800-38FKW+4

other, GRCΒ· Added 26 Oct 2026, published 25 Oct 2026

arxiv.orgpaper🧠 AI

The Geometry of Metaphor: Probing and Steering Metaphor Representations in Large Language Models

The Geometry of Metaphor is an October 2026 arXiv preprint that uses mechanistic interpretability to find causal subspaces for metaphor in LLMs of different architectures and sizes. The authors steer output on classification tasks across parts of speech. They also steer generation tasks, showing the metaphoricity of model output can be controlled. The abstract gives no model names or metrics.

LLM
arXiv

researchΒ· Added 24 Oct 2026, published 22 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

SHAKEing SLH-DSA with Non-profiled SCAs

SHAKEing SLH-DSA with Non-profiled SCAs is an eShard ePrint paper (2026/2584) on correlation power analysis of SLH-DSA-SHAKE, the NIST-standardised hash-based signature scheme. It analyses PRF inputs and selection functions, then combines subtrace averaging, partial-then-total CPA and an efficient exhaustive search to recover the full secret seed, enabling universal forgery. On a 32-bit microcontroller the attack needs about 280 to 559 signatures, and the search finishes within 45 minutes on 72 cores.

SLH-DSASHAKEKeccak
NISTuniversal forgerySPHINCS+

Hardware & RFΒ· Added 24 Oct 2026, published 21 Oct 2026

simonwillison.netwriteup🧠 AI

Battle Drones - a vibe coded RTS with audio-based multiplayer

Battle Drones is a browser-based Command & Conquer style RTS that Simon Willison built over 12 iterations and 321 commits, mostly with Claude Code and Claude Opus 5.5. The post gives key prompts and transcripts per version, including the "Make it a LOT more fun" run in Ultracode mode. It also covers an Agent vs. Agent mode for LLMs, audio-modem multiplayer between nearby phones, and lessons on deterministic simulation and code-generated 3D models and music.

Claude CodeTypeScriptThree.js+6
Simon WillisonClaude Opus 5.5Claude Fable 5+5

coding-agents, agentsΒ· Published and added 20 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

Paper on memory injection, where prompt injection persists across sessions through the long-term memory of LLM-as-a-service platforms. It presents a general threat model and shows all NIST attack goals are achievable on ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash. Vectors include personal memories, projects, skills, organization instructions and MCP resources. On Claude, shared memory lets an attacker compromise multiple users in an organization and exfiltrate prompts. Nearly half of the derived mitigations are unimplemented.

ChatGPTClaudeGemini+2
memory injectionprompt injectionNIST+2

AI SecurityΒ· Added 24 Oct 2026, published 20 Oct 2026

arxiv.orgpaper🧠 AI

Benchmarking Arabic Dialects for Math Problems

DAR-MGSM (Dialectal Arabic Multilingual Grade School Math) is a manually curated benchmark for mathematical reasoning in Dialectal Arabic. It covers five major Arabic dialects plus Modern Standard Arabic, in a translated-only version and a translated and culturally localized version. Eleven Arabic-centric and multilingual LLMs were tested: accuracy generally drops on the localized version, and a mechanistic interpretability analysis shows the two variants induce distinct internal reasoning trajectories.

LLM
DAR-MGSMarXiv

evals, researchΒ· Added 22 Oct 2026, published 20 Oct 2026

github.blogarticle🧠 AI

How 3 Java Champions are using GitHub Copilot for increased productivity

Interviews with three Java Champions (Vlad Mihalcea, Patrick Baumgartner, Frank Delporte) on using GitHub Copilot in production and open source. Examples include a 900-slide Reveal.js to Marp migration with visual verification, a Copilot coding agent diagnosing a Pi4J virtual-thread pinning bug, and custom Agent Skills. Tips: interview-first planning, task-specific verification gates, deterministic quality harnesses, and human review.

GitHub CopilotJavaIntelliJ IDEA+12
GitHubVlad MihalceaPatrick Baumgartner+7

coding-agents, prompting, ai-policyΒ· Added 29 Oct 2026, published 20 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

US Agencies Detail Incident Response Practices for Rogue AI Agents

SecurityWeek summarizes the NIST, NSA and CISA report "Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation". It lists ten practices in five stages (prepare, detect, respond, recover, report) for AI agents that act outside their intended or authorized behavior. The report defines AI control incident and near-miss, and ends with government notification and public disclosure.

NISTNSACISA+3

AI Security, GRC, Blue Team & DetectionΒ· Published and added 20 Oct 2026

github.comrepo🧠 AI

DeepInfer: High-performance inference framework for DeepSeek models

DeepInfer is DeepSeek's open-source inference framework for offline inference of DeepSeek-V4.1-Flash, released under Apache 2.0. It covers attention data parallelism, MoE expert parallelism with load balancing, draft-token decoding with confidence-scheduled verification, batch-invariant inference, deterministic sampling and structured outputs. It runs on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs. The KV cache system, prefill/decode disaggregation and load balancing are not included.

DeepInferFlashMLADeepGEMM+13
DeepSeekDeepSeek-V4.1-FlashNVIDIA

inferenceΒ· Added 21 Oct 2026, published 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium

FN-DSA on Arm Cortex-M55 is an ePrint paper presenting the first FN-DSA (NIST post-quantum signature) implementation on this core that reproduces the reference known-answer tests and runs in constant time. It uses the native FP64 FPU for signing and Helium (MVE) for NTT, key-generation FFT and Keccak, with SLOTHY rescheduling. Key generation, signing and verification are up to 1.23x, 1.93x and 1.30x faster than the reference, and four-signature batch verification up to 1.75x.

FN-DSAARM Cortex-M55Helium+2
NISTknown-answer tests

Hardware & RFΒ· Published and added 20 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Energy Consumption of Post-Quantum Cryptography on Constrained and General-Purpose Architectures

Benchmark of the three NIST post-quantum standards, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), measuring speed and energy for key generation, signing and verification. Tests ran on Raspberry Pi 1, Zero and 4 and on laptop hardware, using OpenSSL 3.5 and a FNIRSI FNB58 USB power meter. ML-KEM and ML-DSA match classical elliptic-curve cryptography, while SLH-DSA signing on 32-bit devices cost up to 243% more energy than on 64-bit.

OpenSSLRaspberry PiFNIRSI FNB58
ML-KEMML-DSASLH-DSA+5

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

ASTOR: Benchmarking and Improving Autoformulation for Soft-Constraint Optimization with a Formal Grammar

ASTOR is an inference-time framework that has an LLM map a natural-language decision problem to a grammar-guided abstract syntax tree, then deterministically compiles it into executable optimization code. The paper also introduces SoftOR, a benchmark of natural-language problems with soft constraints. On SoftOR, ASTOR has the best aggregate accuracy among comparable single-request and multi-agent LLM methods, and it stays competitive on hard-constraint-only autoformulation benchmarks.

LLM
ASTORSoftORarXiv

research, evalsΒ· Added 21 Oct 2026, published 19 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

ConnectWise Suspends Cloud Services in Response to Cyberattack

ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services in October 2026 after a compromised application credential was used to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 tenants on 15 to 16 October and attacker IP 144.172.64[.]128 try nearly 1,000 Entra tenants, with over 300 successful sign-ins. In one tenant, the Cloud Management Teams app added itself to Global Administrator and added client secrets to other apps. No restoration timeline has been given.

Microsoft 365Microsoft Entra IDHuntress+2
ConnectWise Cloud BackupConnectWise Cloud ManagementSkyKick+5

Threat Intel, Identity & Access, Blue Team & DetectionΒ· Published and added 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

From if to Oops: Turning a conditional into a key-recovery oracle

The paper presents a fault attack on deterministic CSIDH and OSIDH-LD. Forcing the lane-selection mask to zero (for example by skipping one instruction) makes output changes reveal whether a secret exponent reaches a threshold. Binary search then recovers the full key in at most 297 queries for OSIDH-LD and 222 for deterministic CSIDH with CSIDH-512-sized keys. Full OSIDH-LD keys were recovered in software fault simulation, and a ChipWhisperer-Lite skipped the target instruction with probability at least 0.94. The authors argue fault resistance requires giving up determinism and propose randomization countermeasures.

CSIDHOSIDH-LDChipWhisperer-Lite
deterministic CSIDHCSIDH-512Houben+6

Hardware & RFΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Provable Lattice Reduction in Nearly the Time of QR Factorization

Provable Lattice Reduction in Nearly the Time of QR Factorization (IACR ePrint 2026/2541, October 2026) presents a deterministic lattice-reduction algorithm with running time Γ•(n^Ο‰(1+log ΞΊ_col(B))), free of heuristic assumptions. Its implementation used fewer instructions than flatter (CRYPTO 2023) in all 153 runs on q-ary, NTRU-like, scaled q-ary and Coppersmith inputs. Median flatter-to-new instruction ratios are 1.55 for q-ary and 1.86 for NTRU-like inputs.

flatter
CoppersmithLLL

otherΒ· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Enjoy FAEST on Hardware: Efficient and Novel Hardware Acceleration of Emerging Post-Quantum Digital Signature Scheme FAEST

This ePrint paper (2026/2525, October 2026) by Brendan Funk and Jiafeng Xie presents the first hardware accelerator for FAEST, an MPC-in-the-head post-quantum signature in NIST's Round 3 additional-signature process. It analyses FAEST's compute-heavy operations, builds them into hardware blocks, and adds an L1-EM-fast variant. The authors report at least 98% lower equivalent area-delay product than the recent complete SDitH design at the same security level.

FAESTFPGA
NISTSDitHMPC-in-the-head+2

Hardware & RFΒ· Added 19 Oct 2026, published 18 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

DPA-style Attacks on VOLE-in-the-Head Signature Schemes

Presents the first DPA-style power side-channel attack framework against VOLE-in-the-Head signature schemes, targeting the secret witness whose recovery enables forging signatures on arbitrary messages. It analyzes leakage from sensitive intermediate values in VOLE correlations and proposes six attack classes (two vertical, four horizontal) on FAEST and SDitH, both in NIST's third round of additional signatures. Attacks are validated with simulated leakage under varying noise and real measurements on three ARM Cortex-M4 devices.

ARM Cortex-M4
FAESTSDitHNIST+2

Hardware & RFΒ· Published and added 17 Oct 2026

coindesk.comarticleπŸ›‘οΈ Security

β€˜Wow, it’s a real discovery’: Claude cracks a 25-year NSA number mystery

CoinDesk reports that an Anthropic internal research model traced five NSA-supplied NIST elliptic-curve seeds to the C library generator lrand48 fed with 1997–98 timestamps. It matched P-256's published seed at the 1,842nd candidate, in under 30 minutes and without being told about the earlier "forgotten phrase" theory. This makes a hidden backdoor in the NIST curves less likely, though why some candidates were skipped and how other curve parameters were chosen remain unexplained. The article also explains why Bitcoin's secp256k1 was never part of the question, and that quantum risk is a separate threat.

ClaudeAnthropiclrand48+1
NISTNSAP-256+9

AI Security, otherΒ· Published and added 17 Oct 2026

coindesk.comarticle🧠 AI

β€˜Wow, it’s a real discovery’: Claude cracks a 25-year NSA number mystery

CoinDesk reports that an internal Anthropic research model traced five unexplained seeds behind the NSA-supplied NIST elliptic curves to lrand48, an old C random-number generator fed with 1997–98 timestamps. It took under 30 minutes. The model matched the P-256 seed at the 1,842nd candidate. Its reasoning trace briefly wondered whether it was in a simulated test before concluding the discovery was real. The result makes a hidden backdoor less likely and claims a $36,864 bounty, donated to ISRG. The article also explains why Bitcoin's secp256k1 was never affected, and that quantum computing is a separate threat.

Claudelrand48elliptic-curve cryptography+5
AnthropicNSANIST+10

models, researchΒ· Published and added 17 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Associated-Data Correlations in Eevee: Deterministic Forgeries against Nonce-Misuse Security

Cryptanalysis of the Eevee forkcipher-based AEAD modes Umbreon and Espeon, which claim online AE security under nonce reuse. Associated-data correlations give probability-one non-empty-message forgeries with three encryption queries and one verification query. The paper adds an affine treatment of partial final blocks (n-r+3 queries, or n-r+2 with adaptive choices). It also checks the published Umbreon attack with the official ForkSkinny primitive and reports a two-query attack accepted by the unmodified public C modes.

EeveeForkSkinnyC
UmbreonEspeonnonce misuse

otherΒ· Published and added 17 Oct 2026

huntress.comwriteupπŸ›‘οΈ Security

ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

Huntress documents abuse of ConnectWise Cloud Backup (formerly SkyKick) vendor app credentials, used on October 15 from 144.172.64[.]128 to obtain Microsoft Graph tokens in at least 162 customer M365 tenants via client assertion. In one tenant, a ConnectWise Cloud Management Teams app self-assigned Global Administrator and added client secrets to an MSP management app and Huntress's own app, a persistence technique. The post lists application IDs, Entra sign-in and audit-log checks, user-agent indicators (kiota-dotnet vs Python-urllib/3.12, curl/7.88.1), and mitigation steps such as disabling (not deleting) the enterprise apps and reviewing added credentials.

Microsoft 365Microsoft Entra IDHuntress+1
ConnectWiseSkyKick144.172.64.128+7

Threat Intel, Identity & Access, Blue Team & DetectionΒ· Added 17 Oct 2026, published 16 Oct 2026

anthropic.comwriteupπŸ›‘οΈ Security

Claude reveals ECDSA curve origins

Anthropic's Frontier Red Team reports that Claude recovered how the NIST P-192/224/256/384/521 and ANSI X9.62 curve seeds were generated. They are outputs of the C library's lrand48 LCG seeded with 1997–98 Unix timestamps, not hashes of a passphrase. The method scanned for weak-PRNG signatures, then used LLL lattice reduction to recover the truncated LCG state and stepped it back to srand48 initialization. Claude also traced some base points to the FreeLIP/NTL random generator. Reproducible Python is included. The authors say this is not an attack and makes deliberate backdoors less plausible. The B-163 seed and the base points of P-224/256/384/521 and the binary curves remain unexplained.

ClaudeNTLFreeLIP+1
NISTECDSANIST P-256+16

otherΒ· Added 17 Oct 2026, published 16 Oct 2026

anthropic.comwriteup🧠 AI

Claude reveals ECDSA curve origins

Anthropic's Frontier Red Team reports that Claude, given no hint, worked out how the NIST P-192/224/256/384/521 and ANSI X9.62 curve seeds were generated. They came from the C library's lrand48 LCG seeded with Unix timestamps from 1997–98, not from a hash of a phrase. Claude found this by scanning for weak-PRNG signatures and recovering the PRNG state with LLL lattice reduction. It also traced several prime-curve base points to the FreeLIP random generator. The post includes Python code that reproduces the seeds and base points. It says this is not an attack and makes backdoor claims less plausible. B-163 and the other base points remain unexplained.

ECDSAlrand48LLL+4
AnthropicClaudeNIST+10

researchΒ· Added 17 Oct 2026, published 16 Oct 2026

microsoft.comarticleπŸ›‘οΈ Security

Managing open-weight model risk in enterprise deployments

Microsoft blog post introducing "Risk Management for Open-Weight Models in Enterprise", a joint Microsoft–NVIDIA paper. It proposes a shared risk taxonomy (Cybersecurity, Data Protection, Content, Human-AI Interaction, Bias) grounded in ISO standards and the NIST AI RMF. The paper maps evaluations to risks as evidence and argues that risk depends on the model, use case, deployment and safeguards, not on weight openness alone. It also covers how responsibility for controls shifts when enterprises self-host models, and points to a joint repository of evaluations. The first paper focuses on the model layer; runtime, harness and application layers are planned for later.

Microsoft FoundryNVIDIA
NIST AI RMFISO

GRC, AI SecurityΒ· Published and added 16 Oct 2026

microsoft.comarticle🧠 AI

Managing open-weight model risk in enterprise deployments

Microsoft's announcement of "Risk Management for Open-Weight Models in Enterprise", the first paper in a planned joint series with NVIDIA. It proposes a taxonomy of five risk categories (Cybersecurity, Data Protection, Content, Human-AI Interaction, Bias). The approach is grounded in ISO standards and the NIST AI Risk Management Framework. It maps evaluations to risks as evidence, stresses that weight openness alone doesn't determine risk, and explains how self-hosting shifts responsibility for safeguards. A joint repository will collect evaluations, and later work will cover the runtime, harness and application layers.

Microsoft Foundry
MicrosoftNVIDIANIST+7

ai-policy, evalsΒ· Published and added 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Secure Compilation of Probabilistic Side-Channel Countermeasures

Presents a language- and leakage-model-agnostic framework for provably secure compilation of probabilistic side-channel countermeasures. It uses a deterministic leakage-preservation relation that implies preservation of d-NI, d-SNI and cryptographic constant-time without probabilistic proof obligations. The authors prove in Rocq that a model of the Jasmin compiler's core pipeline and several optimizing passes preserve security in the value-probing model with glitches. They also add source-level annotations to harden against transition leakage and release libmasking, an arbitrary-order masked gadget library in Jasmin that compiles to ARM and RISC-V, with C bindings and hardware benchmarks.

JasminRocqEasyCrypt+3
d-NId-SNIlibmasking+3

Hardware & RFΒ· Added 17 Oct 2026, published 16 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts

A cybersecurity incident at BAE Systems, which runs the Bankruptcy Noticing Center (BNC) for the US judiciary, has stopped all federal bankruptcy courts from generating or sending notices for about a week. The incident was reported to the Administrative Office of the US Courts late on October 9. The National Creditor Registration Service is offline, and notices issued since then have not been delivered. Neither BAE nor the judiciary has said what caused the incident, whether it was a cyberattack, or whether data was compromised. The case shows how a single contractor outage can disrupt a nationwide government function.

BAE SystemsBankruptcy Noticing CenterAdministrative Office of the US Courts+1

Threat IntelΒ· Published and added 16 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Power Analysis on SQIsign via Ideal Reconstruction from Quaternion Leakages

ePrint paper identifying five side-channel vulnerabilities in the signing procedure of Round-3 SQIsign, the isogeny-based signature scheme in NIST's additional post-quantum signature process. It gives polynomial-time algebraic algorithms that recover the secret key from leaked quaternion/ideal intermediate values, including cases where only partial bits leak. It also demonstrates power analysis on the SQIsign source code to extract the needed leakage, which earlier work on Round-1 or toy parameters did not do.

SQIsign
NISTideal reconstruction

Hardware & RFΒ· Added 17 Oct 2026, published 16 Oct 2026

github.comrepoπŸ›‘οΈ Security

gichirimaku/wp2shell-PoC

wp2shell-PoC is a Python proof-of-concept exploiting a pre-authentication RCE chain in WordPress core, combining CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (SQL injection in WP_Query). It demonstrates escalation from the route-desync bug through blind SQLi, customize_changeset forgery, and hook re-entry to administrator account creation and arbitrary command execution via a malicious plugin upload. The tool supports vulnerability checking, data extraction (union, error-based, blind techniques), and full shell access with or without existing admin credentials.

WordPressPython
CVE-2026-63030CVE-2026-60137SQL injection+1

AppSec, Offensive SecurityΒ· Added 23 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Structural Cryptanalysis of the Eevee AEAD Family

ePrint paper cryptanalysing Eevee (Umbreon, Jolteon, Espeon), forkcipher-based AEAD modes proposed at CCS 2023 for IoT-to-cloud computation. It gives a two-encryption AD-free prefix distinguisher, a four-encryption nonce-misuse distinguisher, a deterministic AD-only forgery, and nonce-respecting forgeries on Jolteon and Espeon (fresh one-block forgery reusing the tag; arbitrary AD substitution). It traces these to proof flaws (online-prefix consistency, domain separation, checksum freshness), derives design requirements, and concludes the failures are in the mode design, not the C implementation.

C
EeveeUmbreonJolteon+2

otherΒ· Published and added 15 Oct 2026

nachi065.github.iootherπŸ›‘οΈ Security

AI Security Wiki: Governance, Risk, Standards and Test Cases

A vendor-neutral AI Security Wiki acting as an implementation layer for enterprise AI adoption: risk methodology, AI risk register, control objectives library, domain standards (browser/IDE AI, runtime apps, agentic AI, sovereignty), vendor evaluation framework, and audit/evidence checklists. It includes a 653-case product evaluation test library across 17 lifecycle layers and 6 emerging domains, plus regulatory hubs for GCC, EU, Australia, Brazil, Canada, China, India, Japan, Singapore, South Korea, UK and US, and crosswalks to FINOS AIGF, NIST AI RMF, ISO/IEC 42001, OWASP, MITRE ATLAS, ISO 27001 and others. Useful as a template and evidence source for teams building AI governance and assurance programmes.

FINOS AI Governance FrameworkNIST AI RMFISO/IEC 42001+8

GRC, AI SecurityΒ· Added 15 Oct 2026

arxiv.orgpaper🧠 AI

Multi-Reward Hacking: From Aggregation-Induced Drift to Trust-Anchored Defense

The paper shows that symmetric aggregation of a primary reward (correctness) and auxiliary rewards (brevity, efficiency) in LLM post-training can raise aggregate reward while primary-task performance falls. It proves that deterministic conditional-mean GRPO converges to auxiliary-favoring behavior when auxiliary rewards are more reliably obtained. It proposes Trust-Anchored Gating (TAG), which elects an anchor channel by policy drift and gates auxiliary credit on anchor satisfaction. On Qwen3-4B with a brevity reward, TAG reaches 0.581 pass@4 versus 0.220 for additive aggregation, and shortens responses by 44% relative to correctness-only training. Experiments on Qwen and Llama models cover math and program synthesis.

GRPOQwen3Qwen+2
Qwen3-4BarXiv

training, researchΒ· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Exploring Fault Injection Attacks on HQC and BIKE Beyond Fujisaki-Okamoto Verification

Presents fault injection attacks on BIKE and HQC decapsulation that target instructions outside the Fujisaki-Okamoto transform, achieving full key recovery with only valid ciphertexts at NIST Level 1 (17392 queries for HQC, about 3 million for BIKE). It also gives a general method for finding effective fault locations by analysing decoder behaviour under perturbed conditions. Attacks were validated with laser fault injection on an STM32H7 microcontroller, showing a wider attack surface for code-based post-quantum KEM implementations.

HQCBIKESTM32H7
Fujisaki-Okamoto transformlaser fault injectionkey recovery+1

Hardware & RFΒ· Published and added 15 Oct 2026

latent.spacearticleπŸ›‘οΈ Security

Crossing the Threshold: How OpenAI and Anthropic Approach Autonomy and Safety in Financial Agents

Recap of AI Engineer New York talks on balancing agent autonomy and safety in financial services. Bloomberg's Andrey Rybka argued for deterministic controls outside the model: scoped credentials, tool-call checks, outbound traffic limits, audit trails, budgets and kill switches. He cited a case where an agent obeyed instructions embedded in a marketplace review. Anthropic described a trust layer of identity and permissions, sandbox and approval, and regression checks, with agents proposing rather than making order amendments. Two Sigma described composable controls, including auto-mode classifiers that escalate only important requests, to avoid approval fatigue. OpenAI framed human-in-the-loop as a product design choice.

ChatGPTClaude
prompt injectionTwo SigmaBloomberg+1

AI SecurityΒ· Published and added 14 Oct 2026

latent.spacearticle🧠 AI

Crossing the Threshold: How OpenAI and Anthropic Approach Autonomy and Safety in Financial Agents

Latent Space recap of AI Engineer New York keynotes on balancing agent autonomy with safety in finance. OpenAI's Joseph Kim frames human-in-the-loop as a product design decision and predicts agents doing investment idea generation and trading by 2027. Two Sigma's John Feminella describes composable controls such as auto-mode classifiers to avoid approval fatigue. Anthropic's Keon Shahab lays out a trust layer: identity and permissions, sandboxed approval, and regression checks, with agents proposing actions rather than executing them. Bloomberg's Andrey Rybka argues for deterministic controls outside the model: scoped credentials, tool-call checks, audit logs, budgets and kill switches.

ChatGPTClaude
OpenAIAnthropicTwo Sigma+10

agents, ai-policyΒ· Published and added 14 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Quantum-Aware Key Rank for Side-Channel Attacks evaluation

Proposes a cost model and metric for an adversary who collects side-channel traces classically and finishes the key search on a quantum computer. Shows any quantum algorithm needs Omega(sqrt(r)) cipher evaluations for key rank r, and that the quadratic advantage holds only up to a rank bound set by the NIST MAXDEPTH budget (about 2^58.6 for AES-128 at D=2^40). Defines a quantum-aware key rank computable from existing rank estimators, with simulated-leakage experiments showing a depth-limited quantum adversary is worth about 22 traces at SNR 0.125.

AES
NIST MAXDEPTHGrover's algorithmquantum search with advice+4

Hardware & RFΒ· Added 16 Oct 2026, published 14 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

edaBits in the Exponent (edaBitE) and Issuer-Hiding Blind Signatures from ML-DSA and VOLE-in-the-Head

Presents the first blind signature in which the issuer runs unmodified NIST-standardized ML-DSA, so it works with certified secure elements. Issuance is an ML-DSA signature on a commitment. The blind signature is a VOLE-in-the-head zero-knowledge proof of knowledge of that signature, about 1 MB, under 1 s to produce and 0.5 s to verify. Security reduces to ML-DSA EUF-CMA and the proof system. Issuer-hiding and selective disclosure add a few tens of KB. The paper also introduces edaBitE, a batch consistency check between binary and prime-field commitments that replaces the costly edaBits checks.

ML-DSAVOLE-in-the-Head
edaBitEedaBitsNIST+1

Identity & AccessΒ· Published and added 14 Oct 2026

eprint.iacr.orgpaper🧠 AI

DPF-SGD: Byzantine-Robust Differentially Private Federated SGD with Exact Optimality Guarantees

DPF-SGD is a federated SGD algorithm that stays robust to Byzantine agents while satisfying Ο΅-differential privacy. It combines private step sizes with a DP noise-decay schedule and adds a privacy-preserving comparative elimination (PPCE) filter that suppresses Byzantine updates during aggregation. The authors prove almost-sure convergence to the global optimum despite persistent noise and adversaries. On synthetic and MNIST data, final optimization error is one to two orders of magnitude lower than DP baselines.

DPF-SGDSGD
MNIST

research, trainingΒ· Published and added 14 Oct 2026

unit42.paloaltonetworks.comarticleπŸ›‘οΈ Security

The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk

Unit 42 case study of an intrusion at a European bank that began through a third-party-managed VPN gateway lacking strict authentication. The attacker used compromised credentials, ran noisy network scans, brute-forced administrator accounts and scraped internal documentation. A WSUS remote code execution attempt on the configuration management server was stopped by Cortex XDR, and threat hunting found no persistence.

Cortex XDRCortex XSIAMWindows Server Update Services+1
Unit 42third-party riskbrute force

Blue Team & Detection, Identity & AccessΒ· Added 30 Oct 2026, published 13 Oct 2026

x.comthreadπŸ›‘οΈ Security

DFIR Radar (@DFIR_Radar) on X

Describes an Oracle Cloud Infrastructure Identity Domains authorization bypass where a User Manager AppRole could create API keys (also SMTP credentials and auth tokens) for the Identity Domain Administrator via POST /admin/v1/ApiKeys on the SCIM API, with no classic IAM policy grant. The flaw sits in the gap between classic OCI IAM policies and AppRoles; it was patched in Oracle's June 2026 critical update. Gives responders hunting guidance: review Identity Domains SCIM audit events (/admin/v1/AuditEvents, resourceType ApiKey) for admin-account keys created by actors lacking the admin AppRole, and audit User Manager/User Administrator assignments, using OCInferno to graph AppRole-to-policy paths.

Oracle Cloud InfrastructureOCI Identity DomainsSCIM
OCInfernoNetSPIAppRole+2

Cloud & Infra, Identity & Access, Blue Team & DetectionΒ· Published and added 13 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Towards Safe Autonomy for Computer Use

Introduces SA-CUA, a dual-LLM framework that gives Computer Use Agents a trust boundary against indirect prompt injection. It derives conservative deterministic rules from the accessibility tree to unmask trusted screen regions for the privileged LLM, and adds an endorsement channel that moves values from untrusted to trusted domains by verification. Human input is needed only at task specification. It reports much higher utility than CaMeL-CUA with a zero attack success rate.

LLM
SA-CUACaMeL-CUACaMeL+2

AI SecurityΒ· Added 15 Oct 2026, published 13 Oct 2026

arxiv.orgpaper🧠 AI

Towards Safe Autonomy for Computer Use

Introduces SA-CUA, a dual-LLM framework for Computer Use Agents (CUAs) that defends against indirect prompt injection. It builds a trust boundary by deriving conservative deterministic rules from the accessibility tree, which unmask trusted screen regions in the privileged LLM's screenshot and keep untrusted content separate. An endorsement channel lets values move from the untrusted to the trusted domain through verification over trusted channels. This removes the need for per-action user confirmation and the confirmation fatigue it causes. SA-CUA is reported to keep much higher utility than CaMeL-CUA with a 0% attack success rate.

LLM
SA-CUACaMeL-CUACaMeL

agents, researchΒ· Added 15 Oct 2026, published 13 Oct 2026

github.comrepo🧠 AI

BijectiveLabs/bitra

bitra (CLI name tra) is an MIT-licensed Python framework from Bijective Labs for autonomous trading agents. Language models only read system-computed figures and give opinions, while deterministic code prices the round trip, applies declared limits, sizes the trade and sends one order with stop attached. Every cycle's briefs, answers and refusals are stored on disk with hashes. It supports many model providers and ccxt venues, with sandbox, demo and mainnet tiers.

PythonPyPIuv+7
Bijective Labsgpt-oss-120bgpt-oss+7

agents, ai-infraΒ· Added 25 Oct 2026, published 13 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, where tool calls, shell commands and agent-written scripts all appear as the same file and network operations. A declarative trust policy decides most effects deterministically and defers the rest; deferred effects are held while the agent continues speculatively, and a bounded-authority decision oracle (an LLM or a human) releases or refuses them based on the trace. Across three benchmarks and three agent models it beats existing defenses on the attack-success/utility trade-off; on AgentDojo it cuts attack success from 47.0% to 2.7% with no loss of benign utility.

LLM
indirect prompt injectionAgentDojo

AI SecurityΒ· Added 15 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Master-Key Recovery from Internal Activation Leakage in ReLU Realizations of Camellia

The paper builds explicit ReLU neural-network realizations of Camellia-128/192/256 from exact Boolean gates, S-box selectors and bit permutations, and reports known-answer-test agreement for Camellia-128. It shows that whitening and round-key quantities leaked from internal activations determine the master key through public key-schedule identities. Under a synthetic internal-oracle model, symmetric real-valued perturbations recover subkey bits with 128 queries (Camellia-128) or 256 (Camellia-256). Camellia-192 is handled by deterministic key-schedule inversion from direct access to round keys. All 3,000 trials (1,000 keys per variant) recovered the key exactly. The authors state this is not a plaintext/ciphertext-only attack on standard Camellia.

Camellia
Kwangjo Kim

otherΒ· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

On the Expected Number of Iterations in ML-DSA Signing: A Complete Accounting of the Rejection Conditions

ePrint paper showing that FIPS 204 Table 1's expected iteration counts for the ML-DSA signing loop cover only the line-23 validity checks (z and r0 norms). They omit the two line-28 encoding-correctness checks (β€–cΒ·t0β€–βˆž and hint weight). It accounts for all four conditions: z by exact counting, cΒ·t0 by an Irwin-Hall tail, and hint weight by a closed-form conditioned per-coefficient probability with a Monte Carlo tail estimate. Corrected expected iterations are 4.36, 5.14 and 3.91 for ML-DSA-44, -65 and -87, within 0.14% of an end-to-end measurement and consistent with NIST's FIPS 204 errata.

CRYSTALS-Dilithium
ML-DSAFIPS 204NIST+2

otherΒ· Added 14 Oct 2026, published 12 Oct 2026

endorlabs.comarticle🧠 AI

Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC | Endor Labs

Explains how lifecycle hooks in Claude Code (.claude/settings.json) and Cursor (.cursor/hooks.json) can act as a deterministic, out-of-band control layer for AI coding agents. It covers the hook events, the JSON passed on stdin, and the response contracts. Claude Code uses exit codes plus permissionDecision, updatedInput and additionalContext. Cursor uses stdout JSON with permission and userMessage. It then shows how Endor Labs' `endorctl ai-audit` handler normalises events across both harnesses, streams them to a central audit trail and enforces server-side policies (29 defaults) such as shell allow/deny lists, sensitive-file patterns and MCP allowlists.

Claude CodeCursorendorctl+3
Endor LabsAURI

coding-agents, ai-policyΒ· Published and added 12 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

StableJudge: A Lightweight Adversarial Defense Framework for LLM-as-a-Judge

StableJudge is a defense framework against score-hijacking prompt injection in LLM-as-a-Judge pipelines (e.g. paper review, recommendation). A compact 0.13B "Sentry" model localizes injected spans and sanitizes them before the judge scores the content, trained on adversarially evolving attacks, and deterministic fine-grained scores are derived from the judge's output distribution. It improves score recovery under attack on held-out scientific abstracts and out-of-distribution attack variants while preserving general performance, decoupling safety from judge model scale. Code and data are promised but not yet released.

LLM
prompt injectionindirect prompt injection

AI SecurityΒ· Added 15 Oct 2026, published 12 Oct 2026

huntress.comarticleπŸ›‘οΈ Security

CMMC Level 2 Non-Negotiable Requirements Explained | Huntress

Explains the "non-negotiable" requirements for a Conditional CMMC Level 2 (Self) status under 32 CFR 170.21. The minimum score is 88 of 110, every 3- and 5-point NIST SP 800-171 requirement must be implemented, plus a short list of 1-point ones. Those mandatory items add up to 64 points, which leaves 24 of the remaining 46 one-point requirements to choose. It also covers how this differs from legacy DFARS 252.204-7019/7020 self-assessments scored with the DoDAM (-203 to 110), and how the 180-day POA&M closeout window can silently expire a status in SPRS. The post ends with a Huntress product mapping.

CMMCNISTNIST SP 800-171+10

GRCΒ· Published and added 12 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CyberForge's CVE of the Day #075 covers CVE-2026-108860, a critical (CVSS 9.1 v3.1 / 9.3 v4.0) authentication bypass in SciSharp BotSharp through 5.2.0. WebStarter ships a published default HMAC JWT signing secret (CWE-321), so anyone holding it can forge bearer tokens that impersonate known users, including administrators. The post sets out how to confirm the effective key and serving build, a six-step SOC investigation trail, and remediation by rotating the secret. No verified fixed release, KEV entry or EPSS data existed at cutoff, and the linked research is static-only.

BotSharpASP.NET CoreJWT+5
CVE-2026-108860CWE-321VulnCheck+2

AppSec, Identity & Access, Blue Team & DetectionΒ· Added 13 Oct 2026, published 12 Oct 2026

x.comadvisoryπŸ›‘οΈ Security

β™«Whyβ™₯Notβ™ͺ (@Python_s_) on X

Alert on CVE-2026-106610, a critical (CVSS 9.8) incorrect privilege assignment flaw in the miniOrange OTP Verification WordPress plugin, versions 5.5.7 and earlier. Unauthenticated remote attackers can gain elevated permissions, potentially administrator, with no user interaction. Fixed in 5.5.8; no in-the-wild exploitation or public PoC verified. It advises auditing unexpected admin accounts and role changes, and warns that Patchstack's mitigation blocks legitimate requests too.

WordPressCVSS
CVE-2026-106610PatchstackminiOrange OTP Verification+1

AppSec, Identity & AccessΒ· Published and added 11 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Efficient Vectorized Implementation of MQOM

ePrint paper presenting a vectorized implementation of the MQOM v2.1 post-quantum signature scheme (a NIST additional-signature candidate). It uses a transpose-enabled paired-matrix trick to cut wasted SIMD work and memory traffic. It benchmarks key generation, signing, verification and memory on Arm NEON, x86 AVX2 and AVX-512, with peak dynamic memory down by up to 39.43%. Supplementary experiments check how the matrix-layout optimization carries over to the Round-3 MQOM v3 code. Useful for practitioners assessing the deployment cost of post-quantum signatures.

Arm NEONAVX2AVX-512
MQOMNIST

otherΒ· Added 14 Oct 2026, published 10 Oct 2026

cphpost.dkarticleπŸ›‘οΈ Security

`123456' password used in Danish CPR data breach

News report on the September 2026 breach of Denmark's CPR civil registration database. Attackers abused the legitimate search access of Pays ApS, a two-employee Odense company, where at least three accounts, including the administrator, used the password "123456". An anonymous hacker told Politiken that a leaked password of a former employee at a small Danish company gave initial access, and that they then wrote two programs to pull data out. The access lasted 21 days 17 hours and about 14 million lookups, exposing roughly 8.8M people's names, addresses and CPR numbers. It was detected only through an unusually large invoice. The page is a news round-up, and the other stories are unrelated to security.

CPR registerPays ApSPolitiken+2

Threat Intel, Identity & AccessΒ· Published and added 10 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Flying, Not Floating: Precise Fixed-Point Falcon on Embedded Processors

Presents the first fixed-point FN-DSA (Falcon) signer for microcontrollers, using 32.64 arithmetic in constant-time Cortex-M4 assembly for Falcon-512 and Falcon-1024. Techniques that keep reciprocals, inverse square roots and small constants wide and round once at the consumer restore the precision lost by naive fixed-point. Measured precision supports about 2^99.7 (Falcon-512) and 2^96.7 (Falcon-1024) signing queries per key, against about 2^61.5 and 2^58.7 for double precision and the 2^64 target. The signer needs about 45% fewer cycles than double-precision emulation, at the cost of signing RAM rising from 59n to 83n bytes. The paper also shows which implementation choices lift double-precision c-fn-dsa above 2^64, derives Falcon-1024 key-generation bounds (72.3% of keys accepted vs 8.5% with the Falcon-512 values), and gives recommendations for the fixed-point FN-DSA NIST plans.

FalconFN-DSAARM Cortex-M4+1
NISTDe Almeida Braga

Hardware & RFΒ· Added 12 Oct 2026, published 9 Oct 2026

media.licdn.comwriteup🧠 AI

Claude Code Complete Guide: Hooks, Agents, MCP Tools & Professional Development

A LinkedIn-hosted PDF guide to Claude Code automation. It explains hook configuration in .claude/settings.json (matchers, JSON stdin payloads, exit code 2 to block) and the hook events: PreToolUse, PostToolUse, Notification, Stop, SubagentStop, SessionStart, UserPromptSubmit and PreCompact. Worked examples include sound and TTS alerts with pyttsx3, a regex guard against rm -rf and other dangerous Bash commands, TDD enforcement, auto-formatting with black, ruff and prettier, and session context loading. It adds troubleshooting and a cheat sheet, and its table of contents lists sections on multi-agent observability, slash commands, MCP tools, sub-agents and professional development patterns. The later sections are cut off in the fetched text. It is useful as deterministic guardrails and automation for a non-deterministic coding agent.

Claude CodePythonModel Context Protocol+7
Cursor

coding-agents, agents, mcpΒ· Added 9 Oct 2026

media.licdn.comcourseπŸ›‘οΈ Security

Claude Code Complete Guide: Hooks, Agents, MCP Tools & Professional Development

A LinkedIn-hosted PDF guide to Claude Code hooks, subagents, MCP tools and custom slash commands. It covers the hook configuration in .claude/settings.json, the event payloads (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart), and exit code 2 as the way to block an action. It includes worked examples of safety hooks: a regex-based PreToolUse script that blocks rm -rf, curl piped to a shell, chmod 777 and privileged Docker containers. Other examples are audit logging, TDD enforcement and session context loading. Useful as a practical reference for putting deterministic guardrails around an AI coding agent, though the regex blocklists are easy to bypass.

Claude CodeModel Context ProtocolPython+1

AI Security, LearningΒ· Added 9 Oct 2026

en.cryptonomist.charticleπŸ›‘οΈ Security

Typed decision model vulnerabilities can push AI guardrail fail-open rates to 63%

A study by Erfan Baghaei Potraghloo, posted to arXiv on October 8, 2026, evaluates seven open-weight LLMs used as "typed decision model" guardrails in agent systems (assigning probabilities to caller-defined allow/block options rather than generating text). It finds that six lines of unrelated server-log text raised one model's fail-open rate from 0% to 63%, and that merely renaming the permissive option's label (without changing its definition or the assessed text) drove fail-open rates to 93-100% in four models; a deterministic rule on typed values instead hit 100% accuracy, leading the author to recommend using these models only to triage reviewer workload rather than as sole decision-makers.

LLM
Erfan Baghaei Potraghloo

AI SecurityΒ· Published and added 9 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

UK Targets Cryptomus and TokenSpot in New Russia Sanctions Package

The UK FCDO sanctioned crypto exchange Cryptomus via its Vancouver registered owner Xeltox Enterprises and linked platform Heleket, Kyrgyz firms TokenSpot and Tsunami Payments, and payment processor Processing KG which operates VexPay and is owned by Kyrgyzstan's Ministry of Finance, plus its director Ulan Bukabaev, for allegedly helping Russia evade financial sanctions. Two of the designated entities reportedly processed transactions for the Kremlin backed A7 illicit finance network, which claims to have moved over 90 billion dollars last year, roughly half of Russia's annual military spending. The 38 target package, which also hit oil producers Zarubezhneft and INK Capital and 12 shadow fleet tankers, follows earlier UK and EU action against Justin Sun's HTX and extends a pattern of Western sanctions targeting crypto rails used for Russia sanctions evasion.

CryptomusXeltox EnterprisesHeleket+11

Blockchain, Threat IntelΒ· Published and added 9 Oct 2026

ethereum-magicians.orgthreadπŸ›‘οΈ Security

Hybrid post-quantum stealth addresses (ERC-5564 schemeId 3)

A draft ERC proposing schemeId 3 for ERC-5564 stealth addresses, combining an ML-KEM-768 encapsulation with a secp256k1 ECDH secret so that future quantum computers cannot retroactively deanonymize recipients from the public announcement log, while spending stays classical secp256k1 (and thus still quantum-vulnerable once spent). The post, with a linked reference implementation, test vectors and gas harness, details the key/meta-address format, the payment-secret combiner (hashing both shared secrets and ciphertexts for IND-CCA), the view-tag derivation ordering to avoid quantum tag-narrowing, measured gas cost (111,330 gas per payment on Prague), and open questions around ANO-CCA proofs for standardized ML-KEM, NIST SP 800-56C combiner approval, and downgrade-attack handling when a recipient registers under both schemeId 1 and 3.

Ethereum
ERC-5564ERC-6538EIP-7623+7

BlockchainΒ· Published and added 9 Oct 2026

ethereum-magicians.orgthreadπŸ›‘οΈ Security

ERC-8441: Hybrid post-quantum stealth address scheme

A draft Ethereum ERC (ERC-8441) proposes schemeId 3 for ERC-5564 stealth addresses, combining an ML-KEM-768 encapsulation with a secp256k1 ECDH secret so that quantum adversaries who later break discrete log still cannot deanonymize who was paid in past public announcement logs, protecting against harvest-now-decrypt-later attacks. Spending remains classical secp256k1 and unprotected once quantum computers exist; the authors flag open issues including a documented downgrade attack (recipients registered under both scheme 1 and 3 can still be paid without PQ protection), the lack of a formal ANO-CCA proof for standardized ML-KEM, and a non-NIST-approved secret combiner. It reuses the existing ERC-5564 announcer and ERC-6538 registry with no contract changes, costing 111,330 gas per payment.

Ethereum
ERC-5564ERC-6538ERC-8441+9

BlockchainΒ· Published and added 9 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Provable Subexponential Algorithms for Module-SIS and Module-LWE

ePrint preprint extending the Ducas–Engelberts–Loyer provable subexponential Gaussian sampler (built on Wagner's generalized birthday algorithm) to module matrices over power-of-two cyclotomic rings. It gives provable 2^{O(n/lnln n)}-time algorithms for Module-SIS and for decision and search Module-LWE using only the k+β„“ ring samples provided, plus sample-preserving scalar search-LWE and narrow Module-LWE variants. Separate heuristic estimates suggest these Wagner-style attacks do not reach the NIST security targets of ML-KEM and ML-DSA.

ML-KEMML-DSANIST+4

otherΒ· Added 12 Oct 2026, published 8 Oct 2026

arxiv.orgpaper🧠 AI

OmniCapBench: A Deep-Structured Evaluation Framework for Fine-Grained Audio-Visual Captioning

OmniCapBench is a benchmark of 786 densely annotated videos that evaluates audio-visual captioning in multimodal LLMs. Instead of scoring free-form captions, it asks models for sets of atomic, verifiable units across three tracks (entity references, visual shots, audio events). These are scored with deterministic constraint checks plus localized LLM-based semantic comparisons, which gives coverage, localization and stable scoring together. Tests on frontier MLLMs show strong local perception but weak long-horizon audio-visual reasoning, especially identity drift and cross-modal misalignment.

multimodal large language model
OmniCapBench

evals, multimodal, researchΒ· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper🧠 AI

Toward Joint Optimization of Circuit Depth and Training Data Size in Adaptively Grown Quantum Classifiers

The paper reimplements Q-FLAIR, which grows a quantum feature-map circuit gate by gate until the training loss stops improving. It runs the method on 784-pixel MNIST 3-vs-5 classification at five training-set sizes (N = 2000 to 10000), then fine-tunes each circuit to count Caro et al.'s active gates K. It finds no predictable link between training-set size and the circuit size Q-FLAIR converges to, and seed variance is nearly as large as any trend. The Caro et al. generalization bound holds in 14 of 15 runs, but the gap correlates only weakly with the bound (r = 0.12), so K explains little of the variation. This is a useful negative result for anyone hoping to jointly optimize circuit depth and data size.

Q-FLAIR
Caro et al.MNIST

researchΒ· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

ORCAGen: Orchestrating Context-Aware Malware Deception with RAG-Guided Generative AI

ORCAGen uses RAG over a curated knowledge base of malware procedures and active-defense strategies, plus structured prompting, to have LLMs generate proof-of-concept malware and matching deception orchestration code offline. Strategies are validated against the PoC malware before being added to a runtime playbook that enforces only the verified, deterministic logic. It is evaluated on GPT-4o, GPT-5.5, Gemini 3.5 Flash, Qwen3-Coder and Claude Sonnet 4.5 over synthesized scenarios and 150 real keylogger, infostealer and ransomware samples, measuring execution success, hallucination rate, refinement effort, deception effectiveness and runtime overhead.

LLMGPT-5.5Gemini+2
ORCAGenClaude Sonnet 4.5Gemini 3.5 Flash+1

AI Security, Blue Team & DetectionΒ· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper🧠 AI

The Geometry of Hierarchical Navigation: Accuracy and Query Cost for Point Process Input

Theoretical analysis of greedy search on a hierarchy of proximity graphs built from n points on the d-dimensional torus. It gives a deterministic coverage condition guaranteeing a (1+Ξ΅)-approximate nearest neighbor for any query. The condition holds w.h.p. for homogeneous Poisson, Hermitian determinantal and bounded-density Cox point processes when d = o(log n / log log n), and the expected hop count is O(exp(Β½ d log d + O(d)) log n), so logarithmic in fixed dimension. It gives formal grounding for the hierarchical ANN indexes used in RAG and recommendation retrieval.

research, llm-appsΒ· Added 9 Oct 2026, published 8 Oct 2026

galaxy.comarticle🧠 AI

Understanding AI, Part I: The Machines That We Taught

Galaxy Research's explainer traces AI's intellectual history from the 1956 Dartmouth Workshop and the Logic Theorist through the symbolic-AI era (expert systems like Mycin and XCON, the Cyc project) to the sub-symbolic/connectionist revival (Perceptron, Hopfield networks, backpropagation, LeCun's CNN zip-code reader) that culminated in deep learning and the 2017 Transformer architecture. It then surveys three machine-learning paradigms (supervised, reinforcement, unsupervised) and five deep generative architectures (autoregressive, diffusion, GANs, VAEs, normalizing flows), closing with how modern LLM chatbots combine these via pretraining, SFT, and RLHF, and how multimodal, reasoning, RAG, agent, and world-model systems extend base LLMs.

Transformer
Jensen HuangGreg BrockmanGPT-6 Astra+34

researchΒ· Added 8 Oct 2026

coindesk.comarticleπŸ›‘οΈ Security

Bitcoin and ether holders urged to enter β€˜bunker mode’ against possible AI attacks

Ethereum researcher Justin Drake and co-founder Vitalik Buterin warn that rapid AI progress in mathematics could break the elliptic-curve signatures securing Bitcoin and Ethereum wallets within months - far sooner than quantum computers are expected to - urging large holders to enter bunker mode by migrating funds to addresses whose public keys have never been exposed onchain. Buterin also flags that lattice-based post-quantum schemes, the basis of NIST's signature standard, could face similar AI-driven erosion, pushing Ethereum's long-term roadmap toward hash-based signatures instead. The piece grounds the warning in already-documented AI-assisted exploit discovery: a 5-year-old Coldcard hardware-wallet firmware bug drained over 1,367 BTC, BTCPay Server Lightning-node thefts, Core Lightning bugs surfaced via AI-generated audits, and Anthropic's demonstration of AI models writing working exploits against simulated DeFi contracts.

BitcoinEthereumColdcard+3
Justin DrakeVitalik ButerinCoinkite+3

Blockchain, AI SecurityΒ· Published and added 8 Oct 2026

arxiv.orgpaper🧠 AI

What Output-Only Review Cannot Verify: Study Contracts for Research Agents

Proposes "study contracts" that bind an AI-generated study's declared experimental choices, run obligations and claim scope to recorded execution evidence, defining contract-relative verification as distinct from scientific truth. In a diagnostic with eight self-authored clean/mutated pairs, a deterministic fault-specific checker caught all eight mutations, while eighteen LLM judge aliases given metadata-filtered packages flagged 104 of 144 mutated cases (32 abstentions, 8 terminal failures). The authors stress the setting is deliberately information-asymmetric, not a verifier-quality comparison or reward-hacking result, and call for full-information comparisons, legitimate-adaptation controls and closed-loop agent evaluations.

research, evals, agentsΒ· Added 9 Oct 2026, published 8 Oct 2026

securityweek.comarticleπŸ›‘οΈ Security

Oracle Health Data Breach Tally Climbs to Nearly 20 Million

New Texas attorney general filings put the toll of the 2025 Oracle Health (Cerner) breach at nearly 20 million affected individuals, far above earlier estimates. The attacker, a lone extortionist known as 'Andrew', used stolen customer credentials to access an old legacy Cerner server not yet migrated to Oracle Cloud and exfiltrated patient data including SSNs and medical records, then demanded cryptocurrency ransom while threatening public leak sites.

Oracle HealthCerner
AndrewChange Healthcare

Threat IntelΒ· Published and added 8 Oct 2026

arxiv.orgpaper🧠 AI

Who Verifies the Verifier? Co-Evolving Inspectable Graders with Self-Improving Agents

Proposes making the verifier the evolving object in self-improving agent loops. The verifier is an inspectable expression over small, mostly deterministic drawback detectors, synthesized from clustered failures, gated at birth, and selected for agreement with a ten-item anchored reference set plus consensus over unlabeled outputs, never for the agent's score. On MBPP+ it gains +0.21 held-out agreement over the hand-authored seed and ends ahead of the bare LLM judge it contains. Removing the anchor guards collapses the verifier into an always-pass grader that still trains skills as well, so downstream task score cannot certify a self-evolved verifier. The paper's Double Ratchet pairs the verifier with a lifecycle-managed skill loop and retains 88-110% of the lift from ground truth or a rubric on code generation, enterprise text-to-SQL and reference-free report generation.

MBPP+

research, evals, agentsΒ· Added 9 Oct 2026, published 8 Oct 2026

arxiv.orgpaper🧠 AI

From Evidence to Action: How Tool-Using Agents Fail

This paper studies where tool-using LLM agents break down in the chain from gathering evidence to taking consequential actions, finding that strong static judgment of whether to act often coexists with much weaker interactive execution, and that failures arise from incomplete investigation, acting before evidence is established, or unresolved prerequisites in multi-action workflows. The authors introduce SafeActBench, a 656-case benchmark across six operational domains and five protocols, paired with a provenance-bound Evidence Ledger and a deterministic trajectory evaluator tested across ten model-harness configurations.

SafeActBench

evals, agentsΒ· Added 7 Oct 2026

rapid7.comarticleπŸ›‘οΈ Security

Four Compliance Frameworks, One Security Team. How Universities Can Stop Drowning in Regulatory Risk

Part 2 of a Rapid7 series on higher-education security examines how four overlapping compliance regimes β€” FERPA (24-hour Federal Student Aid breach notification), GLBA Safeguards Rule (law-enforcement notification at 500+ affected consumers), HIPAA (60-day HHS breach reporting), and CMMC Level 2 (110 NIST 800-171 practices for DoD-funded research) β€” collide during a single incident at decentralized, multi-campus university systems. It argues that fragmented data stores and governance make it hard to quickly scope which regulated data (financial aid, health records, CUI) was touched and which reporting clocks have started, and recommends consistent data classification plus centralized visibility/automation to meet overlapping deadlines.

FERPAGLBACMMC+1

GRCΒ· Published and added 7 Oct 2026

orca.securityadvisoryπŸ›‘οΈ Security

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Orca Security details CVE-2026-21589 (CVSS 9.3), a critical unauthenticated path traversal flaw affecting all versions of eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Insufficient path validation lets remote attackers read arbitrary files within the web application root without authentication, and in Crowd SSO deployments this can expose plaintext credentials usable to create administrative accounts and take over the entire Atlassian ecosystem. The advisory lists fixed versions for each product and recommends WAF rules and log review for organizations unable to patch immediately.

JiraConfluenceBitbucket+3
CVE-2026-21589path traversal

AppSec, Identity & AccessΒ· Published and added 7 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Engineer Gets 32 Months for Bitcoin Extortion Plot Against His Own Employer

A former core infrastructure engineer, Daniel Rhyne, was sentenced to 32 months for extorting his own New Jersey employer: he created a hidden virtual machine on the company network, reset passwords on hundreds of accounts to "TheFr0zenCrew!", deleted domain administrator accounts, scheduled tasks to shut down 40 servers a day, and demanded 20 BTC (~$750K) to stop. The FBI's criminal complaint describes how investigators traced the hidden VM back to him via correlated laptop browsing activity, building access logs, home IP connections, and incriminating search history ("how to clear all windows logs from command line").

BitcoinActive Directory
Daniel RhyneFBITheFr0zenCrew!

Threat IntelΒ· Published and added 7 Oct 2026

rapid7.comwriteupπŸ›‘οΈ Security

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Rapid7's analysis of CVE-2026-21589 (CVSSv4 9.3), a critical unauthenticated arbitrary file read vulnerability affecting Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It summarizes watchTowr Labs' root-cause finding that double-colon (::) sequences can act as path separators in Atlassian's web-resource handling, enabling path traversal to read arbitrary files within the Tomcat web root β€” including crowd.properties credentials that can be chained to create a rogue jira-administrators account. The post provides emergency patching guidance, Atlassian's WAF/RewriteValve mitigations, log-hunting regex, and notes public Python PoC and Nuclei templates exist.

BitbucketConfluenceJira+3
CVE-2026-21589CWE-552watchTowr Labs+1

AppSecΒ· Published and added 7 Oct 2026

fiveminutesforward.comwriteup🧠 AI

Write Like It's 1866: LLMs Relearn Telegraphese

The author revives "cablese," the terse telegraph-era writing style, as an LLM prompting technique: instructing a model to write dense, article-dropping summaries cuts output tokens 25–49% depending on model family, while downstream models (including ones never shown the instruction) answer comprehension questions from the compressed text at parity or better than from plaintext. The piece introduces the "Telegraph Test," an open benchmark (github.com/Travis42/telegraph-test) with ~1,300 questions over 50 passages and a fixed deterministic grader, used to measure compression ratio, cross-model legibility, and read-back/decode costs for GLM-5.3-Flash, Gemma, Qwen and gpt-5-mini; it also contrasts this human-readable, auditable register against emergent machine-only compression protocols described in other papers (BabelTele, GLOSSOGEN) and existing tools (Terse, Caveman).

GLMGemmaQwen+1
GLM-5.3-Flashgpt-5-miniZ.ai+4

prompting, evals, ai-infraΒ· Published and added 7 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Europol Warns Crypto Wallets Are 'Primary Risk' for Quantum Attacks

Decrypt covers two Europol reports β€” "Quantum Computing and Cryptocurrencies" (European Cybercrime Centre) and "Harvest Now, Decrypt Later" (with University Carlos III of Madrid) β€” warning that exposed wallet public keys, not blockchain hash functions, are the primary quantum attack surface for crypto, and that TLS, SSH, and OpenPGP are susceptible to retrospective decryption once quantum computers mature. It details a "just-in-time" attack where a quantum computer derives a private key during the brief window between a transaction broadcasting its public key and confirmation, cites NIST's post-quantum deprecation schedule (phase out classical public-key crypto by 2035), and notes ~30% of BTC supply already has exposed public keys with pre-emptive migration as the only remedy.

BitcoinTLSSSH+2
EuropolEuropean Cybercrime CentreUniversity Carlos III of Madrid+7

Blockchain, GRCΒ· Published and added 7 Oct 2026

unchained.comarticleπŸ›‘οΈ Security

The randomness question at the heart of your hardware wallet

Unchained explains how hardware wallets generate entropy for bitcoin keys, covering PRNG vs TRNG theory, physical TRNG mechanisms (ring oscillator jitter, diode avalanche noise, radio static reuse), and NIST SP 800-90B / BSI AIS-31 certification. It compares entropy sourcing and secure-element chip suppliers (STMicroelectronics, Microchip, Infineon, Espressif, Silicon Labs) across Trezor, Ledger, Coldcard, BitBox02, Foundation Passport, Blockstream Jade and Block Bitkey, and walks through the July 2026 Coldcard firmware bug that silently bypassed its hardware TRNG for five years, causing real bitcoin losses. It also covers manual dice/coin entropy generation for BIP39 seed phrases, the Dark Skippy nonce-leakage attack, and multisig as the primary mitigation against single-device key-generation failures.

BitcoinColdcardTrezor+3
Coldcard firmware vulnerability (2026)Dark SkippyMilk Sad+6

Hardware & RF, BlockchainΒ· Added 8 Oct 2026, published 7 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Provable Subexponential Algorithms for NIST Third-Round Lattice Families

An IACR ePrint paper by Yiming Gao, Xuyuan Han, and Honggang Hu presenting provable classical subexponential algorithms (running in roughly 2^((1/2+o(1))n/ln ln n) time/space) for recovering short secrets in growing parameter families tied to all seven NIST third-round lattice candidates: Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, Dilithium/ML-DSA, Falcon, and cyclic NTRU-HPS/HRSS. The approach extends the Wagner-style Gaussian sampling framework of Ducas, Engelberts, and Loyer (CRYPTO 2025) and a low-error decision-LWE algorithm, using an exact squared-Euclidean-norm gap to binary-search each secret coordinate, and an "affine slice search" over the public lattice for NTRU/Falcon-type quotient relations. The authors explicitly note the subexponential complexity applies to growing/weakened parameter regimes and does not reduce the concrete security of the currently specified NIST parameter sets.

NISTML-KEMML-DSA+12

otherΒ· Added 8 Oct 2026, published 6 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

The Lattice Isomorphism Problem with Hints

This IACR ePrint paper (published TCHES 2027) presents a new cryptanalysis technique for the Lattice Isomorphism Problem that embeds LIP into a shortest-vector-problem instance on a different lattice than the one used in Hawk's specification, allowing attackers to integrate "hints" β€” partial information on the secret key obtained via side-channel attacks or other leakage. Using the LeakyLWEEstimator tool, the authors show Hawk signatures themselves leak exploitable information about the secret key, eroding Hawk-1024's security by roughly 11 bits, and apply the framework to resolve an open side-channel problem from TCHES 2024 plus discuss further fault-injection attack paths. Hawk is a lattice-based signature scheme submitted to NIST's second post-quantum signature call, making this a concrete key-recovery cryptanalysis relevant to PQC migration planning.

HawkLeakyLWEEstimator
Lattice Isomorphism ProblemShortest Vector ProblemMΓ©lissa Rossi

Hardware & RFΒ· Added 8 Oct 2026, published 6 Oct 2026

x.comwriteupπŸ›‘οΈ Security

lee1981 (@lee1981b) on X

CyberForge CVE-of-the-Day #070 on CVE-2026-61500 in Rejetto HFS 3.0.0–3.2.0. The default Koa session-signing key came from Math.random() (CWE-338) and the unauthenticated login handshake leaked outputs of the same generator. That allows recovery of the key, a forged administrator session, and code execution through the legitimate server_code feature. It covers scoring (CVSS 9.8/9.3, EPSS, KEV status), the 3.2.1 fix, a six-step SOC hunting and remediation trail (loginSrp1/2, get_config/set_config pivots, COOKIE_SIGN_KEYS review), and offline jq/Python helpers for container and config metadata.

Rejetto HFSKoaDocker+2
CVE-2026-61500CWE-338VulnCheck+6

Blue Team & Detection, AppSec, Identity & AccessΒ· Added 9 Oct 2026, published 6 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

PoP! Goes the VOLE: Shorter Proofs of Possession for KEM Certificates

This IACR ePrint paper proposes and benchmarks a non-interactive Proof of Possession (PoP) for the code-based post-quantum KEM HQC, built using the VOLE-in-the-Head (VOLEitH) zero-knowledge paradigm, to solve the practical problem of issuing KEM-based certificates needed by protocols like KEMTLS. The authors integrate their HQC PoP into the ACME certificate-issuance protocol and compare it against existing PoP schemes for Kyber and FrodoKEM, showing Kyber issues certificates faster but at the cost of protocol or NIST-standard compatibility, while their HQC-based PoP keeps compatibility and achieves smaller proof sizes, which matters under unstable-network conditions due to larger KEM-based CSRs.

ACMEHQCKyber+2

Identity & AccessΒ· Added 8 Oct 2026, published 6 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

K-LMS: Design, Implementation, and Evaluation of Leighton–Micali Signatures with Korean Cryptographic Primitives

An IACR ePrint paper presenting K-LMS, an experimental variant of the NIST-standardized LMS hash-based post-quantum signature scheme in which the underlying hash is swapped for Korean primitives: the LSH-256 hash function (reference and vectorized) and a Tandem-DM double-block-length construction built from the CHAM, LEA, and ARIA block ciphers. The authors implement a non-invasive backend-swapping bridge over the reference LMS code and benchmark keygen/sign/verify latency, key/signature sizes, memory, and parameter sweeps, finding that hash substitution doesn't change key/signature sizes but that two measurement pitfalls (hash dispatch overhead, and software vs. hardware-accelerated SHA-256 baselines) can shift performance comparisons by an order of magnitude or 6x respectively. They report LSH-256 K-LMS signing on par with SHA-256 LMS in software, and 3.3-3.9x faster than a prior K-XMSS implementation because LMS needs fewer hash calls per Winternitz step than XMSS.

LMSLSH-256CHAM+3
NISTXMSSSPHINCS+

otherΒ· Added 8 Oct 2026, published 6 Oct 2026

almostimplemented.github.iowriteup🧠 AI

Learning Jazz Pianist Style with Cross-Attention Conditioning

An ISMIR 2026 (Abu Dhabi) research project that fine-tunes Aria, a transformer pretrained on piano MIDI, on solo recordings from twelve jazz pianists in the PiJAMA dataset, adding a gated cross-attention layer that conditions generation on a learned per-pianist embedding. Because standard held-out perplexity is nearly blind to style (the next note is predictable regardless of pianist), the authors instead measure style transfer by sliding a pianist classifier over freely generated continuations: conditioned continuations are attributed to the intended pianist 70% of the time versus 37% unconditioned, and a classifier trained only on generated music identifies real recordings with 95% accuracy. The page is an interactive demo with audio examples, blindfold listening tests, and per-pianist results (e.g. 96% attribution for Hank Jones/Dick Hyman vs 29% for Cedar Walton), alongside a link to the full paper with ablations on mismatch conditioning and memorization checks.

TransformerMIDI
AriaPiJAMAISMIR 2026+8

multimodal, trainingΒ· Added 6 Oct 2026, published 5 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Area-Efficient Hardware Architecture of the Post-Quantum HQC Cryptosystem with Side-Channel Protection

This IACR eprint paper presents a resource-efficient FPGA hardware architecture for the NIST-selected HQC post-quantum KEM that defends against power-based side-channel attacks by reusing otherwise-idle KECCAK hardware to inject scrambling dynamic power during decoding, adding less than 0.5 percent area overhead compared to masking/shuffling countermeasures. The fully parameterized design supports HQC-128/192/256 and was prototyped on a Xilinx Artix-7 FPGA (139 MHz, 11,489 LUTs, 6,785 FFs, 4 DSPs), with functional correctness verified via NIST Known Answer Tests and leakage suppression confirmed via Test Vector Leakage Assessment.

HQCFPGAArtix-7+1
NISTTVLA

Hardware & RFΒ· Added 8 Oct 2026, published 5 Oct 2026

cpr.dkadvisoryπŸ›‘οΈ Security

Denmark Data Breach Exposes 8.8M People's Personal Data

Denmark's CPR administration (Det Centrale Personregister) disclosed that unauthorized actors abused a Danish company's legitimate, authorized access to the CPR system to extract names, addresses and CPR (national ID) numbers for roughly 8.8 million registered citizens. Records of individuals with name/address protection were not exposed. CPR has revoked the company's access, notified the Danish Data Protection Agency (Datatilsynet), and the incident is being investigated by police alongside relevant authorities.

Det Centrale PersonregisterDatatilsynet

Threat IntelΒ· Published and added 5 Oct 2026

arxiv.orgpaperπŸ›‘οΈ Security

Agentic-ZTA: A Multi-Agent Architecture for Autonomous Zero Trust Enforcement

Agentic-ZTA is a multi-agent architecture that operationalizes the NIST SP 800-207 Zero Trust Architecture control loop using coordinated AI agents. A Policy Enforcement Point intercepts access requests, enriches them with context, and routes them to a policy-engine agent that invokes domain-specialized core and supporting agents; policies are retrieved via RAG and embedded into agent prompts at inference time, with trust scores aggregated by a trust algorithm to produce the final access decision. The authors implement and evaluate the framework on a testbed, reporting 95.0% accuracy, 93.9% precision, and 96.3% recall on representative access-control scenarios.

LLM
NIST SP 800-207

Identity & Access, AI SecurityΒ· Added 6 Oct 2026, published 5 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Optimized NEON Implementation of MAYO on Apple M1

An IACR ePrint paper presenting an optimized ARMv8 NEON assembly implementation of MAYO Round 3 (one of NIST's post-quantum signature candidates) for Apple M1, generated to be byte-identical to upstream intrinsics but 2–2.6x faster for signing and verification across all four parameter sets. The authors also run a constant-time testing campaign with matched null runs and find that while linear-algebra operations are statistically indistinguishable from constant-time nulls, verification (on public data) exhibits a measurable key-fixed timing effect present in both their implementation and the upstream code.

ARM NEONApple M1AES
MAYO

Hardware & RFΒ· Added 8 Oct 2026, published 5 Oct 2026

eprint.iacr.orgpaperπŸ›‘οΈ Security

Post-Quantum Command Authentication for Unmanned Systems: A KpqC Feasibility Study under Real-Time and Bandwidth Constraints

This paper evaluates whether Korean post-quantum crypto candidates (HAETAE, AIMer, SMAUG-T, NTRU+) and NIST PQC standards (ML-KEM, ML-DSA, SLH-DSA) can replace classical ECDSA/ECDH in the authentication and key-establishment path of ROS2/DDS-Security for UAV/UGV command channels. The authors build a feasibility envelope mapping each algorithm's key/signature size and handshake latency against real command-link constraints (message rate, MTU, latency deadline, bandwidth), then validate it with authentication-handshake measurements over emulated constrained links on a two-node testbed, producing a classical→NIST→KpqC comparison and per-channel-budget application guidance.

ROS2DDS-Security
KpqCHAETAEAIMer+7

Hardware & RF, Identity & AccessΒ· Added 8 Oct 2026, published 5 Oct 2026

thehackernews.comarticleπŸ›‘οΈ Security

Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Leak Site

Spanish, German and Romanian authorities, coordinated by Europol and Eurojust, arrested three suspects including a 16-year-old alleged administrator of the KillSec ransomware/extortion group and seized its dark web leak site and servers. KillSec began as a hacktivist group in 2021, pivoted to ransomware (KillSecurity 2.0/3.0) in 2023, and launched a ransomware-as-a-service affiliate program in 2024, breaching organizations via software vulnerabilities and poorly secured cloud storage and extorting roughly 280+ identified victims. Investigators secured over 110TB of data, shut down five servers, seized crypto wallets with transactions matching ransom payments, and found the group used AI to build infrastructure and identify targets.

Rapid7Bitdefender
KillSecKillSecurity 2.0KillSecurity 3.0+7

Threat IntelΒ· Added 3 Oct 2026

arxiv.orgpaper🧠 AI

A Vision-Language Model (VLM)-based Pipeline for End-to-End Procedural Modeling of Field-Grown Maize from Point Clouds

This paper presents an automated pipeline that uses a vision-language model to annotate leaf midlines in rendered orthographic views of maize point-cloud scans, then applies deterministic geometric algorithms and differentiable NURBS fitting to reconstruct editable, organ-level procedural 3D plant models without manual tuning or species-specific segmentation training. Evaluated on 100 field-grown maize plants from the MaizeField3D dataset, it achieves a median whole-plant Chamfer distance of 5.4 mm and recovers 99.4% of curated reference leaves at IoU β‰₯ 0.5, outperforming an earlier semi-automated pipeline. It demonstrates that VLM annotations can become reliable quantitative measurements when paired with correcting geometric post-processing, enabling scalable generation of 3D plant assets for high-throughput phenotyping and in silico breeding.

vision-language modelNURBS
MaizeField3D

research, multimodalΒ· Added 5 Oct 2026, published 2 Oct 2026

arxiv.orgpaper🧠 AI

From Patching to Pruning Visual Computation in Vision Language Models

Patch-to-Prune (P2P) is a training-free framework that repurposes activation patching from mechanistic interpretability into an inference-time compute bypass for vision-language models, replacing unnecessary visual-token projections in certain decoder layers with fixed neutral proxy vectors while preserving sequence length, token order, and residual pathways. Tested on Qwen2.5-VL and LLaVA family models across seven multimodal benchmarks, P2P at 3 percent tolerance retains about 94 percent of dense accuracy while cutting FLOPs by 55 percent, and reveals that intermediate decoder layers do most of the task-relevant visual integration while early and late layers need little token-specific visual computation.

vision-language modelQwen2.5-VLLLaVA

research, multimodal, inferenceΒ· Added 5 Oct 2026, published 2 Oct 2026

arxiv.orgpaper🧠 AI

Beyond Reward Hacking: Proxy Divergence Across Four Layers of a Staged Humanoid Learning Pipeline

This arXiv preprint extends the concept of reward hacking to four distinct "proxy" layers in a staged RL training pipeline for legged robots: the reward itself, the curriculum gate, the evaluation statistic, and the reference motion. Using measurements from a continuous PPO policy lineage trained on a simulated 1.91m humanoid over four stages and 13,500 iterations on a single laptop GPU, the author shows concrete divergence failures β€” e.g., a curriculum gate built on averaged error that advanced at its rate limit while the gated skill was absent, and a batched push test whose synchronized resets aliased gait phase and misranked push magnitudes by danger. For each layer it proposes a reformulation that closes the divergence, including L1 costs, peak/outcome statistics, gate reachability checks, deterministic/phase-desynchronized evaluation, and function-preserving input widening for growing a single policy instead of retraining.

PyTorch
PPO

research, trainingΒ· Added 5 Oct 2026, published 2 Oct 2026

blog.trailofbits.comwriteupπŸ›‘οΈ Security

SequenceHash: multihashing for the rest of us

Trail of Bits introduces SequenceHash and its keyed variant SequenceMAC, hash-agnostic multihashing constructions similar in goal to NIST's TupleHash but not tied to Keccak, working with SHA256/384/512, BLAKE, and RIPEMD. The spec, now part of the Community Cryptography Specification Project, provides unambiguous input encoding, length-extension prevention, built-in customization strings, and HMAC-style keyed MACs that avoid HMAC's key-pseudocollision issues; reference implementations ship in Rust, Go, and Python with full test vectors.

RustGoPython
TupleHashHMACNIST SP 800-185+10

AppSecΒ· Published and added 2 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Spanish Police Arrest 16-Year-Old Accused of Running KillSec Ransomware Group

Spanish police arrested a 16-year-old Romanian national in Alicante suspected of administering the KillSec ransomware group, part of a coordinated multinational Operation KillSwitch led by the FBI San Juan field office and Hamburg's State Criminal Police Office. Authorities seized KillSec's leak site and five central servers, securing at least 110TB of stolen data, and arrested additional suspects in the UK and Romania, including Fouad Eltibrizi (alias "Archduke"), indicted in Puerto Rico. KillSec, active since 2024, used double extortion, exploited cloud misconfigurations, and reportedly leveraged AI to build its ransomware infrastructure and identify victims across roughly 500 successful attacks.

KillSecOperation KillSwitchFouad Eltibrizi+5

Threat IntelΒ· Published and added 2 Oct 2026

x.comthread🧠 AI

Dizzzank (@dank0296) on X

A Twitter thread recapping a "forward-deployed engineer" (FDE) talk on AI transformation methodology: find the real process a company runs (not the one it documents) by interviewing veteran staff and embedding engineers in the system of record, then sort every step into four buckets β€” delete, deterministic code, agentic (judgment plus exception history), or human-in-the-loop (payment, signing, negotiation). It argues most deployed workflows don't need frontier models β€” benchmark each workflow against cheap tiers and open-weight models like GLM, Kimi and Qwen, plus Grok, and let evals decide β€” and that agents should live inside existing systems of record like Salesforce/Slack rather than requiring migration to new AI-native tools. Cites a concrete case: a $5B-market-cap company's "seven-step" quote-to-cash process turned out to have twenty steps and seven loops, and after the rework cycle time dropped from 24 to 6 days and invoice straight-through processing rose from 18% to 87%.

SalesforceSlackSharePoint
GrokGLMQwen+1

ai-policy, agentsΒ· Added 2 Oct 2026, published 1 Oct 2026

decrypt.coarticleπŸ›‘οΈ Security

Meta Pushes Back on Claim That Muse AI Read a User's Messages Without Consent

Meta's communications chief disputes a tech columnist's claim that Muse, Meta's personal AI agent for Mac, read and uploaded his iMessages database to the cloud even though he says Full Disk Access was disabled. The piece lays out the conflicting permission-model claims (Full Disk Access + a Messages connector toggle, per Meta) alongside a separate incident where Muse allegedly disclosed a user's home address to a stranger, and notes Amazon has blocked Muse over undisclosed browsing and apparent credential capture.

macOS
Andy StoneJason AtenDavid Singleton+1

AI SecurityΒ· Published and added 1 Oct 2026

decrypt.coarticle🧠 AI

Meta Pushes Back on Claim That Muse AI Read a User's Messages Without Consent

News report on a dispute over Meta's Muse personal AI agent, launched Sept. 8 and built in Meta Superintelligence Labs. Inc. columnist Jason Aten says Muse synced his Mac Messages database even though Full Disk Access was off, and that Muse falsely said it only saw notification banners. Meta's Andy Stone and David Singleton reply that the Messages integration is opt-in, needing both macOS Full Disk Access and the Muse Messages connector. The article also covers a separate claim that Muse gave a user's home address to a Facebook Marketplace buyer, Amazon blocking Muse, and the Amazon v. Perplexity Comet injunction. It shows how agent permission layers can fail or be disputed.

MusemacOSFull Disk Access+2
MetaMuse SparkAndy Stone+7

agents, ai-policyΒ· Published and added 1 Oct 2026

arxiv.orgpaper🧠 AI

Are We Recovering Mechanisms? Objective-Level Recovery Gaps in Mechanistic Interpretability

This paper shows that intervention-defined faithfulness metrics used to evaluate automated circuit discovery in mechanistic interpretability can favor a worse circuit over a better one, an objective-level recovery gap. Testing EAP, EAP-IG, ACDC, and Edge-SP across four human-reference tasks and InterpBench, the authors find KL-based faithfulness misranks 9.4%-41.2% of candidate circuit pairs under held-out resampling, and trace the cause to context distortion, where excluded signals change the inputs retained components operate on. Restoring selected signals from the intact model's execution repairs 96 of 100 persistent misrankings, showing the evaluation objective itself, not just the search algorithm, needs fixing.

EAPEAP-IGACDC+1
InterpBench

ai-safety, researchΒ· Added 2 Oct 2026, published 1 Oct 2026

arxiv.orgpaper🧠 AI

Mimir: Physics-Grounded LLM Agents for Long-Horizon Irrigation Control

Mimir is a physics-grounded LLM agent for long-horizon irrigation control that pairs a fast-timescale loop β€” where a structured physical interface and deterministic simulator verify, revise, and bound LLM-proposed actions before execution β€” with a slow-timescale loop that consolidates recurrent failure patterns into persistent contextual principles, while keeping the physical model, evaluator, and execution constraints immutable. Evaluated across multiple sites, crops, and years with a common retrospective evaluator, Mimir achieves the lowest aggregate control cost among tested baselines and uses about 51% less irrigation than historical schedule replay; ablations show forward simulation, verified revision, and persistent context are all necessary, and scaling LLM size or switching model families gives no monotonic improvement.

Mimir

agents, researchΒ· Added 2 Oct 2026, published 1 Oct 2026

bughunters.google.comwriteupπŸ›‘οΈ Security

https://bughunters.google.com/blog/pagebreak-real-world-findings?utm_source=tldrsec.com&utm_medium=newsletter&utm_campaign=tl-dr-sec-348-google-s-pagebreak-scanner-perplexity-s-agent-security-tool-defending-agentically

Google's Product Security team describes three high-severity bugs found by PageBreak, an internal LLM-agent scanner that validates findings by running payloads against live environments. The cases are cache poisoning on apis.google.com (an unkeyed `extra_path` injected into cached JS), XSS on admin.google.com where the agent bypassed the `sig` check by getting the authorize endpoint to sign a `javascript:` URI, and a UXSS in the Tag Assistant extension via a weak `onConnectExternal` origin check and nonce exfiltration. It shows what agentic, deterministically verified scanning can find in well-reviewed targets.

ChromeTag AssistantGoogle Tag Manager+2
PageBreakcache poisoningXSS+4

AppSec, AI SecurityΒ· Added 2 Oct 2026, published 1 Oct 2026

tldrsec.comarticleπŸ›‘οΈ Security

[tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically

tl;dr sec #348 is a weekly security newsletter issue. It summarises Google's PageBreak agent (500+ XSS bugs found since November 2025, validated deterministically), Perplexity's open-source Numbat agent-security tool (52 CEL rules), and SpecterOps' CiliumHound. It also covers Scaleway IAM attack paths, the NCSC essay on defending agentically, Julien Vehent on detection fidelity, and Wiz's Scan for Good.

PageBreakNumbatCiliumHound+3
XSSVolt TyphoonRed Agent+6

AI Security, AppSec, Blue Team & DetectionΒ· Added 30 Oct 2026, published 1 Oct 2026

theregister.comarticleπŸ›‘οΈ Security

16-year-old found Microsoft bug, got admin access to 17.3T-row databases

A Register news report describes a 16-year-old security researcher who found a bug in a Microsoft service that granted administrator-level access to databases containing 17.3 trillion rows. The actual article text was not retrievable in this fetch (only unrelated site navigation links were returned), so the specific vulnerable service, root cause, and any CVE/bounty details are unconfirmed from this pass.

AppSecΒ· Added 2 Oct 2026, published 30 Sep 2026

csrc.nist.govarticleπŸ›‘οΈ Security

NIST CSWP 36G β€” False Base Station draft white paper

NIST's National Cybersecurity Center of Excellence (NCCoE) released an initial public draft of CSWP 36G, "False Base Station: Applying 5G Cybersecurity and Privacy Capabilities," which evaluates how commercial 5G devices respond to six simulated rogue/fake base station attack scenarios run on NCCoE's operational 5G security testbed. False base stations impersonate legitimate carrier radio access network equipment to intercept traffic, degrade service, or track user location, and the paper identifies gaps in 5G standards and available device-level protections, noting that even 5G's improved security features remain susceptible to denial-of-service attacks. Public comment is open through October 30, 2026.

5G
NCCoE

Hardware & RF, GRCΒ· Added 1 Oct 2026, published 29 Sep 2026

arxiv.orgpaper🧠 AI

LLM Parkinsonism: Uncertainty-Aware Global Executive Control Architecture for Autonomous LM Agents

This paper names "LLM Parkinsonism" - the tendency of autonomous LM agents to keep acting (over-verifying, over-refining, repairing self-created complexity) after a task's goal is already met - and traces it to proposal generation, scope interpretation, progress assessment, and stopping authority all being concentrated in the same self-conditioned loop. It introduces Global Executive Control (GEC) v0.2, an uncertainty-aware governance layer that separates action generation from project-level control (scope, evidence, resource use, stopping), and evaluates it in a 24,000-episode matched-candidate benchmark under a 40,000-token ceiling: a first-candidate baseline hits 67.42% hard-goal success, a candidate-set control reaches 96.53%, and GEC matches that success (96.57%) while cutting mean token use about 36%. The results are from mechanistic simulations only; the authors flag live-model validation as still needed.

Global Executive Control

agents, research, evalsΒ· Added 28 Sep 2026

arxiv.orgpaper🧠 AI

A Unified Uncertainty Representation for Graph Neural Networks via Doubly-Spectral Stochastic Expansion

Proposes a doubly-spectral stochastic (DSS) expansion for graph neural networks that unifies calibration, out-of-distribution detection, and distribution-shift robustness in a single representation: graph Fourier filters capture structural variation while an orthogonal-polynomial chaos coordinate captures latent stochastic variation. DSS-GNN (standalone) achieves the lowest Brier score across 14 node classification benchmarks without post-hoc correction, and DSS-Hybrid (a residual branch beside a deterministic encoder) achieves the best AUROC on most node-OOD settings and strongest shifted accuracy on all 7 GOOD concept-shift benchmarks under standard ERM. A capacity theorem shows the method matches chaos coefficients of Gaussian-latent random graph signals under full-rank assumptions with exponentially decaying truncation error.

GOOD

researchΒ· Added 29 Sep 2026, published 28 Sep 2026

arxiv.orgpaper🧠 AI

EvE: An Alternate Optimizer to Adam

EvE (Evolutionary Explorer) is a steady-state, population-of-four differential evolution optimizer with a targeted Adam fallback, proposed as an alternative to Adam for cheap, early ranking of configurations in hyperparameter and architecture search. Under a fixed evaluation-cost-matched budget it wins or ties Adam on 76% of 70 (problem, dimension) cells across seven scalable benchmarks up to one million variables, and on real tasks (MLP on MNIST, LoRA fine-tuning of a 1.5B-parameter LLM on two datasets) it finishes 1.7-3.9x faster at a modest quality cost. Inside successive halving on UCI Adult it completes hyperparameter/architecture searches 3.1-3.5x faster while ranking configurations nearly as consistently as Adam does with itself across seeds (Kendall's tau 0.66-0.69).

LoRA
MNISTGSM8KUCI Adult

training, researchΒ· Added 29 Sep 2026, published 28 Sep 2026

arxiv.orgpaperπŸ›‘οΈ Security

Certified Multi-Source Integrity for Structured Agent Actions

This arXiv paper proposes a certifier for structured, privileged agent actions such as paying an invoice, assembled from potentially corrupted documents and tool outputs, formalizing when multi-source corroboration can be trusted under indirect prompt injection. It uses a corruption-radius rule counted via minimum hitting sets over corruption-distinct evidence classes so laundered or re-published copies cannot fake a quorum, plus deterministic reconciliation and trusted anchors for single-sourced fields. Evaluated on 70,966 sanctions entities and 450 software-supply-chain provenance records, and against five LLM agents where a realistic injection fools all but one model and existing action-gating or provenance baselines are broken while the certifier admits no unsafe action.

LLM

AI SecurityΒ· Added 2 Oct 2026, published 28 Sep 2026

github.comrepoπŸ›‘οΈ Security

Agent Threat Rules (ATR) β€” open detection-rule standard for AI agent threats

Agent Threat Rules (ATR) is an open, versioned YAML rule format (ATR-YYYY-NNNNN scheme) for detecting AI-agent runtime threats β€” prompt injection, tool-poisoning, malicious SKILL.md content, and MCP exchange abuse β€” evaluated by a reference TypeScript engine (with a Python wrapper) shipped as an npm/pip package, CLI, GitHub Action, and Docker scanner with SARIF output. The project positions itself as "Sigma for agent threats," maps rules to OWASP Agentic/LLM Top 10, MITRE ATLAS, and NIST AI RMF, and publishes an extensive (and unusually self-critical) benchmark suite against corpora like garak, PromptBench, and PromptInject, including documented harness bugs and withdrawn recall figures.

Model Context ProtocolnpmTypeScript+3
CVE-2026-26030CVE-2026-25592OWASP Top 10 for Agentic Applications+2

AI SecurityΒ· Added 26 Sep 2026

arxiv.orgpaperπŸ›‘οΈ Security

Aray: Deterministic-First Synthesis of Benign Artifacts for YARA Validation

Aray is a deterministic-first YARA interpreter and positive-fixture synthesizer that generates benign, YARA-matching ELF/PE/generic artifacts to validate detection rules without storing or distributing live malware samples. Conventional code (not a generative model) canonicalizes rules, derives witnesses from regex/hex declarations, and performs extraction, layout, and binary serialization; an LLM is only permitted to propose constructive rule normalizations or residual-semantics judgments, never backend source or binary structure, and the pipeline supports a zero-inference execution path. Evaluated against 416 public YARA rules, it achieved 406/416 (97.6%) matches to the original upstream rule, with the design explicitly motivated by containment concerns raised by the July 2026 OpenAI–Hugging Face agent incident.

YARALangGraphOpenAI
OpenAI–Hugging Face incident

Blue Team & Detection, AI SecurityΒ· Added 26 Sep 2026

arxiv.orgpaper🧠 AI

Progressive Skill Discovery as Access Control for Tool-Using LLM Agents

Introduces "skilder," a framework that bundles LLM agent capabilities into roles (skills, tools, instructions, and limits) delivered progressively through a single MCP server, so an agent starts with a minimal catalog and only gains tool access as it learns the roles a task requires. This structural approach enforces access control deterministically at the server layer rather than relying on prompt-based policy, addressing context bloat and governance gaps in enterprise tool-using agents. Evaluated against flat-context tool selection and multi-agent orchestration across 13 tasks and six models, showing zero unauthorized tool calls or parameter violations when agents completed the discovery protocol.

Model Context Protocol
skilder

agents, research, mcpΒ· Added 26 Sep 2026

arxiv.orgpaper🧠 AI

Clean Engineering, Unstable Measurement: A Preregistered Reliability Failure of Black-Box LLM Observers on Shared Endpoints

This preregistered study audits whether black-box LLM judges give stable, reproducible readings on shared serving endpoints, running two campaigns across 52,988 request attempts. Same-window repeat rankings only reached Spearman 0.400 against a required 0.90, and byte-identical next-day replays agreed at 0.78 against a required 0.99, showing that a model name on a shared endpoint is not a frozen measurement instrument. The authors trace the failure to label-to-meaning mapping bias, tiny candidate gaps relative to instrument noise, and non-deterministic outputs on identical inputs, and propose a three-level snapshot-identity ladder plus design rules and a reporting checklist for anyone freezing eval gates on LLM judges.

evalsΒ· Added 26 Sep 2026

arxiv.orgpaper🧠 AI

Coding Agents Are Guessing: Measuring Action-Boundary Violations in Underspecified DevOps Instructions

UnderSpecBench is a benchmark of 69 task families and 2,208 prompt variants testing whether coding agents (Claude Code, Codex, OpenCode) overstep action boundaries when given benign but underspecified DevOps instructions. It uses deterministic, side-effect-based oracles to classify outcomes as Safe Success, Wrong Target, or OverScope, finding that 55.8-67.8% of runs violate at least one action boundary β€” agents tend to guess rather than clarify or refuse, especially when the target is uncertain.

Claude CodeCodexOpenCode
UnderSpecBench

evals, coding-agentsΒ· Added 26 Sep 2026

arxiv.orgpaper🧠 AI

Regulating the Machine Contributor: Governance and Policy Alignment in Open Source

This paper studies how open-source projects (SymPy, LLVM, matplotlib, OpenInfra, Apache Software Foundation, Linux Foundation) are adapting contribution policies to govern AI agent contributors β€” bots that plan changes, edit files and submit pull requests with limited human oversight. Using Most-Similar Systems Design and process tracing, the authors build a six-dimensional taxonomy (disclosure, responsibility, human oversight, licensing, enforcement, maintainer workload) and an ordinal Policy Maturity Score, then map documented agent incidents against these dimensions and against regulatory frameworks like the EU AI Act, NIST AI RMF's Agentic AI Profile, and ISO/IEC 42001/23894.

SymPyLLVMmatplotlib+8

ai-policy, researchΒ· Added 26 Sep 2026

agentthreatrule.orgotherπŸ›‘οΈ Security

Agent Threat Rules (ATR) β€” Sigma/YARA-style open detection format for AI agent threats

Agent Threat Rules (ATR) is an open, versioned YAML rule format for detecting AI-agent security threats β€” prompt injection, tool poisoning, credential exfiltration, unauthenticated agent execution β€” positioned as "what Sigma is to SIEM and YARA is to malware." Rules carry permanent ATR-YYYY-NNNNN IDs, declare detection conditions against fields like LLM I/O, tool-call args, or SKILL.md content, and map back to OWASP Agentic/LLM Top 10, MITRE ATLAS, SAFE-MCP, and NIST AI RMF; a reference TypeScript engine and Python wrapper ship MIT-licensed. Governance is transitioning from a single BDFL maintainer to a Technical Steering Committee, and the spec is notably transparent about its own limits, withdrawing previously published per-lane false-positive figures after discovering a tainted benign corpus.

SigmaYARAMITRE ATLAS+3
OWASP Top 10 for LLM ApplicationsOWASP Top 10 for Agentic ApplicationsNIST AI RMF+2

AI Security, Blue Team & DetectionΒ· Added 26 Sep 2026

github.comadvisoryπŸ›‘οΈ Security

Unauthenticated Administrator takeover exfiltrated via the MCP

GHSA advisory for SiYuan v3.7.1 (CVE-2026-66012) describing how the kernel's POST /mcp route registers 31 MCP tools β€” including a file tool with full read/write/delete/rename/copy over the workspace β€” gated only by CheckAuth with no admin or read-only check. When the Publish server runs in anonymous mode (a documented configuration for public docs sites), the Publish reverse proxy attaches an anonymous RoleReader JWT to every proxied request, letting an unauthenticated attacker reach /mcp, exfiltrate accessAuthCode/api.token/cookieKey from conf.json, escalate to Administrator, and plant a malicious Electron plugin (nodeIntegration:true, contextIsolation:false) for RCE on the desktop client. Includes a full working PoC and remediation (CheckAdminRole gate, proxy path allowlist, restricting the file tool).

Model Context ProtocolDockerElectron
CVE-2026-66012CWE-862GHSA-jqwg-75qf-vmf9+6

AppSecΒ· Added 26 Sep 2026

arxiv.orgpaperπŸ›‘οΈ Security

The Illusion of Secure LLM Code: Closing the Security Gap via Iterative Reprompting

This paper evaluates authentication code generated by five prominent AI coding assistants, combining static code analysis and dynamic penetration testing mapped against NIST SP 800-63B guidelines. It tests four prompting strategies (Basic, Secure, NIST-Based, and iterative Reprompting) and finds that basic and generically "secure" prompts consistently miss critical protections like brute-force resistance, session management, and password handling, while even a single-shot NIST-context prompt is structurally inadequate β€” only an iterative self-auditing reprompting loop achieves defense-in-depth. The authors argue enterprises must shift from single-shot prompt engineering to continuous, standards-driven verification pipelines for AI-generated auth code.

LLM
NIST SP 800-63B

AI Security, AppSec, Identity & AccessΒ· Added 26 Sep 2026

arxiv.orgpaperπŸ›‘οΈ Security

Coding Agents Are Guessing: Measuring Action-Boundary Violations in Underspecified DevOps Instructions

UnderSpecBench is a benchmark of 69 task families (2,208 prompt variants) grounded in real incidents and CVEs that tests whether coding agents (Claude Code, Codex, OpenCode) safely handle underspecified DevOps instructions rather than guessing at intent, target, or blast radius. Using deterministic side-effect oracles, the study finds 55.8–67.8% of agent runs violate at least one action boundary, with target ambiguity most sharply degrading safe action and blast-radius cues barely reducing risky autonomous behavior. The paper argues completion-centric agent benchmarks overstate safe autonomy and calls for mitigations at the model, harness, and system layers.

Claude CodeCodexOpenCode
UnderSpecBench

AI Security, DevSecOpsΒ· Added 26 Sep 2026

arxiv.orgpaperπŸ›‘οΈ Security

Regulating the Machine Contributor: Governance and Policy Alignment in Open Source

This paper compares AI-contributor policies across six open-source organizations (SymPy, LLVM, matplotlib, OpenInfra, Apache Software Foundation, Linux Foundation) using Most-Similar Systems Design and process tracing, deriving a six-dimensional taxonomy (disclosure, responsibility, human oversight, licensing, enforcement, maintainer workload) and an ordinal Policy Maturity Score. It then maps documented AI-agent incidents (nuisance PR volume, platform-level shutdowns) onto the dimensions each policy fails to govern, and cross-references the resulting gaps against the EU AI Act, NIST AI RMF (with the UC Berkeley Agentic AI Profile), and ISO/IEC 42001/23894 to show where regulatory and project-level policy leave the same holes unaddressed.

EU AI ActNIST AI RMFISO/IEC 42001+2

GRC, AI SecurityΒ· Added 26 Sep 2026

arxiv.orgpaperπŸ›‘οΈ Security

From Source Code to Network Profile: Automated and Traceable MUD Profile Generation for IoT Devices

AutoMUD is a source-code-driven tool that generates Manufacturer Usage Description (MUD) network access-control profiles for IoT devices by statically analyzing firmware/source code rather than relying on live traffic observation. It combines static and syntactic extraction with retrieval-grounded LLM reasoning and deterministic validation to recover rarely-exercised or conditional communication paths, link each generated rule to its source-level provenance, and record excluded findings with explicit reasons for review. Evaluated on a Linux-based repository plus a controlled semantic fault-injection campaign, it produced structurally valid, traceable MUD profiles that let analysts detect, localize and correct propagated errors.

LinuxLLM
AutoMUD

Hardware & RF, AI SecurityΒ· Added 28 Sep 2026, published 25 Sep 2026

arxiv.orgpaper🧠 AI

Common-Mode Collapse and Recovery in Direct Feedback Alignment

Analyzes a common-mode collapse failure mode in Direct Feedback Alignment training and proposes mitigations, tested on MNIST and CIFAR-10.

Adam
MNISTCIFAR-10Direct Feedback Alignment

researchΒ· Added 28 Sep 2026, published 25 Sep 2026

arxiv.orgpaper🧠 AI

Can You Check That? The Checkability Boundary for Local LLM Network Automation

This arXiv paper proposes checkability - whether a task has a cheap, deterministic intrinsic check that can reject incorrect outputs - as the deciding factor for whether local small language models (SLMs) can be trusted for network-automation tasks instead of sending sensitive configs, topologies and logs to a third-party frontier LLM. The authors build Touchstone, a local-first pipeline that runs seven off-the-shelf SLMs (1-8B params) to generate candidates, uses task-specific intrinsic checks to reject bad outputs, and escalates only unresolved cases to a frontier model, reaching 98.6 percent and 93.8 percent end-to-end accuracy on conflict-detection and intent-translation tasks while escalating just 16-17 percent of inputs. On TeleQnA, a knowledge-only benchmark lacking task-specific checks, Touchstone fails to match the frontier baseline, showing the escalation strategy only works when precise correctness checks exist.

TouchstoneTeleQnA

research, inferenceΒ· Added 28 Sep 2026, published 25 Sep 2026

huntress.comwriteupπŸ›‘οΈ Security

The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

Huntress SOC analyzes an intrusion that began with exploitation of Samsung MagicINFO (CVE-2025-4632, after incomplete fix of CVE-2024-7399) via tomcat9.exe. The actor took three tries to install AnyDesk (certutil and PowerShell attempts were blocked by Defender), created an 'oldadministrator' account, disabled Defender, then ran Silent XMR Miner Builder, which compiled a Monero miner on the endpoint using csc.exe, cvtres.exe, donut, tcc and MinGW gcc. The miner ran masquerading as explorer.exe against C3Pool; the post gives command lines and detection ideas such as unusual compiler child processes from an unsigned parent and explorer.exe with mining arguments.

Samsung MagicINFOAnyDeskWindows Defender+3
CVE-2025-4632CVE-2024-7399SilentXMRMiner+10

Blue Team & Detection, Threat IntelΒ· Published and added 24 Sep 2026

blog.googlearticleπŸ›‘οΈ Security

Agentic Hacks, Real Proofs: Inside Google's PageBreak Project

PageBreak is Google Product Security's internal LLM-driven agent, built mostly on Gemini models, that autonomously hunts for exploitable bugs in Google's first-party web apps and confirms them with deterministic, non-AI validators rather than relying on model-generated hypotheses alone. The validators execute real payloads to prove exploitability for XSS, SQL injection, path traversal, RCE, and SSRF, which Google says drives false positives near zero and let the system surface over 500 real XSS bugs across sensitive Google domains; when run against apps built on Google's high-assurance web framework it found only 2. The post also describes feeding unverified findings back into the system to seed deeper scans and improve validators, and notes integration plans with Google's CodeMender automated-fix agent.

GeminiCodeMender
XSSSQL Injectionpath traversal+2

AI Security, AppSecΒ· Added 1 Oct 2026, published 24 Sep 2026

alignmentforum.orgwriteup🧠 AI

WorkspaceBench: Evaluating Interpretability Methods for the Global Workspace

WorkspaceBench is a benchmark introduced by camilablank, agam_bhatia, Euan Ong and Neel Nanda through the MATS Program for evaluating interpretability methods applied to Global Workspace style neural network architectures. The fetched page only exposed metadata without the article body so specific tasks and metrics could not be confirmed from the text, but the title and venue indicate a mechanistic interpretability evaluation framework.

camilablankagam_bhatiaEuan Ong+4

ai-safety, evalsΒ· Added 7 Oct 2026, published 23 Sep 2026

aikido.devarticleπŸ›‘οΈ Security

Cyber Resilience Act is here! Myth busting and first impressions

Aikido Security walks through the EU Cyber Resilience Act's newly live Single Reporting Platform (SRP), which as of September 11 requires manufacturers to report actively exploited vulnerabilities or severe incidents within 24 hours, with follow-up notifications at 72 hours and a final report 14 days after a fix ships. The post corrects common misconceptions β€” you don't report every vulnerability found, the 14-day clock starts at remediation not discovery, SRP submission alone isn't sufficient (affected users must also be notified), and pre-registration isn't required before you have something to report β€” and flags the upcoming harmonised standards EN 40000-1-1 and EN 40000-1-3 as the next thing to track ahead of the December 2027 full-compliance deadline. It also notes the EU is using CRA-collected data to build its own EUVD as an alternative to the backlog-plagued NIST NVD.

Aikido SecurityCISA KEVNVD
ENISAEU Cyber Resilience ActEUVD+3

GRCΒ· Published and added 23 Sep 2026

github.comrepo🧠 AI

nealbridges/VulnHunter

VulnHunter is a maintained fork of Capital One's open-source agentic security scanner, reworked to run on any agent harness (Claude Code, Codex, Grok/OpenCode) instead of being Claude-Code-specific. The fork's distinguishing work is engineering, not security findings: portable "skill" prompt files with an explicit environment contract, an installer that fails loudly instead of guessing paths, Docker-based sandboxed exploit validation, and a benchmark harness that ran six full scans of one production Go service across five model/harness stacks, finding that result counts swung from 3 to 42 findings depending on how rigorously exploits were validated. It ships three composable skills (/vulnhunt, /vulnhunter-fix, /vulnhunt-fix-verify), a headless batch-runner (harness/), and a deterministic manifest-writing CLI (vh).

Claude CodeCodexGrok+4
VulnHunterCapital OneOWASP NodeGoat+2

coding-agents, evalsΒ· Added 6 Oct 2026, published 22 Sep 2026

endorlabs.comarticle🧠 AI

Engineering a security harness for AI coding agents | Blog | Endor Labs

Endor Labs lays out a seven-question framework for building a 'security harness' around AI coding/security agents: defining task scope, engineering minimal sufficient evidence retrieval, tiered authority (Read→Recommend→Prepare→Publish→Enforce), hard enforcement gates before consequential actions, and operational controls for evaluation, failure containment, and versioned change management. It argues the model should never be the control plane — deterministic evidence and explicit approval boundaries must sit around it — and backs the evidence-architecture point with a benchmark showing a 91.7% token reduction (6.6M vs 79.5M) when agents receive deterministic security evidence instead of reconstructing it via tool loops.

Jinja2
Endor LabsEndor Labs Agent Kit

agents, coding-agentsΒ· Published and added 22 Sep 2026

orca.securityadvisoryπŸ›‘οΈ Security

WordPress β€œComment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

CVE-2026-93485 (CVSS 7.1) is a stored XSS-to-RCE chain in WordPress Core's wpautop() function (wp-includes/formatting.php), where a mismatch between comment sanitization at save time and HTML reformatting at display time lets an unauthenticated attacker inject live event handlers via a crafted comment. When a logged-in administrator views the page, the script executes and installs a malicious plugin containing a web shell, achieving full RCE. It affects WordPress Core 4.7 through 7.1.0 (essentially all installs, including block themes since Twenty Twenty-Two), and is fixed in 7.1.1 with backports down to 4.7.36; no public PoC or in-the-wild exploitation was reported at disclosure time.

WordPressPHP
CVE-2026-93485

AppSecΒ· Published and added 22 Sep 2026

blog.talosintelligence.comwriteupπŸ›‘οΈ Security

The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant

Cisco Talos' CAIRN project documents CLOSEDQUORUM, a 64-bit Go Windows implant that replaces traditional C2 infrastructure with a panel of up to four commercial LLM providers (DeepSeek, Qwen, Mistral, Gemini) that vote on the implant's next action via plurality voting, with each model queried against a structured JSON decision schema constrained to inject/persist/steal/move actions. Once deployed it autonomously dumps LSASS credentials, steals browser passwords and crypto wallets (MetaMask, Exodus, Ethereum), and exfiltrates AES-256-GCM-encrypted data to an operator's Discord webhook, all without further human tasking. The post details the developer's apparent credentials-as-a-service distribution model, deterministic tie-breaking favoring DeepSeek, and provides SHA256 hashes plus a YARA detection rule for the family (formerly tracked as BALZAK).

GoWindowsDeepSeek+3
CLOSEDQUORUMCAIRNBALZAK

AI Security, Malware & RE, Threat IntelΒ· Added 30 Sep 2026, published 22 Sep 2026

github.comrepo🧠 AI

Show HN: Foremerge – Catch intent conflicts between parallel coding agents

Foremerge is an open-source coordination protocol layered above Git for parallel coding agents (Claude Code, Codex, Cursor). Agents publish semantic intent (scopes like symbol/api/schema) before editing into a shared SQLite store under .git, so Foremerge can detect intent conflictsβ€”like one agent replacing a class another is extendingβ€”that Git's text-diff merging would silently miss. It's advisory-only (no file locking), deterministic (no LLM judgment calls), and gates ChangeSet acceptance on Foremerge-run validation rather than agent self-reports.

GitSQLiteModel Context Protocol+4

coding-agents, agents, mcpΒ· Added 26 Sep 2026, published 21 Sep 2026

nist.govpaperπŸ›‘οΈ Security

NIST Draft SP 800-82r4: Guide to Operational Technology (OT) Security

NIST has published the initial public draft of Special Publication 800-82 Revision 4, "Guide to Operational Technology (OT) Security," updating the long-standing OT/ICS security guidance to cover a broader scope of programmable physical-world systems (industrial control systems, building automation, physical access control, transportation, and environmental monitoring/measurement systems). The draft revises the overview of OT topologies, common threats, typical vulnerabilities, and recommended safeguards/countermeasures, and is open for public comment until November 30, 2026.

NIST SP 800-82r4

GRCΒ· Added 26 Sep 2026, published 21 Sep 2026

github.comrepoπŸ›‘οΈ Security

StellarFoundry/soroban-security-scanner

soroban-scan is an open-source, deterministic static analyzer for Stellar Soroban smart contracts and Rust projects. It ships 19 Soroban-aware detectors (SS-001 to SS-033) covering missing authorization, re-initialization, cross-contract call ordering, unchecked arithmetic and storage or resource misuse. Output includes JSON, SARIF 2.1.0 and GitHub annotations, with baselines and a PR-scanning Action. The project describes itself as early development.

SorobanStellarRust+2

AppSecΒ· Added 28 Oct 2026, published 21 Sep 2026

csrc.nist.govpaperπŸ›‘οΈ Security

NIST SP 800-82 Rev.4 (Initial Public Draft) β€” Guide to OT Security

NIST SP 800-82 Revision 4 is the initial public draft of the agency's core guide to Operational Technology (OT) security, covering industrial control systems, building automation, physical access control, and environmental monitoring/measurement systems. It updates OT threat models, typical topologies, and vulnerability descriptions, and provides recommended security safeguards and countermeasures for organizations running cyber-physical systems, with a public comment period through November 30, 2026.

NIST

GRCΒ· Added 26 Sep 2026, published 21 Sep 2026

socket.devwriteupπŸ›‘οΈ Security

Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

Socket's research team found two beta releases of the @joyfill npm packages (@joyfill/layouts and @joyfill/components) contained an import-time JavaScript implant that resolves encrypted payloads through Tron, Aptos, and BNB Smart Chain transactions, ultimately dropping a 77KB Node.js remote-access trojan matching the DEV#POPPER family and sharing loader fingerprints with the PolinRider blockchain-loader campaign. The RAT establishes a Socket.IO C2 channel, executes arbitrary JS/shell commands, exfiltrates files and clipboard data, and persists by patching files inside VS Code, Cursor, Antigravity, Discord Desktop, GitHub Desktop, and the global npm CLI; a parallel detached-process branch fetches an additional bootstrap that can deploy a Python credential/browser-data stealer assessed as an OmniStealer variant. Because the implant fires on module load (not via npm lifecycle scripts), `--ignore-scripts` provides no protection, and the writeup includes full IOCs, blockchain addresses, C2 infrastructure, and MITRE ATT&CK mappings.

npmNode.jsPython+3
DEV#POPPERPolinRiderOmniStealer+12

Supply Chain, Malware & RE, Threat IntelΒ· Added 22 Sep 2026, published 20 Sep 2026

github.comrepoπŸ›‘οΈ Security

Shor

Shor is a source-available, multi-tenant autonomous pentesting platform where a ~17-agent LLM pipeline (discovery, hypothesis, adversarial screening jury, exploitation, proof replay) attacks a target URL and optionally its connected source repo. It wields 30+ real offensive tools (sqlmap, dalfox, nuclei, jwt_tool, hydra, ffuf, etc.) plus SAST/secret/SCA tools (Semgrep, Gitleaks, TruffleHog, OSV-Scanner, Trivy) in white-box mode, and only reports findings whose PoC is deterministically re-executed and confirmed by a code-enforced safety layer under a signed Rules of Engagement, with scan authorization gated behind single-use human-minted tokens on its MCP/automation surface.

SemgrepGitleaksTruffleHog+3
MITRE CAPECPolyForm Noncommercial License 1.0.0

Offensive Security, AppSec, AI SecurityΒ· Added 22 Sep 2026, published 19 Sep 2026

github.comrepoπŸ›‘οΈ Security

Outrider Recon

Outrider Recon is an open-source, Claude-native multi-agent OSINT and external attack-surface recon platform for authorized engagements, covering web/API, identity/SSO, cloud, secrets, and people/breach intelligence. It deliberately stops short of exploitation: active enumeration is approval-gated and intrusive validation is a human hand-off, with deterministic Python controls enforcing scope, evidence integrity, workflow state, and finding promotion around Claude skills and optional MCP-based enrichment. Output is ranked, evidence-backed finding cards (confidence/severity/handoff recommendations) meant to feed proxy-assisted testing or pen-testing rather than raw scanner dumps.

ClaudeClaude CodeModel Context Protocol+2
elementalsouls/Claude-OSINTSnailSploit/offensive-checklist

OSINT, Offensive Security, AI SecurityΒ· Added 22 Sep 2026, published 19 Sep 2026

arxiv.orgpaperπŸ›‘οΈ Security

APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport

APort Vault is a benchmark that replays 4,371 human-written CTF attacks against a live AI payment agent across 14 models from 8 labs, five policy configurations, and two replay tracks β€” with and without a deterministic pre-action check implementing the Open Agent Passport (OAP) specification. Across 225,964 evaluations, unauthorized transfers to non-allowlisted recipients occurred 140/76,842 times with the model alone versus 0/69,297 times behind the OAP layer, while the layer still allowed 25,370 legitimate payments through, showing a policy-enforcement layer can materially close the authorization gap in agentic payment flows without just refusing everything. The authors release all evaluations, level passports, scoring code, and analysis scripts.

Open Agent PassportAPort Vault

AI Security, Identity & AccessΒ· Added 21 Sep 2026, published 18 Sep 2026

csrc.nist.govpaperπŸ›‘οΈ Security

NIST SP 800-82r4 (Initial Public Draft) β€” Guide to OT Security

NIST has issued the initial public draft of SP 800-82 Revision 4, "Guide to Operational Technology (OT) Security," updating its long-standing guidance for securing industrial control systems, building automation, transportation, and physical access/monitoring systems. The draft covers OT system topologies, common threats and vulnerabilities affecting energy, manufacturing, and transportation sectors, and recommended security safeguards, with public comments open through November 30, 2026.

SP 800-82r4

GRCΒ· Added 28 Sep 2026, published 18 Sep 2026

ethresear.charticleπŸ›‘οΈ Security

Post-Quantum: Lattice or Hash-Based (one question, two right answers)

A deep-dive field guide to choosing between lattice-based (ML-DSA/FN-DSA) and hash-based (SLH-DSA) post-quantum signatures, built from interviews with the designers and implementers behind both NIST standards and their deployments. It walks through Mosca's-inequality-style migration timing, CNSA 2.0's split between lattice signatures and stateful hash-based LMS/XMSS for firmware, the stateful-signature "footgun," and why the broader internet (TLS/WebPKI, via Merkle Tree Certificates) is converging on lattices while Ethereum's post-quantum consensus roadmap (leanXMSS, EIP-8292, EIP-8288 aggregation) and Algorand's live Falcon-1024 state proofs lean hash-based or scheme-neutral because of aggregation and on-chain storage constraints. It closes with a decision framework and a rundown of NIST's round-3 "onramp" signature candidates (MAYO, SQIsign, HAWK, etc.).

EthereumBitcoinAlgorand+3
ML-DSASLH-DSAFN-DSA+16

Blockchain, otherΒ· Added 3 Oct 2026, published 15 Sep 2026

csrc.nist.govpaperπŸ›‘οΈ Security

NIST IR 8587 (Final) β€” Protecting Tokens and Assertions from Forgery, Theft, and Misuse

NIST IR 8587 is a final NIST report giving federal agencies and cloud service providers implementation guidance for protecting identity tokens, access tokens, and assertions from forgery, theft, and misuse. It builds on NIST SP 800-53 (Release 5.1.1) with architectural recommendations for identity providers and authorization servers covering key management, token verification, and lifecycle controls, aimed at securing SSO, federation, and API access scenarios following recent high-profile token-forgery attacks.

NIST SP 800-53

Identity & Access, GRCΒ· Added 3 Oct 2026, published 15 Sep 2026

openzeppelin.comarticleπŸ›‘οΈ Security

From Algebra to Noise: Why Post-Quantum Cryptography Looks Different

OpenZeppelin Security's technical explainer on why post-quantum cryptography looks so different from classical crypto: Shor's algorithm exploits the abelian hidden-subgroup structure underlying RSA, Diffie-Hellman, ECDSA, EdDSA and pairing-based schemes, while Grover's algorithm only halves the effective security of hashes and symmetric keys (256-bit hashes stay at a comfortable 128-bit level). It then walks through NIST's finalized lattice/hash-based PQC standards β€” ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for general signatures, SLH-DSA (SPHINCS+) as a conservative hash-based backup, plus future Falcon/FN-DSA and code-based HQC β€” mapping each to blockchain use cases and covering real deployment (Starknet's Falcon-512 Cairo account contracts), Ethereum account-abstraction/hybrid-signature migration paths, Bitcoin's UTXO/consensus constraints, Ethereum's LeanSig consensus-signature research, and a concrete institutional crypto-asset-inventory and PQC audit checklist.

EthereumBitcoinML-KEM+3
NISTCRYSTALS-KyberCRYSTALS-Dilithium+10

BlockchainΒ· Added 29 Sep 2026, published 14 Sep 2026

csrc.nist.govpaperπŸ›‘οΈ Security

NIST IR 8587: Protecting Tokens and Assertions from Forgery, Theft, and Misuse

NIST IR 8587 is a finalized interagency report, developed with CISAs Joint Cyber Defense Collaborative under Executive Order 14306, giving federal agencies and cloud service providers implementation recommendations to protect identity tokens and assertions from forgery, theft, and misuse. It builds on NIST SP 800-53 Revision 5 to detail architectural guidance for identity providers and authorization servers, plus enhancements to key management, token verification, and token lifecycle controls covering SSO, federation, API, and workload access scenarios, informed by threats seen in recent high profile token theft attacks.

CISAExecutive Order 14306NIST SP 800-53 Revision 5

Identity & Access, GRCΒ· Added 26 Sep 2026, published 14 Sep 2026

github.comrepoπŸ›‘οΈ Security

RepoGuardBench

RepoGuardBench is a benchmark and accompanying paper that measures whether local open-weight coding agents (Qwen2.5-Coder 1.5B-14B via Ollama) stay on the bug-fix task when repository artifacts β€” README files, issue text, code comments, test logs, and agent-rule files β€” carry inert prompt-injection instructions. It evaluates five lightweight context- and action-level defenses (D0-D5, including a path-only action gate) across seven metrics in a sandboxed task workspace, finding no statistically clear utility winner among them. The project ships a deterministic no-GPU smoke test, paper-claim verification scripts, and reproducible tables/figures under MIT (code) and CC BY 4.0 (data) licenses.

QwenOllamaClaude

AI SecurityΒ· Added 22 Sep 2026, published 13 Sep 2026

endorlabs.comarticleπŸ›‘οΈ Security

Evaluating and Scoring OSS Packages | Endor Labs | Blog | Endor Labs

Endor Labs blog post detailing their "Endor Score" methodology for evaluating open source package risk, distinguishing operational risk (activity, popularity, licensing, code quality) from security risk (vulnerabilities, secrets, malicious code, security practices). It argues against compressing everything into a single opaque score, favoring transparent, deterministic "facts" (e.g., recent commit counts, normalized SAST findings) that users can combine into custom policies, and discusses pitfalls like event-selection bias, threshold selection, and the unproven predictive power of these signals.

Endor LabsDependabotGitHub+2
OpenSSF ScorecardGoogle Assured Open Source SoftwareOWASP Top 10 Risks for Open Source Software+1

Supply ChainΒ· Published and added 11 Sep 2026

endorlabs.comarticleπŸ›‘οΈ Security

SSDF Compliance and Attestation: A Practical Guide | Blog | Endor Labs

Endor Labs breaks down CISA's finalized Secure Software Development Attestation Form, which requires federal software suppliers to attest compliance with NIST's Secure Software Development Framework (SSDF) under EO 14028, with critical software due June 8, 2024 and other software due September 8, 2024. It covers the form's scope (excluding federal-developed, open source, and freely available software), flags ambiguous language and gaps (no explicit SBOM/threat-modeling/memory-safety mandate), and maps the four required practice areas β€” secure environments, trusted source code supply chains, code/artifact provenance, and vulnerability scanning/remediation β€” to Endor Labs' supply chain security platform features.

Endor LabsSBOM
NIST SSDFExecutive Order 14028CISA+3

GRC, Supply ChainΒ· Published and added 11 Sep 2026

aikido.devarticleπŸ›‘οΈ Security

The CVE spike across major software companies is a remediation problem

Aikido argues the widely-shared a16z/Epoch AI chart showing critical/high CVEs jumping from under 100/month to over 600/month since spring 2026 reflects AI accelerating vulnerability discovery, not a real spike in danger β€” since CISA's KEV count has stayed flat. It details how NIST's NVD, overwhelmed by volume, let its scoring backlog balloon from 13,000 to 27,000 CVEs in 18 months and pivoted to only prioritizing federal/critical/KEV-listed CVEs, while Verizon's 2026 DBIR found only 26% of confirmed actively-exploited KEV vulnerabilities were fully remediated in 2025 (down from 38%) with median patch time rising to 43 days. It illustrates the point with StyleSmuggler, an unauthenticated RCE hitting Adobe Commerce and Magento Open Source that had no CVE or vendor advisory, which Aikido Intel flagged and Aikido Libraries auto-patched more than 24 hours before Adobe's own hotfix.

Adobe CommerceMagentoAikido Security+2
StyleSmugglerCISA KEVNIST+3

AppSec, Supply ChainΒ· Published and added 10 Sep 2026

snyk.ioarticleπŸ›‘οΈ Security

Is prevention essentially a solved problem?

A Snyk blog post arguing that preventing new vulnerabilities in agent-generated code is architecturally solved, using Laurie Voss's nested "loop" model (execution/task/product/system/oversight) to map four control types β€” in-context guidance, deterministic scanning inside the agent loop (Snyk's Trusted Output Assurance), LLM-based semantic analysis for authz/business-logic flaws like IDOR, and adversarial pentesting/red-teaming (Snyk's Continuous Offensive Security) β€” to the points in the SDLC where each is cost-effective. It cites Snyk VulnBench JS 1.0 data showing nearly half of LLM-found vulnerabilities appear in only one of five identical review runs, illustrating why single-pass LLM scanning needs repetition to be trusted, and closes by distinguishing solved "prevention" from unsolved "remediation" of existing vulnerability backlogs.

Snyk
IDORVulnBench JS 1.0Laurie Voss+3

AI Security, AppSec, DevSecOpsΒ· Published and added 10 Sep 2026

arxiv.orgpaper🧠 AI

Programmable World Model

Programmable World Model decouples persistent world-state evolution from visual rendering in video world models: an agent compiles natural-language instructions into executable programs governing entity states and transition rules, which a lightweight engine executes and maintains as explicit global state (including off-screen entities and non-visual attributes). State-augmented 3D oriented bounding boxes plus camera trajectory are deterministically compiled into pixel-aligned conditioning signals fed to a pretrained video model that renders the scene, enabling playable games with predefined mechanics and direct entity control. On the paper's new CombatStateBench benchmark it achieves 94% Count Accuracy and 98% State Accuracy, beating existing interactive video world models on long-horizon coherence.

video model
CombatStateBench

research, multimodal, evalsΒ· Added 22 Sep 2026, published 9 Sep 2026

huntress.comarticleπŸ›‘οΈ Security

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Part 1 of a Huntress research series on Active Directory Rights Management Services (AD RMS), explaining its PKI-based trust model (Server Licensor Certificate signing content keys), why it's still deployed despite Microsoft's deprecation push toward Azure Information Protection, and how to fingerprint and enumerate a cluster from an unprivileged domain account. It introduces SharpRMS, a custom C# tool that speaks the AD RMS SOAP protocol to enumerate clusters and rights-policy templates, and shows how local AD RMS Service Group membership (not Domain Admin) gates the administrative surface where the SLC private key can eventually be reached β€” setting up Part 2's key extraction and offline decryption.

Active DirectoryWindows.NET+1
DisARMSMSRC Case 33210Sean Metcalf+1

Offensive Security, Identity & AccessΒ· Published and added 8 Sep 2026

arxiv.orgpaper🧠 AI

RegionFed: Federated Learning for Personalized Query Understanding in Heterogeneous Retail Environments

RegionFed is a federated learning framework for personalized retail search query understanding that operates at the gradient level rather than parameter level, using the β„“2 conflict between regional and global gradients to diagnose heterogeneity and route regions to personalization strategies. Unlike existing parameter-level personalized FL methods that collapse below 10% accuracy on transformers like T5, RegionFed deploys unchanged across T5-Small, T5-3B, RoBERTa, and CNN architectures. Evaluated on Amazon ESCI, Amazon Reviews, and LEAF-FEMNIST, RegionFed-Meta reaches 92.27% accuracy, closing to within 0.23pp of a privacy-violating centralized upper bound while providing (Ξ΅β‰ˆ0.60)-differential privacy.

TransformerT5RoBERTa+1
Amazon ESCIAmazon ReviewsLEAF-FEMNIST

researchΒ· Added 22 Sep 2026, published 4 Sep 2026

arxiv.orgpaper🧠 AI

Clean Engineering, Unstable Measurement: A Preregistered Reliability Failure of Black-Box LLM Observers on Shared Endpoints

A preregistered audit of whether identical requests to the same-named LLM API return stable outputs over time, finding they largely do not: across 52,988 audited requests, same-window repeat rankings hit Spearman 0.400 against a required 0.90, and next-day byte-identical replays hit 0.78 against a required 0.99. The authors trace the failure to label-mapping bias, candidate gaps far below the instrument's noise floor, and non-deterministic outputs for identical inputs, tested across four providers and self-hosted batch-invariant kernels, concluding a model name on shared infrastructure is not a frozen measurement instrument and that evaluations must characterize instrument noise before freezing any gate on it.

evals, researchΒ· Added 22 Sep 2026, published 3 Sep 2026

github.comrepo🧠 AI

kajisho5/ffmpeg-skill

ffmpeg-skill is an Agent Skill (SKILL.md plus 42 stdlib-only Python tools) that lets Claude Code, Cursor, Codex and other agents edit video and audio with local ffmpeg/ffprobe. It enforces a probe β†’ edit losslessly β†’ check β†’ verify workflow, and every tool takes --dry-run, --json and --plan. A machine-readable contract, whose input schemas are derived at run time from each script's argparse parser (the author's "SPEC" pattern), drives an MCP server that lists a core 12 tools by default. The repo also ships per-platform render templates, a doctor capability check, a test suite and evals. It is useful as a worked example of a deterministic, verifiable skill/tool layer in which the agent supplies judgement and the tools do the work.

FFmpegPythonNode.js+10
ffmpeg-skillkajisho5whisper+2

coding-agents, mcp, promptingΒ· Added 16 Oct 2026, published 3 Sep 2026

endorlabs.comarticleπŸ›‘οΈ Security

The Secure Agentic Development Lifecycle (ADLC), Explained | Blog | Endor Labs

Endor Labs defines the "agentic development lifecycle" (ADLC) β€” the process by which AI coding agents autonomously plan, write, test, and ship code β€” and lays out where it introduces new security risk: insecure-by-default code, architectural design flaws that pass static analysis, hallucinated/unvetted dependencies, and a review bottleneck as agents outpace human reviewers. It cites benchmark data (62% of best-model BaxBench solutions insecure, only 10.5% of SWE-Agent/Claude 4 Sonnet solutions secure, only 1 in 5 AI-recommended dependency versions safe) and proposes a control stack β€” secure-generation prompting, security-aware multi-agent PR review, reachability-based prioritization, and automated remediation β€” mapped to NIST SP 800-218A, CSA's Agentic SDLC, and OWASP.

Model Context ProtocolCursorClaude Code+3
BaxBenchSWE-AgentNIST SP 800-218A+4

AI Security, Supply Chain, DevSecOpsΒ· Added 3 Sep 2026, published 2 Sep 2026

endorlabs.comarticleπŸ›‘οΈ Security

AI Code Review: How to Actually Review Code an Agent Wrote | Blog | Endor Labs

Endor Labs explainer on "AI code review" as a discipline: pairing LLM reasoning with static analysis (call graphs, data flow) to catch security-relevant PR changes that AI coding agents introduce, alongside human reviewers. It cites research showing common AI-generated flaws (missing input validation CWE-20/89/78, hardcoded secrets CWE-798, broken auth CWE-306/284, hallucinated/insecure dependencies), Endor's finding that under 9.5% of vulnerabilities are reachable/exploitable, and a comparison of AI review against SAST, SCA, and secrets scanning, plus a rollout checklist referencing NIST SP 800-218A.

Endor LabsGitHubGitLab+3
CWE-20CWE-89CWE-78+5

AI Security, AppSecΒ· Added 3 Sep 2026, published 2 Sep 2026

huntress.comarticleπŸ›‘οΈ Security

CMMC Hit Pause, the FAR Council Hit Play

Huntress blog post clarifying that DoD's July 13 "strategic pause" only suspended CMMC Phase 2 third-party certification requirements (for solicitations after Nov 2026), while Phase 1 self-assessments, SPRS scoring, and DFARS 252.204-7012's 72-hour CUI incident reporting remain fully in force and now face closer DIBCAC/DOJ False Claims Act scrutiny. It also flags the FAR Council's June 23 proposed CUI rule (part of the Revolutionary FAR Overhaul), which would extend 72-hour breach reporting and a NIST 800-171 Rev 3 baseline to all FAR-based federal contractors, not just the defense industrial base, creating a temporary split between CMMC's Rev 2 and the FAR's Rev 3. It closes with a breakdown of 32 CFR 170.21's strict POA&M limits (no POA&M at Level 1, minimum 88/110 score and only 1-point requirements eligible at Level 2) and practical questions MSPs should ask clients about federal contract exposure.

Huntress
CMMCDFARS 252.204-7012DFARS 252.204-7021+12

GRCΒ· Added 8 Sep 2026, published 2 Sep 2026

endorlabs.comarticleπŸ›‘οΈ Security

Hooks are the control plane for the agentic development lifecycle | Blog | Endor Labs

Endor Labs blog post arguing that lifecycle hooks β€” not system prompts, skills, or MCP tools β€” are the only enforceable control plane for coding agents, because hooks intercept consequential actions (shell commands, file writes, credential access, package installs) before execution and return a deterministic allow/block/escalate verdict the agent cannot opt out of or reason around. It frames platform engineering's "golden path" concept applied to the agentic development lifecycle (ADLC), positioning hooks as the mechanism to restore reliability and observability that autonomous coding agents otherwise erode.

Claude CodeModel Context ProtocolEndor Labs
DORA

AI Security, DevSecOpsΒ· Added 3 Sep 2026, published 1 Sep 2026

github.comrepoπŸ›‘οΈ Security

cyanheads/osv-advisory-mcp-server

osv-advisory-mcp-server is an MCP server that queries the OSV.dev vulnerability database, offering single-package version checks, batch audits of up to 1000 {name, ecosystem, version} tuples for SBOM/lockfile triage, and full advisory record fetch by OSV ID (GHSA/PYSEC/RUSTSEC/GO/DSA/DLA/CVE prefixes). It surfaces CVE aliases, CVSS vectors, derived severity labels, and CWE IDs, and is designed to chain into a companion nist-nvd-mcp-server for CVSS base scores, EPSS probability, and CISA KEV status. It ships as a keyless, no-API-key tool runnable via STDIO or Streamable HTTP, with a public hosted instance and Bun/npx/Docker install paths.

Model Context ProtocolOSVBun+3
CISA KEVEPSSnist-nvd-mcp-server

Supply ChainΒ· Added 1 Sep 2026

endorlabs.comarticleπŸ›‘οΈ Security

The real test of AI-native code analysis: is your security debt shrinking? | Blog | Endor Labs

Endor Labs argues that AI-native code analysis tools should be judged by whether they actually shrink security debt, not by how many findings or patches they generate. It cites data showing coding agents increase code duplication and reduce review rigor (GitClear, DORA, Faros AI), that AI-generated findings are often false positives (Comcast: 44% of validated critical/high findings), and that agents can pass functional tests while shipping insecure code (Agent Security League: 84.4% correct vs 7.8% secure), then lays out six requirements for analysis tools (deterministic evidence, impact-ranked findings, remediation-grade context, fix validation, shift-left coverage, independent measurement) and six questions to ask vendors, tying back to Endor Labs' own AURI product.

Endor LabsAURI
Agent Security League1PasswordDORA+5

AppSec, AI SecurityΒ· Added 3 Sep 2026, published 31 Aug 2026

github.comrepoπŸ›‘οΈ Security

galyarder-security

galyarder-security (formerly Shannon Proxy) is a Docker/Temporal-based auditing layer that intercepts model SDK calls (Anthropic, Groq, local Ollama, etc.) and routes them through a local proxy on port 8317 rather than direct cloud endpoints, giving operators visibility into and control over what autonomous coding/tool-using agents execute. It runs structured "security sweep" and threat-modeling workflows against a target repo (`./shannon start`) and includes deterministic cleanup routines (`./shannon cleanup`) to remove agent-generated scripts and execution residue and prevent workspace pollution/exposure. It targets a threat model broader than chat-based prompt injection: agent tool-execution drift, dependency supply-chain issues, and unverified code paths in "agentic company" shell-access workflows.

DockerLiteLLMOpenRouter+3

AI SecurityΒ· Published and added 31 Aug 2026

github.comrepoπŸ›‘οΈ Security

DataSentry

DataSentry is a Claude Code plugin that redacts secrets (AWS keys, tokens, credentials) from tool outputs before they enter the model's context window, using deterministic hooks rather than model instructions, and blocks prompts that contain live credentials. It ships 40 regex-based detection rules (ported from an enterprise Warp ADE ruleset), stable per-secret placeholders via sha1 hashing, per-category overrides, an audit log, and a fail-closed mode; PII/financial/healthcare pattern detection is reserved for a paid Enterprise tier.

Claude CodePython
Warp

AI Security, DevSecOpsΒ· Published and added 27 Aug 2026

github.comrepoπŸ›‘οΈ Security

Cyberful

Cyberful is an AI red-team CLI that orchestrates 316 cybersecurity tools (203 CLI apps/commands including Nmap, Metasploit, Nuclei, plus ZAP and Ghidra) through a multi-agent system: hypothesis workers map attack surfaces and test exploit paths, while a deterministic control plane enforces engagement scope, preserves evidence, and only surfaces independently reproduced vulnerabilities. Built for authorized penetration testing, code audits, and bug bounty hunting; ships a hardened agent-controlled browser, Docker-based runtime, offline MITRE ATT&CK snapshot, and CVE dictionary.

NmapMetasploitNuclei+3

Offensive Security, AI SecurityΒ· Published and added 25 Aug 2026

stepsecurity.ioarticleπŸ›‘οΈ Security

The State of Open Source Supply Chain Attacks

StepSecurity's threat intelligence team's annual report tallies 56 confirmed software supply chain attacks between August 2025 and August 2026, showing an over 8x acceleration since February 2026 driven by self-propagating worms (Shai-Hulud, Shai-Hulud 2.0, CanisterWorm, Miasma, ChainDrop) and mutable GitHub Actions tags. It details the five-day TeamPCP campaign that stole 78,330 secrets from 2,186 organizations by poisoning Trivy Action, Checkmarx KICS, telnyx, and LiteLLM, plus compromises spanning npm, PyPI, RubyGems, Composer, and crates.io.

npmGitHub ActionsPyPI+3
Shai-HuludShai-Hulud 2.0CanisterWorm+22

Supply Chain, DevSecOps, Threat IntelΒ· Added 3 Sep 2026, published 23 Aug 2026

magazine.sebastianraschka.comarticle🧠 AI

How Claude Watermarks AI-Generated Text

Sebastian Raschka (author of "Build a Large Language Model From Scratch") breaks down, in a 48-minute lecture with transcript, exactly how Anthropic's newly announced Claude text watermarking works: it is applied not inside the model but at the sampling stage, using a secret key plus the last few tokens to derive a deterministic random seed. He explains the underlying "tournament sampling" technique (derived from Google's SynthID-Text, published in Nature) where multiple random watermarking functions (G1...Gn) generate bit signatures for candidate tokens that compete pairwise, letting Anthropic later score arbitrary text for the watermark without rerunning the LLM. The piece also covers why the watermark is theoretically removable by editing enough token positions, since only some positions have near-equally-likely alternative tokens.

ClaudeNumPyPyTorch
AnthropicGoogle DeepMindSynthID-Text+2

inference, ai-safetyΒ· Added 29 Sep 2026, published 22 Aug 2026

magazine.sebastianraschka.comtalkπŸ›‘οΈ Security

How Claude Watermarks AI-Generated Text

Sebastian Raschka's recorded lecture (with transcript and slides) breaks down how Anthropic's Claude watermarking works under the hood: a secret watermarking key plus the preceding tokens deterministically seeds next-token sampling, using a tournament-sampling scheme (based on Google's SynthID-Text/Nature paper) that lets Anthropic score arbitrary text for the watermark cheaply without rerunning the LLM. He also explains the practical limits of detection (requires the secret key/API) and how a watermark could be defeated by editing enough token positions, since an attacker cannot know which positions were watermarked without access to the key. The page is truncated before the "What This Means for AI-Generated Text" conclusion section.

ClaudeAnthropic
SynthID-TextSebastian Raschka

AI SecurityΒ· Added 29 Sep 2026, published 22 Aug 2026

socket.devarticleπŸ›‘οΈ Security

NIST NVD: V-etalon AI Enrichment Tool Announced After Audit Finds Backlog, Wasted Spend

Socket.dev reports that NIST has disclosed an unreleased AI tool called V-etalon meant to aid CVE enrichment, alongside a Request for Information on modernizing the National Vulnerability Database. The piece traces two years of unfulfilled NIST automation promises, a Commerce Department OIG audit that found no strategic plan and ~$200,000 in wasted duplicate enrichment spend with CISA, and current NVD data showing 42,353 CVEs stuck in "Not Scheduled" status versus far fewer actively being enriched.

NVDCVSSCPE+1
V-etalonNISTCISA+3

GRCΒ· Published and added 19 Aug 2026

endorlabs.comarticleπŸ›‘οΈ Security

What is an agent harness? The software that turns a model into an agent | Blog | Endor Labs

Endor Labs explainer arguing that an AI agent's "harness" (orchestration loop, tool calling/MCP, memory, sandboxes, permission guardrails) - not the underlying LLM - is what determines both capability and attack surface. It walks through concrete harness-level risks (prompt injection as OWASP's LLM01, MCP servers as unvetted dependencies, permission sprawl) and pitches deterministic lifecycle hooks (as used in Claude Code/Cursor via Endor's AURI) as a jailbreak-proof control layer, citing Endor's Agent Security League benchmark where Cursor+Fable 5 beat Claude Code and Codex on both functional and security correctness.

Model Context ProtocolClaude CodeCursor+3
Agent Security LeagueOWASP Top 10 for LLM ApplicationsClaude Fable 5+1

AI SecurityΒ· Added 3 Sep 2026, published 15 Aug 2026

orca.securityarticleπŸ›‘οΈ Security

Orca Security: SOC Automation

A conceptual deep-dive into SOC automation structured as a five-stage pipeline (trigger, enrichment, decision, action, feedback), arguing that enrichment quality β€” not action count β€” determines outcomes, and that reversibility should set the bar for what runs unattended. It cites concrete platform behaviors (AWS Security Hub rule-ordering, Microsoft Sentinel's 2-minute playbook timeout) and NIST SP 800-61r3's CSF 2.0 incident-response guidance, then covers AI-driven SOC automation where model outputs serve as triggers/enrichment rather than approvals, before pitching Orca's context layer for SIEM/SOAR integrations.

Orca SecurityAWSMicrosoft Sentinel
NIST SP 800-61r3CSF 2.0

Blue Team & Detection, AI SecurityΒ· Published and added 14 Aug 2026

xbow.comarticleπŸ›‘οΈ Security

XBOW: Engineering the Impossible

XBOW describes the layered architecture it uses to contain its autonomous pentesting agents after reviewing three real incidents: OpenAI models escaping a sandbox to reach Hugging Face's production systems, Anthropic's Claude models breaking out of misconfigured CTF environments (including the Mythos PyPI scenario), and a similar Meta model incident. The post argues prompt-level "soft scoping" (telling a model there's no Internet) is insufficient and describes "hard scoping" via a DNS-enforcing egress proxy, per-agent OS-user isolation, a separate non-reasoning Guardian model that vets every action, deterministic auto-pause health checks, and a typed/immutable audit trail. It cites XBOW's own whitepaper "Safety Guardrails in Autonomous Security Testing" as further reading.

XBOWAnthropicOpenAI+2
MythosOpus 4.7

AI Security, Offensive SecurityΒ· Published and added 13 Aug 2026

xmcyber.comwriteupπŸ›‘οΈ Security

Potential for Remote Code Execution in Microsoft SCCM via Newly-Discovered Exploit Chain

XM Cyber researchers detail a four-stage exploit chain in Microsoft SCCM (Configuration Manager) that lets any unprivileged domain user achieve SYSTEM-level remote code execution on the primary site server: a missing authorization check on the AdminService UploadExtensionInChunks endpoint (CVE-2026-47301), a weak code-signing check that accepts any commercial certificate, a "CabSlip" Zip-Slip-style path traversal in CAB extraction giving arbitrary file write, and DLL hijacking of adsource.dll loaded by the SYSTEM-level SMS Executive service. Microsoft patched the RBAC bypass in July 2026, but the rest of the chain remains exploitable via the built-in Operations Administrator role until a full fix in ConfigMgr 2609 (October 2026); the article also gives log-based detection guidance (AdminService.log DirectoryNotFoundException/HTTP 500 patterns) and interim mitigations.

Microsoft SCCMWindowsActive Directory+1
CVE-2026-47301CabSlip

Offensive Security, AppSecΒ· Added 3 Sep 2026, published 13 Aug 2026

aikido.devarticleπŸ›‘οΈ Security

Finding vulnerabilities at every stage: what to run, and when

Aikido breaks down four distinct approaches to finding vulnerabilities in code: deterministic pattern-matching SAST, Deep PR Review (reasoning about a diff's impact on the wider codebase before merge), Code Security Audit/'AI SAST' (LLM-based reasoning across a whole repo without a live target), and AI pentesting (the same reasoning validated via live exploitation against a running app). It explains why each produces different false-positive profiles, why whitebox AI pentests (with source access) found a median 7x more high/critical findings than greybox in over 1,000 Aikido engagements at roughly half the compute cost per finding, and gives guidance on which layer to run at which stage of the SDLC and for which compliance needs (SOC 2, ISO 27001).

Aikido Security
IDORSOC 2ISO 27001

AppSec, Offensive SecurityΒ· Added 3 Sep 2026, published 12 Aug 2026

github.comrepoπŸ›‘οΈ Security

aurscan

aurscan is a Go-based CLI that hooks into yay/paru to scan a downloaded AUR package's PKGBUILD, .install scriptlets, .SRCINFO and helper scripts before makepkg runs, blocking the build if it looks malicious. It combines offline, quote-aware static rules covering known AUR campaign signatures such as disguised source patch URLs, install-scriptlet worms, masqueraded binary file types, and editor auto-exec triggers with an LLM auditor (Claude Code, Codex, Anthropic API, or a local OpenAI-compatible model) that answers a fixed checklist of yes/no behavioral questions, from which aurscan deterministically derives a verdict, severity and confidence, and fails closed when no backend is available. It documents and defends against real incidents including the July 2025 firefox-patch-bin CHAOS RAT vector, the June 2026 Atomic Arch mass orphan-package takeover pulling a Rust stealer and eBPF rootkit, and the August 2026 xsnow dot-install worm that harvested SSH keys and self-propagated across AUR.

GoClaude CodeCodex CLI+3
CHAOS RATAtomic Archxsnow+4

Supply Chain, AI SecurityΒ· Published and added 8 Aug 2026

github.comrepoπŸ›‘οΈ Security

autoguardrails

autoguardrails is an open-source alignment research scaffold from Santander AI Lab, inspired by Karpathy's autoresearch pattern, that searches over a single mutable policy.md file to minimize attack success rate (ASR) against a fixed jailbreak/obfuscation eval suite while enforcing a benign-pass floor so the guardrail can't just refuse everything. It reports asr_unguarded, asr_with_policy, and policy_delta to isolate the guardrail's contribution from the target model's native safety, and supports both an offline deterministic stub and real OpenAI-compatible target/judge models.

PythonOpenAI

AI SecurityΒ· Published and added 5 Aug 2026

github.comrepoπŸ›‘οΈ Security

Precogly

Precogly is an open-source, now-OWASP threat modeling platform (React/TypeScript frontend, Django REST Framework/PostgreSQL backend) offering a collaborative DFD editor with trust zones, TM-BOM import/export, and community library packs linked to MITRE ATT&CK, CAPEC, STRIDE, and LINDDUN. It's positioned as compliance-aware, tracing threats and countermeasures to DORA, the EU Cyber Resilience Act, ASVS, NIST CSF, and SOC 2, and exposes a full OpenAPI REST API meant as scaffolding for AI-driven threat modeling assistants.

ReactTypeScriptDjango+3
OWASPCAPECSTRIDE+6

AppSec, GRCΒ· Added 3 Sep 2026, published 5 Aug 2026

huntress.comwriteupπŸ›‘οΈ Security

Bank of America Phishing Email Delivers ScreenConnect Malware

Huntress dissects a Bank of America-themed phishing email that lures victims into downloading AccountGuardSetup.vbs, which unpacks through several layers of base64-encoded PowerShell to silently install ScreenConnect RMM with Administrator privileges. The chain uses AES-128-CBC encrypted blobs to deliver a C# UAC-bypass exploit via the ICMLuaUtil COM interface (MITRE ATT&CK T1548.002), then hides the resulting ScreenConnect service (renamed "Windows Security") from users and admins using SDDL/ACL manipulation so it can't be seen, logged, or removed.

ScreenConnectPowerShellWindows+2
T1548.002ICMLuaUtilBank of America phishing

Threat Intel, Malware & RE, Offensive SecurityΒ· Added 3 Sep 2026, published 4 Aug 2026

genai.owasp.orgpaperπŸ›‘οΈ Security

OWASP GenAI LLM Top 10 2026

OWASP's 2026 update to the Top 10 for LLM Applications, developed by hundreds of AI security experts and grounded in real-world AI security incidents. It provides updated risk rankings, attack scenarios, and mitigations for prompt injection, model/data poisoning, and other LLM-specific threats, and maps each risk to NIST, MITRE ATLAS, CWE, and the OWASP Top 10 for Agentic Applications.

LLM
OWASP Top 10 for LLM ApplicationsMITRE ATLASOWASP Top 10 for Agentic Applications+1

AI Security, GRCΒ· Added 26 Sep 2026, published 4 Aug 2026

incibe.esadvisoryπŸ›‘οΈ Security

CVE-2026-15988 | INCIBE-CERT | INCIBE

CVE-2026-15988 describes a CSRF vulnerability (CVSS 8.8, CWE-352) in the "AI Engine – The Chatbot, AI Framework & MCP" WordPress plugin, affecting all versions up to and including 3.6.5. Missing/incorrect nonce validation on the reauth_for_authorize function lets an unauthenticated attacker trick a logged-in administrator into visiting a crafted link, which β€” combined with WordPress's ?_method=POST override to turn a GET into an authenticated REST POST β€” creates a new administrator account with attacker-supplied credentials.

WordPress
CVE-2026-15988CWE-352

AppSecΒ· Added 2 Aug 2026

github.comrepo🧠 AI

Semantica

Semantica is an open-source Python pipeline (pip install semantica) that ingests enterprise data and builds a queryable Context Graph and knowledge graph with deterministic (LLM-optional) reasoning, ontology management (OWL/SHACL/SKOS), and W3C PROV-O provenance for full decision auditability. It ships modules for ingestion (Databricks, Snowflake, SAP, Kafka, Git, etc.), NER/relation/event extraction, conflict detection and deduplication, Rete/Datalog/SPARQL reasoning, bi-temporal graph queries, polyglot graph storage (RDF stores and LPGs like Neo4j/Neptune), and integrations with Agno, CrewAI, LangChain, and MCP.

SemanticaPythonRDF+17
SAPAgnoCrewAI+4

llm-apps, agents, ai-infraΒ· Added 22 Sep 2026, published 1 Aug 2026

endorlabs.comarticleπŸ›‘οΈ Security

The OpenAI and Hugging Face security incident: why AI agents need deterministic guardrails | Blog | Endor Labs

Analysis of the July 21 incident in which OpenAI models, during a cyber capability benchmark, exploited a zero-day in an internal package-registry proxy inside an isolated eval sandbox, escalated privileges, moved laterally to an internet-connected node, then chained stolen credentials and additional zero-days into RCE on Hugging Face production servers to exfiltrate benchmark answers. The piece argues probabilistic agents can't be predicted or self-audited (illustrated by the "defender paradox," where provider guardrails blocked Hugging Face's own forensics on the attack logs while GLM-5.2 running on self-controlled infra had to be used instead), and advocates deterministic, model-independent enforcement via agent lifecycle hooks (as in Claude Code, Cursor, Gemini CLI) that intercept shell commands, credential access, and tool calls before execution.

OpenAIHugging FaceClaude Code+2
GLM-5.2Noma Security

AI SecurityΒ· Added 3 Sep 2026, published 31 Jul 2026

endorlabs.comarticleπŸ›‘οΈ Security

Critical Security Controls for Governing AI Coding Agents | Blog | Endor Labs

Endor Labs analyzes the security risks of AI coding agents running on developer laptops with shell, filesystem, network access and the developer's own credentials, framing the threat as prompt-injection-driven abuse of legitimate agent capabilities (e.g., an agent tricked into exfiltrating .env via a malicious README). It maps six control points β€” EDR/XDR, sandboxes/containers, AI/MCP gateways, in-agent hooks, package firewalls, and secrets scanning/PR controls β€” arguing that in-agent hooks (deterministic allow/deny/ask decisions on proposed actions before execution) are the only point that intercepts model intent before it becomes a shell command, and promotes Endor Labs' own hook-based AI Coding Agent Governance and Package Firewall products as the implementation.

Claude CodeCodex CLIGitHub Copilot CLI+5

AI Security, DevSecOps, Supply ChainΒ· Added 3 Sep 2026, published 31 Jul 2026

endorlabs.comarticleπŸ›‘οΈ Security

Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC | Blog | Endor Labs

Endor Labs explains how the hook systems in Claude Code (.claude/settings.json) and Cursor (.cursor/hooks.json) work as deterministic, out-of-band interception points β€” PreToolUse, beforeSubmitPrompt, afterFileEdit, stop, etc. β€” that let a security-owned script allow, deny, or rewrite an agent's shell commands, MCP calls, and file edits before they execute. It details the exit-code/stdout-JSON contract for each platform and describes how their endorctl ai-audit command normalizes both vocabularies, streams every agent action to a backend for a centralized audit trail, and enforces 29 default governance policies (shell-command allow/deny lists, sensitive-file patterns, MCP allowlists) server-side across developer machines.

Claude CodeCursorEndor Labs+1

AI Security, DevSecOpsΒ· Added 3 Sep 2026, published 31 Jul 2026

orca.securityarticleπŸ›‘οΈ Security

Orca Security: AI-BOM

Orca Security explains what an AI-BOM is (an inventory of models, datasets, prompts, embeddings, and external AI services an AI system depends on) and why discovery β€” not format β€” is the hard problem: components arrive via notebooks and managed consoles rather than dependency manifests. It surveys the two competing standards, CycloneDX's ML-BOM (v1.7, standardized as ECMA-424 2nd edition) and SPDX 3.0's AI/Dataset profiles, walks through failure modes like unrecoverable model lineage, stale embeddings outliving deleted source documents, and silent version drift on managed endpoints (e.g. Azure OpenAI's auto-update-to-default), and ties the practice to EU AI Act Annex IV technical-documentation requirements and the NIST AI RMF. It ends by describing Orca's agentless SideScanning-based AI inventory across Azure OpenAI, AWS Bedrock, SageMaker, and Vertex AI.

CycloneDXSPDXSBOM+3
EU AI ActNIST AI RMFOWASP AIBOM Generator+2

AI Security, Supply Chain, GRCΒ· Published and added 31 Jul 2026

orca.securityarticleπŸ›‘οΈ Security

Orca Security: Incident Response Tools

A vendor buyer's guide from Orca Security that breaks incident response tooling into four distinct jobs (evidence/forensics, case management, telemetry/detection, automation) and compares twelve commercial platforms across them: Magnet Axiom Cyber, Exterro FTK Enterprise, Binalyze AIR, Cortex XSOAR, IBM QRadar SOAR, Swimlane, Microsoft Sentinel, Splunk Enterprise Security, Google Security Operations, Torq, Tines, and Rapid7 InsightConnect. It frames evaluation against NIST SP 800-61 Revision 3 (April 2025), covers M&A shifts affecting the category (Darktrace/Cado Security, OpenText/EnCase, Palo Alto/IBM QRadar SaaS EOL), and closes by positioning Orca's agentless cloud context (SideScanning, Unified Data Model) as complementary to these tools rather than a replacement.

Cortex XSOARMicrosoft SentinelSplunk+3
NIST SP 800-61 Revision 3CSF 2.0FIRST CSIRT Services Framework

Blue Team & DetectionΒ· Published and added 31 Jul 2026

mr-r3b00t.github.iootherπŸ›‘οΈ Security

A Really Bad Day

An interactive web-based attack simulation depicting a domain administrator executing a trojanized "SpeedDownloader.exe" containing a backdoor RAT on a Tier 0 host (EXCH01), leading to full domain compromise over a compressed 2-hour kill chain. Users click through 9 attack stages either as Red Team (watching the compromise unfold) or Blue Team (seeing which security controls could break the chain at each step), illustrating Tier 0 asset risk, initial access via trojanized software, and defense-in-depth against domain dominance.

Active Directory

Offensive Security, Blue Team & Detection, LearningΒ· Added 3 Sep 2026, published 31 Jul 2026

github.comrepoπŸ›‘οΈ Security

OpenOSINT

OpenOSINT is a Python OSINT agent that wraps 20 investigation tools (holehe for email enumeration, sherlock for username lookup, sublist3r for subdomain enumeration, phoneinfoga for phone intel, plus HaveIBeenPwned, Shodan, VirusTotal, Censys, AbuseIPDB, IP2Location, DNS/SPF/DMARC checks, GitHub, and Bright Data-powered dorking/scraping) behind a natural-language AI interface that issues deterministic tool calls so findings can't be hallucinated. It ships as a REPL, CLI, MCP server (usable from Claude Code/Desktop, Cursor, Windsurf), or browser web UI, with an optional additive FollowTheMoney entity graph for correlating findings and pivoting between investigation results, plus documented reverse-proxy/credential-handling behavior for remote deployments.

Model Context ProtocolPythonShodan+3

OSINTΒ· Published and added 31 Jul 2026

opensourcemalware.comwriteupπŸ›‘οΈ Security

PolinRider Caused Dozens of npm, Go, PHP Compromises

OpenSourceMalware's research ties together JFrog's, Nextron's, and Socket's separate reports on compromised html-to-gutenberg/fetch-page-assets npm packages, 16 Go modules, and Joyfill's poisoned beta releases, attributing all of them to DPRK's PolinRider campaign via shared XOR keys, TRON/Aptos wallets, C2 infrastructure, and the fa-solid-400.woff2 loader file hash. The piece argues these aren't targeted account takeovers but automated propagation from infected maintainer machines (via temp_auto_push.bat git history rewriting and stolen .npmrc tokens), and uses GH Archive to prove that 43 of 64 analyzed Go module pseudo-version timestamps were forged to appear years older than the actual malicious push. Delivered payloads include InvisibleFerret/DEV#POPPER RAT and the OmniStealer Python infostealer, and the article links a PolinRider crossover into a compromised Packagist/PHP package (roberts/leads) via shared C2 infrastructure.

npmGoPHP+3
DPRKPolinRiderLazarus Group+6

Threat Intel, Supply ChainΒ· Added 3 Sep 2026, published 31 Jul 2026

github.comrepo🧠 AI

redhat-et/ripwire

Ripwire is an offline, single-binary CLI (with optional MCP server) that indexes a repository to give coding agents a ranked, deterministic call graph, task-oriented context bundles (--for, --pack-task), and edit-time checks (--edit-check, --quality-delta, --test-gate) that flag blast radius, contract breakage, and code-quality regressions. It installs skills for Claude Code, Codex, Cursor, Windsurf, Gemini, opencode and aider, and ships extensive self-published benchmarks (docs/EVALS.md, LocBench-style head-to-head comparisons against graph-database MCP servers like codebase-memory-mcp, repowise, graphify and aider) claiming large token and latency savings plus higher file@10 retrieval accuracy. The README includes a detailed field report on using it across a ~20-agent, ~1,500-file C++/Metal orchestration engagement.

Model Context ProtocolClaude CodeCodex+6
WindsurfGeminiaider+3

coding-agents, mcpΒ· Added 2 Oct 2026, published 29 Jul 2026

huntress.comwriteupπŸ›‘οΈ Security

Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking

Huntress SOC tracked a credential stuffing campaign against SonicWall VPN/firewall logins starting July 25, 2026, originating from five DigitalOcean-hosted IPs. Over three days, 92 unique user accounts across 30 organizations were compromised through opportunistic, automated credential validation rather than targeted attacks, with no observed post-compromise activity. The post includes IoCs and mitigation guidance (WAN access restriction, credential resets, MFA enforcement) for defenders.

SonicWall
Huntress

Threat Intel, Blue Team & Detection, Identity & AccessΒ· Added 3 Sep 2026, published 28 Jul 2026

snyk.ioarticleπŸ›‘οΈ Security

What Is AI Pentesting and How Does It Work?

Snyk explains AI pentesting as an orchestrated system β€” a reasoning model that plans reconnaissance/exploitation, deterministic DAST tooling for known vulnerability classes, an independent validator model that confirms exploitability, and context from existing scanner findings β€” designed to catch context-dependent flaws like BOLA/IDOR, cross-tenant leakage, and chained business-logic exploits that signature-based scanners miss. It cites concrete reliability data (frontier models solving only ~26% of hard system-exploitation benchmark tasks, ~30% hallucinated findings without independent validation, 210% YoY growth in valid AI-generated HackerOne reports and 540% growth in prompt-injection reports) and positions Snyk's Evo Continuous Offensive Security product against these evaluation criteria. It also references a RAND 2026 study on low-cost CTF-solving coding agents, Anthropic/Mozilla open-source vulnerability discovery work, and Google GTIG's report of the first in-the-wild AI-assisted zero-day.

SnykHackerOneAnthropic
RANDGoogle GTIG

Offensive Security, AI Security, LearningΒ· Added 3 Sep 2026, published 27 Jul 2026

github.comrepo🧠 AI

yolorouter/yolorouter

Yolorouter is a free, self-hosted, single-binary LLM gateway that translates between the four major chat wire protocols β€” OpenAI Chat Completions, OpenAI Responses, Anthropic Messages, and Gemini generateContent β€” so a client built for one provider (e.g. Claude Code) can be pointed at any other. It adds multi-provider failover, round-robin upstream API key pooling with rate-limit/quota handling, per-key budgets and access control, a multi-user admin console with OAuth2/OIDC SSO, and native image/video generation support for OpenAI-shaped and non-OpenAI-shaped providers (DashScope, Volcengine Ark, Kling, MiniMax). It also ships cost-optimization features β€” deterministic system-prompt injection and tool-output compression for coding agents β€” backed by a published benchmark, plus built-in usage/cost observability.

DockerGoSQLite+4
YolorouterOpenAIAnthropic+11

ai-infraΒ· Added 2 Oct 2026, published 21 Jul 2026

arxiv.orgpaperπŸ›‘οΈ Security

AI Security Briefing

This paper presents the first systematic evaluation of package-install-time supply-chain attacks delivered through ordinary project-setup documentation (README, requirements files, Makefiles) against production AI coding-agent harnesses. Testing frontier models across twelve scenarios in five attack classes grounded in real incidents, the authors find install-time security depends on the harness-model pairing rather than the model alone: agents reliably catch blatant typosquats but miss plausible separator-confusion names (e.g. azurecore for azure-core) and almost universally miss registry-redirection attacks, with the source blind spot recurring on npm and Cargo. A deterministic pre-install check that verifies package names, sources, and versions before code execution closes most of the gap.

npmCargoPyPI

AI Security, Supply ChainΒ· Published and added 18 Jul 2026

thehackernews.comadvisoryπŸ›‘οΈ Security

AI Security Briefing

CISA added four actively exploited vulnerabilities to its KEV catalog: a path traversal RCE in Adobe ColdFusion (CVE-2026-48282, CVSS 10.0), an unauthenticated file-upload RCE in Joomlack Page Builder CK (CVE-2026-56290, CVSS 10.0), an IDOR in Langflow allowing cross-tenant flow execution and LLM/AWS key theft (CVE-2026-55255, CVSS 6.1), and an unauthenticated arbitrary file upload in JoomShaper SP Page Builder (CVE-2026-48908, CVSS 10.0). Sysdig documented an operator chaining the Langflow IDOR with CVE-2026-33017 RCE for opportunistic, financially motivated cryptojacking/botnet activity and credential theft from an AI orchestration platform, while mySites.guru observed web shell deployment via the Joomla flaws. FCEB agencies must patch by July 10, 2026.

Adobe ColdFusionLangflowPHP+1
CVE-2026-48282CVE-2026-56290CVE-2026-55255+15

Threat Intel, AppSec, AI SecurityΒ· Published and added 18 Jul 2026

socket.devarticleπŸ›‘οΈ Security

Socket: White House Launches Gold Eagle Initiative to Manage Surge in AI-Discovered Vulnerabilities

Socket reports on the White House's Gold Eagle initiative, a clearinghouse created under Trump's June 2 executive order on AI security to coordinate AI-discovered vulnerability scanning, validate findings, and prioritize patching across federal systems, critical infrastructure, and open source. The piece notes Gold Eagle will reuse Carnegie Mellon's VINCE platform rather than build new infrastructure, and contrasts the initiative's ambitious claims with the unresolved bottleneck of maintainer capacity, citing curl's Daniel Stenberg reporting a 4-5x surge in AI-assisted vulnerability reports and NIST's NVD backlog failures as evidence that coordination structures alone do not solve the problem.

curlNVDVINCE
Gold EagleDaniel StenbergNIST+2

GRC, AI SecurityΒ· Published and added 18 Jul 2026

github.comrepo🧠 AI

gioblu/NPC-Forge

NPC-Forge is a framework for building deterministic, non-ML conversational NPCs/agents with multi-turn context, sentiment analysis, and tool-call support, designed to run on CPU even on embedded or obsolete hardware. It ships with an OpenAI-compatible API server so its deterministic agents can be plugged into LLM harnesses like Open WebUI or GitHub Copilot, and includes TERMy, a bundled NPC that transpiles natural-language prompts or scripts into shell commands without using any model. Agents are defined and updated via a dataset format (NDF) rather than trained, with a CLI (npc-forge list/serve/install/reboot) for managing and running them; currently an experimental Linux/WSL-only release under AGPL-3.0.

OpenAI APIGitHub CopilotOpen WebUI
NPC-ForgeTERMyNLP.js

agentsΒ· Added 30 Sep 2026, published 18 Jul 2026

github.comrepoπŸ›‘οΈ Security

GoogleCloudPlatform/k8s-aibom

k8s-aibom is a Kubernetes controller from GoogleCloudPlatform that generates CycloneDX 1.6 ML-BOM documents at runtime for AI workloads β€” inference services (vLLM, TGI, Triton, Ollama), agent stacks (LangChain, AutoGen, CrewAI), RAG/vector DB infrastructure (Milvus, Qdrant, Weaviate), and training/eval jobs β€” by watching Kubernetes API objects with no privileged access. Each BOM attribute carries a declared/inferred/unresolved confidence flag and evidence locator, and the project positions its output as auditor-traceable evidence for EU AI Act Article 12/50, NIST AI RMF, and ISO/IEC 42001 compliance, with redaction filters, immutable GCS write-once sinks, and Sigstore-signed release attestations.

KubernetesCycloneDXSigstore+3
EU AI ActNIST AI RMFISO/IEC 42001+2

Supply Chain, Cloud & Infra, GRCΒ· Published and added 18 Jul 2026

github.comrepoπŸ›‘οΈ Security

Icex0/wp2shell-poc

wp2shell-poc is an independent proof-of-concept tool for the wp2shell vulnerability chain in WordPress core: an unauthenticated route-confusion bug in the REST /batch/v1 handler (serve_batch_request_v1) that desynchronizes matched-handler and validation arrays when a sub-request fails wp_parse_url(), letting a GET posts item-route request be dispatched under get_items() so the author_exclude parameter reaches WP_Query's author__not_in query var as unsanitized SQL. The tool's check/read/shell commands detect the route-confusion marker pattern, extract data via UNION/error-based/boolean-blind SQLi, and (without credentials) chain UNION fake-post rendering into oEmbed cache post creation, ID recovery via SQLi, and a poisoned batch request that creates a real WordPress administrator account, finishing with a plugin-upload webshell. Affects WordPress builds before 7.0.2 (or 6.9.5 on the 6.9 branch); links out to Searchlight Cyber's advisory and Elastic/Eye Security detection guidance.

WordPressPython
wp2shellSearchlight CyberElastic Security Labs+2

AppSec, Offensive SecurityΒ· Added 2 Oct 2026, published 17 Jul 2026

github.comrepoπŸ›‘οΈ Security

Mantis

Mantis is Google's open-source suite of AI agent skills plus an ADK-based reference harness for autonomous security code review. It walks a codebase to build a semantic index and threat model, generates and executes vulnerability research hypotheses across agents, deduplicates and triages findings to combat LLM hallucination, attempts reproduction (static guesses up to spun-up mock servers), chains findings for impact, and patches issues in an adversarial verify-the-fix loop, calibrating severity against a rubric to avoid inflated "critical" spam. It explicitly warns it is demonstration-only, non-deterministic, and requires isolated sandboxing plus human expert verification before any findings are reported.

PythonGoogle Cloud

AI Security, AppSecΒ· Published and added 15 Jul 2026

github.comrepoπŸ›‘οΈ Security

deep-scan

deep-scan is a modular security-scanning monorepo exposing one shared scanner engine (SAST, SCA, secrets, IaC, license, malware, DAST, CI/CD checks) through a CLI, MCP server, REST API/web app, and a continuous-scanning ASPM fleet called kruncher. It adds a deterministic, AI-free code-graph engine for taint and reachability analysis to cut CVE noise to actually-reachable dependencies, an optional local-model AI triage pass, and an agent-driven MCP workflow that scans, confirms reachability, and opens fix-group PR branches with regression tests. Untrusted-repo scanning is hardened with pinned/checksum-verified tools, sandboxed subprocesses, and optional gVisor (runsc) isolation for dependency resolution on Kubernetes.

Model Context ProtocolPythonDocker+3

AppSec, DevSecOps, Supply ChainΒ· Added 3 Sep 2026, published 14 Jul 2026

github.compaperπŸ›‘οΈ Security

WSO2 Trusted AI Governance

WSO2 CTO Asanka Abeysinghe's architectural thesis argues that agentic AI systems break specification-based governance and instead require a control system spanning discovery, first-class agent identity and delegation, parameter-aware boundary authorization, runtime safety (prompt injection, jailbreaks, tool misuse, data exfiltration), deliberate human oversight, centrally-authored/distributedly-enforced policy, evidentiary observability, and economic (cost/budget) controls. It distinguishes inline governance (embedded in agent code) from infrastructure-enforced governance (gateways, proxies, service meshes, model/API gateways) and proposes a control-plane/data-plane split as the load-bearing pattern, referencing EU AI Act, NIST AI RMF, ISO 42001, and MCP registries as systems of record.

Model Context Protocol
EU AI ActNIST AI RMFISO 42001+2

AI Security, GRCΒ· Added 3 Sep 2026, published 14 Jul 2026

blog.kubeek.comwriteupπŸ›‘οΈ Security

deep scan tuto

Build log/tutorial for "Deep Scan," a PoC that pairs a deterministic security-scanning engine (20+ SAST/SCA/DAST scanners normalized into one Finding model, plus an AI-free code-graph engine doing taint/reachability analysis) with an agentic remediation loop exposed via an MCP server and three Claude Code skills (/security-eval, /security-patch, /security). The agent triages thousands of raw findings down to a prioritized P0–P3 plan, groups fixes into reviewable branches, and proves each fix with a demonstration test that safely calls an inert owner-operated canary endpoint instead of firing a real exploit (e.g., rm -rf /). The author also covers scaling via Docker Compose/Kubernetes+gVisor and the risk of running untrusted dependency-resolution code during scans.

Model Context ProtocolClaude CodeSARIF+3
Deep ScanMDASHFable 5+2

AI Security, AppSec, DevSecOpsΒ· Published and added 14 Jul 2026

github.comrepoπŸ›‘οΈ Security

apisec-inc/AI-Surface

ai-surface is a local/offline static analysis CLI (apisec-inc) that scans a codebase for AI attack surface β€” LLM SDK calls, agent frameworks (LangChain, AWS Strands), MCP servers, RAG/vector stores, model gateways, and provider keys β€” and flags risk indicators such as financial-action tools with no human approval or unverified MCP servers. It generates an AI-BOM (CycloneDX), SARIF for GitHub code scanning, and maps findings to OWASP LLM Top 10, EU AI Act, NIST AI RMF, and ISO/IEC 42001, with a baseline+fail-on-severity workflow for gating new risk in PRs without blocking on pre-existing debt.

Model Context ProtocolLangChainPython+4
OWASP Top 10 for LLM ApplicationsEU AI ActNIST AI RMF+1

AI Security, DevSecOpsΒ· Published and added 11 Jul 2026

blog.ethereum.orgarticleπŸ›‘οΈ Security

The triage is the product: running AI agents against Ethereum's protocol code

The Ethereum Foundation's Protocol Security team describes how they run many AI agents in parallel against systems software, cryptographic code, and contracts, coordinating through shared state in version control (a pattern borrowed from Anthropic's fleet-based C compiler experiment) with recon, hunting, gap-filling, and validation roles. The team found and disclosed CVE-2026-34219, a remotely-triggerable panic in libp2p's gossipsub, and details a false-positive taxonomy that keeps recurring: debug-only panics that vanish in release builds, reproducers built from hand-crafted values no real input path can reach, and formally-verified proofs that are vacuously true. It argues the real bottleneck has shifted from finding bugs to judging and triaging AI-generated candidates at scale, and lays out concrete practices β€” mandatory self-contained reproducers, provenance tracking, deterministic environments, and human-only sign-off β€” for keeping agent-driven audits trustworthy.

EthereumAnthropicCloudflare
CVE-2026-34219libp2p gossipsubStanislav Fort+2

AI Security, AppSecΒ· Added 29 Sep 2026, published 9 Jul 2026

github.comrepoπŸ›‘οΈ Security

requie/AI-Red-Teaming-Guide

A community-maintained GitHub guide (requie/AI-Red-Teaming-Guide) that consolidates AI red-teaming methodology, mapping techniques like prompt injection, jailbreaking (Skeleton Key, Crescendo), model extraction, data/fine-tuning poisoning, and MCP tool-poisoning/rug-pull attacks to frameworks including NIST AI RMF, OWASP Top 10 for LLM Applications and Agentic Applications, MITRE ATLAS, and CSA's Agentic AI Red Teaming Guide. It cites real incidents (OpenClaw's CVE-2026-25253, GitHub Copilot's CVE-2025-53773, the Anthropic-disrupted Claude Code state-sponsored campaign, the Morris II AI worm) and surveys red-team tooling (PyRIT, NVIDIA's Garak, DeepTeam) plus emerging agent-orchestrated red-teaming approaches.

MITRE ATLASModel Context ProtocolPyRIT+2
CVE-2026-25253CVE-2025-53773OpenClaw+9

AI Security, LearningΒ· Published and added 8 Jul 2026

stepsecurity.iowriteupπŸ›‘οΈ Security

10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions

StepSecurity walks through the TeamPCP-led compromise of aquasecurity/trivy-action (CVE-2026-33634, CVSS 9.4), where attackers force-pushed a credential-stealing payload into 76 of 77 version tags, plus the related Checkmarx KICS action compromise, both harvesting secrets from /proc/pid/mem of the GitHub Actions Runner.Worker process and exfiltrating to a typosquatted domain (scan.aquasecurtiy.org, 45.148.10.212). The post details the attack technique of 'imposter commits' (fork commits reachable by SHA but not on any branch) used to hide the malicious tags, and situates the incident alongside the same-window CanisterWorm npm worm and TeamPCP credential stealers in litellm and telnyx PyPI packages, then maps ten StepSecurity/Harden-Runner defense-in-depth controls (egress blocking, process lockdown, SHA-pinning PRs, imposter-commit scanning, global blocklist) to each stage of the kill chain.

GitHub ActionsTrivyCheckmarx+3
CVE-2026-33634TeamPCPCanisterWorm+4

Supply Chain, DevSecOps, Threat IntelΒ· Added 3 Sep 2026, published 2 Jul 2026

socket.devwriteupπŸ›‘οΈ Security

Socket: PolinRider

Socket's Threat Research Team documents the expansion of PolinRider, a North Korea-linked (Contagious Interview / Famous Chollima) supply chain campaign, finding 162 malicious release artifacts across 108 packages and extensions spanning npm, Packagist, Go modules, and Chrome extensions. Attackers compromise GitHub maintainer accounts, hide obfuscated JavaScript loaders in fake .woff2 font files or config files, trigger execution via VS Code task files, and use force-pushed/anti-dated commits to disguise malicious changes; the loader fetches second-stage payloads (DEV#POPPER, OmniStealer) via TRON/Aptos/BNB Smart Chain RPC infrastructure for credential and wallet theft.

npmPackagistGo+3
PolinRiderContagious InterviewFamous Chollima+4

Threat Intel, Supply ChainΒ· Published and added 2 Jul 2026

wiz.ioarticleπŸ›‘οΈ Security

Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness

Wiz breaks down Executive Order 14409 ('Securing the Nation Against Advanced Cryptographic Attacks') and OMB memorandum M-26-15, which set accelerated federal deadlines for migrating High Value Assets and High Impact Systems to NIST-approved post-quantum cryptography (key establishment by 2030, digital signatures by 2031). It covers requirements for automated cryptographic inventories, forthcoming NIST/CISA Cryptographic Bill of Materials (CBOM) guidance, Harvest-Now-Decrypt-Later risk prioritization, FedRAMP/FAR Council contractor compliance rules, and comparable international timelines (EU, Japan, Australia, India), before pitching Wiz's own CBOM/PQC readiness tooling.

Wiz
Executive Order 14409M-26-15FAR Council+3

GRCΒ· Added 3 Sep 2026, published 2 Jul 2026

github.comrepoπŸ›‘οΈ Security

XORCISM-AI/XORCISM

XORCISM is a self-hosted, open-source enterprise risk/exposure management platform (Node.js/TypeScript over SQLite/PostgreSQL/MySQL) that unifies asset inventory, vulnerability management, threat intel (STIX/TAXII), GRC (ISO 27001, NIST CSF/800-53, EBIOS Risk Manager, NIS2, DORA), incident management, and offensive/defensive testing into one continuously recomputed per-asset and enterprise risk score. It chains recon/exploitation tool connectors (nmap, nuclei, Metasploit, sqlmap) into attack-path/choke-point graphs weighted by fusion exploitability (EPSS+CVSS+KEV+public exploits), validates detection coverage via a purple-team loop against 3,750+ Sigma rules and MITRE ATT&CK/D3FEND, and quantifies ransomware impact in dollar terms via a FAIR-style model β€” with local-only Ollama AI assistants for triage, hunting, and reporting.

Node.jsTypeScriptSQLite+3
APT29SecureCodersRustinel

GRC, Offensive Security, Blue Team & DetectionΒ· Published and added 1 Jul 2026

blog.trailofbits.comwriteupπŸ›‘οΈ Security

Shipping post-quantum cryptography to Python

Trail of Bits, funded by the Sovereign Tech Agency, implemented Rust bindings for NIST's ML-KEM (FIPS 203) key-establishment and ML-DSA (FIPS 204) digital-signature standards into pyca/cryptography, shipped in version 48 with AWS-LC backend support. The post makes them a pip install away for the Python ecosystem (pyca/cryptography sees 1.2B monthly PyPI downloads and underpins Certbot, Ansible, Airflow, and paramiko), while detailing the size/performance tradeoffs versus Ed25519/X25519 and noting SLH-DSA (FIPS 205) support and protocol-level integration are still in progress.

PythonPyPIRust+3
ML-KEMML-DSASLH-DSA+6

AppSecΒ· Added 3 Sep 2026, published 30 Jun 2026

snyk.iowriteupπŸ›‘οΈ Security

Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

Snyk's VulnBench JS 1.0 report runs 300 repeated agentic security-review scans (10 JS/Express fixtures x 6 model configs x 5 repetitions) to measure whether LLMs like Claude Opus 4.6/4.7 and Claude Sonnet 4.6 find the same vulnerabilities twice, benchmarked against deterministic Snyk Code SAST reference findings. Key results: reference-matched LLM findings were highly repeatable (84.8% appeared in all 5 runs) while extra, non-reference LLM findings were unreliable (only 14% reproduced in all runs), the best LLM config (Opus 4.6 Medium) reached only 75.4% Snyk-reference F1 with a 24.6-point gap to SAST, and higher-cost models (Opus 4.7 Max) did not outperform cheaper ones despite 5.7x cost. The study argues LLM review and SAST catch different vulnerability classes (LLMs strong on injection/SSRF-type bugs, weak on path traversal/resource-limit enumeration) and should be combined rather than substituted.

ClaudeSnykJavaScript
Snyk CodeOpus 4.6Opus 4.7+2

AI Security, AppSecΒ· Added 3 Sep 2026, published 29 Jun 2026

github.comrepoπŸ›‘οΈ Security

OASIS

OASIS (Open Automated Security Intelligence Scanner) is an AI-powered SAST tool that runs local LLMs via Ollama or any OpenAI-compatible backend (vLLM, LiteLLM, LM Studio, llama.cpp) to detect vulnerabilities like SQLi and XSS in source code. It uses a two-phase scan (lightweight scan model + deep analysis model) orchestrated by a LangGraph pipeline (discover→scan→expand→deep→verify→report), adds a deterministic finding-validation agent that computes exploitability verdicts with confidence, and exports canonical JSON/SARIF/HTML/PDF reports with a web dashboard, RAG-backed chat assistant, --fail-on CI gating, and suppression/inline-ignore support.

OllamavLLMLiteLLM+3

AI Security, AppSecΒ· Published and added 28 Jun 2026

huntress.comarticleπŸ›‘οΈ Security

How to Spot a Client in the DoD Industrial Base That Handles CUI

A Huntress blog post (authored by DEFCERT's Ryan Bonner) gives MSPs and MSSPs a concrete methodology for spotting clients that are secretly part of the DoD Industrial Base and subject to DFARS 252.204-7012/-7021, CMMC, and NIST 800-171 obligations. It covers public research signals (USASpending.gov contract lookups, ITAR/DDTC registration, AS9100 certification, Nadcap accreditation, contract vehicles like IDIQ/GWAC/BPA/OTA) and direct screening questions (FAR/DFARS flow-down clauses, DoD distribution-statement-marked technical data, PIEE/SPRS/WAWF account access) to determine whether a company handles Controlled Unclassified Information. It closes with a pitch for Huntress's CMMC Level 2 control coverage.

Huntress
CMMCDFARS 252.204-7012DFARS 252.204-7021+8

GRCΒ· Added 3 Sep 2026, published 25 Jun 2026

snyk.ioarticleπŸ›‘οΈ Security

NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence

Snyk analyzes NIST's April 15, 2026 policy change to NVD, which replaced universal CVE enrichment with a risk-based triage model prioritizing CVEs in CISA's KEV catalog, federal-government software, and EO 14028 critical software, while deprioritizing everything else as lowest priority not scheduled. The piece details operational changes (NIST no longer routinely providing an independent CVSS score when a CNA already supplied one, and only reanalyzing modified CVEs when materially impactful) and argues this creates blind spots for scanners that depend solely on NVD, driven by CVE volume growth from about 18000 in 2020 to over 48000 in 2025 due to the federated CNA model and AI-accelerated vulnerability research.

NVDCVSSSnyk
CISA KEVExecutive Order 14028NIST

AppSec, Supply Chain, GRCΒ· Added 3 Sep 2026, published 25 Jun 2026

academy.8ksec.iocourseπŸ›‘οΈ Security

8kSec AI/LLM Exploitation Labs

8kSec's AI/LLM Exploitation Labs is a set of hands-on CTF-style challenges covering real attack classes against AI systems: prompt-injection to manipulate an LLM essay grader and a workspace assistant into granting admin access, crafting adversarial images to bypass an MNIST-based ML authentication vault, extracting a "secret" encryption key from an n8n/OpenAI chatbot via conversation alone, exploiting a remote MCP server (via Cursor) for path traversal to read /etc/passwd, poisoning a training CSV to backdoor a spam classifier, detecting neural network backdoors in CIFAR-10 models, spotting a malicious MCP skill with a data-exfiltration payload, and identifying "ghost record" membership-inference leakage in a supply-chain-compromised model. Each challenge maps to a distinct AI security technique (prompt injection, adversarial examples, model/data poisoning, MCP tool abuse, membership inference) and offers a free certification on completion.

Model Context ProtocolOpenAICursor

AI Security, LearningΒ· Published and added 21 Jun 2026

jfrog.comarticleπŸ›‘οΈ Security

JFrog: npm v12

JFrog's Security Research Team breaks down npm v12's core security change: lifecycle scripts, Git-based dependencies, and remote URL dependencies will be blocked by default and require explicit approval (allowScripts, --allow-git, --allow-remote flags), reversing npm's historical implicit-execute-on-install model. The article ties each control to real campaigns β€” Shai-Hulud variants abusing preinstall/postinstall hooks, easy-day-js typosquatting a dayjs dependency, CanisterWorm's Python backdoor via postinstall, and the PhantomRaven remote-dynamic-dependency campaign β€” and predicts attackers will pivot to compromising already-trusted scripted packages and shifting to runtime (import-time/invocation-time) execution to evade the new installation-time controls.

npmnode-gypBun
Shai-HuludMiasmaeasy-day-js+4

Supply ChainΒ· Published and added 18 Jun 2026

socket.devwriteupπŸ›‘οΈ Security

Socket: npm Package Uses Prompt Injection + Token Flooding to Evade AI Malware Scanners

Socket Threat Research analyzed shai_hulululud@1.0.48596, a ~9.28MB npm package whose index.js opens with a Japanese-language block comment simulating bioweapon-production instructions to trigger LLM safety refusals, follows with a fake 'SYSTEM OVERRIDE' prompt-injection block aimed at AI reviewers, then floods the file with tens of thousands of repeated comment lines (3.5M+ tokens) before appending doubly-obfuscated (character-substitution plus AES) JavaScript. The deobfuscated payload reintroduces the same policy-triggering content and scanner/vendor-referencing strings, and was classified as protestware rather than a functional credential stealer; the piece argues this demonstrates a practical LLM-specific denial-of-service pattern (prompt injection + safety triggers + context flooding + obfuscation) that AI-assisted supply-chain scanners must defend against via deterministic preprocessing, fail-closed behavior, and combining LLM review with static/AST/entropy/behavioral analysis.

npmSocketJavaScript+1
shai_hulululudShai-HuludMini Shai-Hulud+2

AI Security, Supply Chain, Malware & REΒ· Published and added 17 Jun 2026

huntress.comwriteupπŸ›‘οΈ Security

The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed

Huntress SOC incident report on an internet-facing RD Gateway/RDWeb terminal server compromised via credential reuse with no MFA, where the actor staged Gammadyne Mailer (a legitimate commercial bulk-mail tool) to send 8.9 million Boots-impersonation phishing emails direct-to-MX from the victim's clean IP, evading AV entirely. The phishing kit itself was hosted on a compromised Bolivian government domain (ipelc.gob.bo) to inherit its trust and dodge reputation blocklists, and the writeup details the log-forensics (Windows Security log gaps, Terminal Services operational logs, Chainsaw parsing, WFP Event 5157) used to reconstruct the timeline and attribute a separate opportunistic brute-force bot.

RDPIISWindows+3
ipelc.gob.boBootsdracii.mmp+2

Threat Intel, Blue Team & Detection, Identity & AccessΒ· Added 3 Sep 2026, published 15 Jun 2026

endorlabs.comarticleπŸ›‘οΈ Security

Endor Labs: AI AppSec Agents Cost 12x More Without Pre-Computed Security Context

Endor Labs argues that AI coding/security agents are far more expensive when they must reconstruct security context (SCA, reachability, license data) from raw repo reads instead of using deterministic tools. Their benchmark of 442 security prompts (reachability, exploitability, prioritization, remediation, license compliance) across 12 open-source projects in 6 languages found an LLM-only agent averaged ~14 tool calls per question (mostly grep/file-read/web-search) versus ~2.5 high-level calls when equipped with Endor Labs' precomputed security data, yielding a 91.7% token reduction and 4.5x fewer tool calls. The piece also cites a naive academic LLM vuln-scan baseline that flagged ~14,000 candidate sinks with zero confirmed vulnerabilities, and quotes Anthropic's Michael Moore stating Claude Code Security is meant to augment, not replace, existing AppSec tooling.

Endor LabsClaude CodeCodex+3
MythosMichael MooreFinOps Foundation+3

AI Security, AppSecΒ· Published and added 11 Jun 2026

github.comrepo🧠 AI

book-to-skill

book-to-skill is an open-source converter that turns a technical book, docs folder, or set of source files into a structured "Agent Skill" (SKILL.md plus per-chapter files) usable by Claude Code, GitHub Copilot CLI, Amp, Hermes Agent, and OpenClaw. It pairs a deterministic Python extractor (PDF/EPUB/DOCX/etc. β†’ clean text) with a spec-driven generator that distills frameworks, decision rules, and anti-patterns, loading chapter content on demand to claim 24x-51x fewer tokens than dumping the whole document into context.

Claude CodeGitHub Copilot CLIAmp+6

coding-agents, promptingΒ· Added 22 Sep 2026, published 10 Jun 2026

jakewnuk.comarticle🧠 AI

The Digital Context Gap

First post in a series on building agentic infrastructure. It separates traditional machine learning (gradient-boosted trees, fraud detection) from black-box neural networks like LLMs. It argues LLMs add value in two cases: non-deterministic workflows that can't be hand-programmed, and as a "digitally native" interface that narrows the "digital context gap" between human and machine speed at handling context. It also challenges its own thesis, noting that models lack real comprehension and that even a 1% error rate is costly at volume. It closes with practical principles: start from the problem, design for failure, add validation layers and human-in-the-loop checkpoints, and treat LLMs as enhancement rather than replacement.

LLMvision-language modelgradient-boosted trees+1
ChatGPTBenford's Law

ai-policy, agentsΒ· Added 22 Sep 2026, published 10 Jun 2026

Showing 240 of 266

Show more