Chainalysis disclosed a data breach in which an external actor used offensive agentic techniques to access its systems and internal tools. Exposed data was non-sensitive customer data: user IDs, full names, email addresses and organization role labels. Investigation content, query results and credentials were not compromised. The company says the incident is unrelated to the $6.36 billion Binance heist, and advises users to enable MFA and watch for password reset prompts. Scope and victim count are undisclosed.
LLM
ChainalysisBinanceDPRK
Threat Intel, AI Securityยท Published and added 2 Nov 2026
Chainalysis confirmed on 30 October 2026 that an external actor accessed its systems and internal tools earlier in October, using what it called "offensive agentic techniques". Exposed data covers some customers' names, emails, job titles, user IDs and role labels. Chainalysis says it has found no access to passwords, session tokens or investigation content so far, and customers should expect targeted phishing. Affected-customer counts and the exploited vulnerabilities are not disclosed.
Chainalysis disclosed on 30 October 2026 that an attacker using "offensive agentic techniques" accessed customer names, emails, user IDs and role labels, but no investigation content, passwords or session tokens. The report also covers the Binance hack (about $6.3-6.4 billion, attributed to North Korea), where funds loop through addresses and JustLend lending on Tron is used to dodge stablecoin freezes. About $2.8 billion is frozen.
TronJustLend
ChainalysisBinanceDPRK
Threat Intel, Blockchain, AI Securityยท Published and added 31 Oct 2026
Chainalysis disclosed a security incident in which an external actor used "offensive agentic techniques" to access internal systems and tools earlier in the month. Exposed customer data includes user IDs, names, email addresses and organizational role labels. The company reports no evidence of access to investigation content, credentials or session tokens, and has shared no details on the vulnerabilities, tools or dwell time. The article also lists other incidents from the same week.
ChainalysisBinanceARTEX+3
Threat Intel, AI Securityยท Published and added 31 Oct 2026
Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.
Virtualine is a Russian-speaking bulletproof hosting provider whose domain virtualine.net the FBI seized. Court documents say it hosted phishing, spam, carding and illicit content, and ignored abuse reports. TRM Labs says it received more illicit-attributed cryptocurrency than any other labeled bulletproof host, mostly from a Russian drug marketplace (44%) and a sextortion scheme (17%), and later from StealC operators in 2026.
Binance is investigating a possible breach involving up to $5.8 billion in assets, which would exceed the $1.5 billion Bybit theft of February 2025. Tether froze over $1.567 billion in USDT and Circle over $800 million in USDC. Arkham tracks 55 addresses labelled "binance-hacker-1029" holding about $5.78 billion, but that is wallet holdings, not a confirmed theft amount. The cause is not yet known.
BinanceEthereumTether+2
BybitChangpeng ZhaoCircle+5
Blockchain, Threat Intelยท Added 30 Oct 2026, published 29 Oct 2026
VeriCUA is a platform-agnostic framework that verifies task completion by computer-using agents through agentic exploration. The verifier inspects context to build a task rubric, then picks GUI or code checks for unresolved requirements and combines findings under explicit evidence rules. It works online and offline across desktop, mobile and web, and agrees better with reference labels than the baselines, with the largest offline gains on hard cases.
vision-language modelVeriCUA
arXiv
agents, evals, researchยท Added 31 Oct 2026, published 29 Oct 2026
This paper derives bounds on predicting an LLM's decode length from prefill-phase hidden states, a primitive for inference scheduling. It models decoding as a stopped stochastic process, giving per-prompt normality and an affine variance law ฯ=ฮฑฮผ+b. Predictors (MLP, EGTP, FiLM, soft-label, Mixture-of-Experts) converge near the bound, so system error dominates model error. It proposes fixing model, data and sampling in benchmarks and reporting relative-error metrics.
LLMMixture of ExpertsMLP+2
arXiv
research, inference, evalsยท Added 31 Oct 2026, published 29 Oct 2026
On-policy state training is a method for training chain embedding retrievers for multi-hop RAG on the states the encoder itself reaches, including those built on its own wrong retrievals. Each state is labeled with the earliest missing gold passage, other missing gold passages are masked, and updates are contrastive and mixed with teacher-forced states. It retrieves complete evidence more often than teacher-forced training and graph-based systems, and transfers to harder long-chain HotpotQA and 2WikiMultiHopQA variants the authors built.
RAGon-policy state trainingcontrastive learning+1
HotpotQA2WikiMultiHopQAarXiv
research, llm-apps, trainingยท Added 31 Oct 2026, published 29 Oct 2026
Wiz Research reviews agentic attacks seen in its incident response work and in public reports (ARTEX, Hermes, JPCERT/CC, CrowdStrike, DIVD). It derives fingerprints of AI-agent activity from three intrusions: machine-paced iteration, natural-language reasoning in scripts, self-correcting script versions, checklist enumeration, noisy lateral spraying, probe-before-payload and self-labeled scratch files. It also covers effects on attribution, attack scale and defense.
KubernetesAWSClaude Code+2
ARTEXHermesStorm-0940+12
Threat Intel, Blue Team & Detection, AI Security, Cloud & Infraยท Published and added 29 Oct 2026
Proof-Carrying Messages (PCM) is a protocol where each claim an AI agent sends carries evidence: records from an append-only Merkle log the agent cannot write, with inclusion proofs, signed by an attesting signer. Receivers verify offline in about 1 ms and label each claim proven, unproven or failed. On 926 messages (712 lies in 16 classes), PCM accepts 10 lies (1.4%), all stale evidence; plain A2A accepts all 712.
A2AModel Context ProtocoluAgents+5
arXiv
agents, researchยท Added 31 Oct 2026, published 29 Oct 2026
inkGround is a benchmark for stroke trajectory recovery from full-page, camera-captured handwriting, with 537 page images (about 18.7k words, 163k strokes) and pseudo-label references filtered by OCR agreement and human raters. Models get a page image and a target word, then output ordered stroke points. Seven VLMs were scored with DTW, Chamfer distance, readability and style similarity. Closed-source models, notably Gemini-3.1-Pro, did best, and the ranking held on IAM-OnDB.
vision-language model
inkGroundIAM-OnDBGemini-3.1-Pro+1
evals, multimodal, researchยท Added 30 Oct 2026, published 28 Oct 2026
Nemotron 3.5 Transcribe is an open-weight, promptable 30B mixture-of-experts model from NVIDIA with about 4B active parameters, built for recorded audio. One checkpoint transcribes 40 languages, handles recordings up to an hour, labels up to eight speakers, translates, and answers questions about English audio. Weights and a demo are on Hugging Face. The post gives no benchmarks.
Mixture of ExpertsHugging Face
NVIDIANemotronNemotron 3.5 Transcribe+1
models, multimodalยท Added 29 Oct 2026, published 28 Oct 2026
Akamai SIG argues that vendors and researchers broke embargo norms during the October 2026 PHP2Shell leak, when the PHP fix shipped a day early on 21 October. It explains the four TLP 2.0 labels, tabulates past embargo breaks (Heartbleed, a collapsed six-month kernel-era embargo, the Alibaba Cloud and MIIT case), and lists seven practices, such as no proofs of concept or CVE numbers before the fix.
VulnLens is a framework for binary C/C++ function-level vulnerability detection. A label-blind LLM Explainer describes each function from seven fixed perspectives (data flow, memory access, object lifetime, arithmetic and type behavior, control flow, shared state, external-resource access). A supervised Detector fuses code and explanations by cross-attention. It reaches 75.5% accuracy and 77.2% F1 on a 526-function PrimeVul test set, and 66.4% accuracy on SecVulEval without retraining.
LLMCC+++2
VulnLensPrimeVulSecVulEval
AI Security, AppSecยท Added 30 Oct 2026, published 27 Oct 2026
This paper tests the delta-learning hypothesis for Direct Preference Optimization (DPO), where the larger model's response in a single model pair is treated as preferred. It shows, in theory and experiments, that fixed pairs add generator-specific biases that predict the preference label regardless of quality. DPO on single-pair data underperforms multi-model data, consistent with reward hacking, and adding more generators partly fixes it without an external judge.
LLM
arXiv
training, researchยท Added 28 Oct 2026, published 27 Oct 2026
Clean-label poisoning attack on federated learning for Basic Safety Message anomaly detection in vehicular networks, from Sagduyu, Erpek, Stephenson and Xue (paper submitted 23 October 2026). The attack perturbs benign samples toward malicious feature extremes without changing labels, which lowers class separability, and it grows stronger with more compromised nodes. A feature-consistency relabeling defense keeps attack success low without hurting clean accuracy, and a game-theoretic model shifts equilibria against attacking.
MCP Market search results for "security" in its skills category, listing about 20 installable AI agent skills. Entries cover OWASP Top 10 audits, secure PHP coding, STRIDE threat modeling, CVE remediation, security header analysis, misconfiguration finding, bug bounty triage and AgentShield scans of Claude Code configurations. One is a paid D365FO security-role XML skill. Each entry has only a one-line description and a category label.
MCP Market search results for "security" in the skills category, listing about 20 installable AI agent skills. Entries cover OWASP Top 10 audits, secure coding for PHP, STRIDE threat modeling, CVE remediation, security header analysis, misconfiguration finding, bug bounty triage and AgentShield scans of Claude Code configurations. One is a paid D365FO security-role XML skill. Each entry has only a one-line description and a category label.
This paper presents a pipeline that uses persona-conditioned vision language models to surface interpretive ambiguity in visualizations. Topic-relevant personas elicit candidate takeaways, and a Target-Pattern-Scope framework lets LLM judges label statement pairs as Compatible, Disjoint or Opposing, which are summarized in an ambiguity profile. The authors benchmark VLMs on chart comprehension per chart type, check labeling against human annotations, and run case studies on public visualizations and a redesign.
vision-language modelLLM
arXiv
research, multimodal, evalsยท Added 27 Oct 2026, published 25 Oct 2026
TriageRAG is a failure-aware self-training method for adapting retrieval-augmented LLMs to specialized domains using only an unlabeled corpus. It probes the student on self-generated questions with and without retrieved context, sorts them into known, solved, context-failure and retrieval-failure, and routes each to a matching training signal. With Qwen3-4B on 11 datasets it beats budget-matched SimRAG by 1.2-6.4 points and recovers closed-book accuracy where retrieval hurts.
RAGLLMQwen3
TriageRAGSimRAGCS-Bench+1
research, llm-apps, trainingยท Added 27 Oct 2026, published 24 Oct 2026
Bitget breach tracking report: Arkham recorded $19.48 million moved in 52 transfers between 21 and 24 October 2026, and $78.01 million to new addresses from 15 to 23 October. About $242.54 million remains in labeled holdings. It recaps September laundering via Wasabi CoinJoin, THORChain and Chainflip, and Bitget's stated root cause, a flaw in a third-party security product.
BitcoinEthereumTHORChain+3
BitgetArkhamAMLBot+5
Blockchain, Threat Intelยท Published and added 24 Oct 2026
VulDec is a dataset and framework for detecting vulnerabilities in binaries by first decompiling them with fine-tuned LLMs. The dataset aligns real-world Assembly-C function pairs across several architectures with CWE labels. Tuned neural decompilers reach about 56% Edit Similarity and 43% BLEU-4, and tuned detectors reach a macro F1 of 0.61 on a realistic test set with a 3% vulnerability rate.
LLM
VulDecCWE
research, trainingยท Added 28 Oct 2026, published 24 Oct 2026
VulDec is an arXiv paper (October 2026) presenting a dataset of real-world Assembly-C function pairs with CWE labels across multiple architectures, plus an end-to-end framework that uses neural decompilation for binary vulnerability detection. Tuned LLM decompilers reach about 56% Edit Similarity and 43% BLEU-4. Tuned LLM detectors reach macro F1 of 0.61 on a realistic test set with a 3% vulnerability rate.
LLM
VulDec
Malware & RE, AI Securityยท Added 28 Oct 2026, published 24 Oct 2026
Extraction meets Distillation is an IACR ePrint paper (2026/2628, CSCML 2026) that combines cryptanalytic weight-direction extraction with label-based distillation to reconstruct fully connected neural networks. It adapts a ReLU extraction implementation to Leaky ReLU and proves conditional bounds for direction recovery and sign selection. On CIFAR-10 victims, reconstructed models reach 56.40% and 58.29% agreement. It separates label requests from privileged access and notes that prediction agreement does not identify parameters.
ReLULeaky ReLU
CSCML 2026CIFAR-10
AI Securityยท Added 26 Oct 2026, published 24 Oct 2026
Bitcoin Core merged a security policy update in October 2026 that adds an "easily discoverable" label for vulnerabilities findable with a simple LLM query. Such bugs get a fix backported to all maintained releases and a new version shipped fast with an advisory, instead of a long embargo. Antoine Poinsot of Chaincode Labs proposed the change after a spike in reports. The article also recaps the Bitcoin Red Team and AI-found Lightning and wallet bugs.
BitcoinLLM
Antoine PoinsotChaincode LabsBitcoin Red Team+1
AI Security, GRCยท Published and added 23 Oct 2026
OWLS (Open-world Language-conditioned Speed Fields) plans directly over a vision-language model's dense feature map. A text prompt describing traversable terrain scores every pixel of one camera image. The scores are projected onto the ground, adapted with two morphological operations, and used as the speed field of a minimum-time planner. It needs no training, terrain labels, map or extra sensors. It was tested on a physical rover, on simulated Mars and Moon rovers over 200 procedural terrains, and on real planetary imagery.
vision-language model
OWLSarXiv
research, multimodalยท Added 26 Oct 2026, published 23 Oct 2026
Preprint (IACR ePrint 2026/2611) proposing a federated learning defense that replaces gradient detection with zero-knowledge-proof sample-level audits of client datasets. A staking mechanism forces attackers to train on discovered poisoned samples with flipped labels, producing counter-gradients that remove the backdoor without knowing the trigger. ZKP commitments lock the training data, which blocks adaptive attacks and gradient tampering. On CIFAR-10 under Dir(0.1) non-IID, it holds attack success rate below 6% against distributed backdoor and edge-case attacks.
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js (CWE-787, CWE-252), rated CVSS v4.0 9.2 by the Google CNA and High by the Node.js project. Fixes are Node 22.23.4, 24.22.1 and 26.12.1, and 24.22.1 still labels Brotli 1.2.0 because the fix was cherry-picked. The post gives a SOC trail from input to worker, with remediation and verification steps. It notes no KEV match, CISA SSVC exploitation none, and only unverified public lab claims.
Node.jsBrotliCVSS+3
CVE-2026-111497CWE-787CWE-252+3
Blue Team & Detection, AppSecยท Added 26 Oct 2026, published 23 Oct 2026
Decode-time provenance binding is a defense for Model Context Protocol agent pipelines against cross-modal trust laundering, where instructions hidden in an email-signature image via LSB, DCT or metadata steganography get decoded by a tool. It combines HMAC-authenticated trust labels, a provenance ledger and context-taint tracking to block critical tool calls. On a real MCP testbed with 24 adaptive payloads, attack success fell from 100% undefended (62.5% for keyword and regex filters) to 0%.
Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.
PowerShellActive DirectoryWMI+2
TerminalFixClickFixMicrosoft+7
Blue Team & Detection, Offensive Securityยท Added 24 Oct 2026, published 22 Oct 2026
Forest Typology (ForTy) 2020 is a global 10-meter map from Google DeepMind, Google Research, WRI and IIASA. It sorts land into six FAO-based classes: primary, naturally regenerating, planted, plantation, tree crops and agroforestry, and other land. The model uses AlphaEarth Foundations embeddings and about 1.7 million labeled locations. It was 90% accurate on forest type across 9,000+ expert-checked sites. An early 2017 to 2025 time series is on Earth Engine.
Google Earth EngineAlphaEarth Foundations
Google DeepMindGoogle ResearchWorld Resources Institute+7
models, multimodalยท Published and added 22 Oct 2026
SecLog-Bench is a benchmark for LLM reasoning over cybersecurity logs, built on an extensible simulation platform covering 29 attack scenarios. It combines audit logs, application logs and network traffic, with attack-stage labels and step-by-step evidence chains. Eight LLMs were tested on post-detection attack-progress reasoning: the best reached 44.44% accuracy, 45.07% Macro-F1 and 54.87% Stage Reasoning F1.
LLM
SecLog-BenchStage Reasoning F1
AI Security, Blue Team & Detectionยท Added 23 Oct 2026, published 22 Oct 2026
SecLog-Bench is a benchmark for LLM reasoning over cybersecurity logs. A simulation platform with 29 attack scenarios generates audit logs, application logs and network traffic, with attack-stage labels and step-by-step evidence chains. Eight mainstream LLMs were tested on attack-progress reasoning: the best reached 44.44% accuracy, 45.07% Macro-F1 and 54.87% Stage Reasoning F1. Correct predictions often came with flawed reasoning.
LLM
SecLog-BencharXiv
evals, researchยท Added 23 Oct 2026, published 22 Oct 2026
A Spectral Theory of Local-to-Global Leakage is an IACR ePrint paper (2026/2571) by Rei Ueno on additive secret sharing over finite abelian groups. It gives an exact leakage decomposition into local leakage magnitude and spectral alignment across shares. Two channels with identical local mutual information can have exponentially different global leakage. Automorphism-weighted sharing can cancel leakage perfectly with finitely many shares, which ordinary additive sharing cannot do.
Rei UenoMรถbius inversion
Hardware & RFยท Added 21 Oct 2026, published 20 Oct 2026
Castryck, Dina, Kutas and Lorenzon study the Shimura class group action on superspecial principally polarized abelian varieties with a CM orientation, as a post-quantum commutative group action for key exchange. They give tools to represent CM orientations through higher-dimensional isogenies and to compute the action in the restricted effective group action model. These rely on a CM version of Kani's lemma and a trick that often halves the ambient dimension. The paper also gives a method for finding oriented superspecial abelian surfaces and analyses obstructions to transitivity.
Shimura class group actionKani's lemmaIbukiyama-Katsura-Oort correspondence+5
EpiLens is a lightweight, open-source retrieval-augmented generation package that applies a fixed retrieval template and output schema to every paper in a corpus and links outputs to source passages. On a corpus of 2,297 epidemiology papers, its classifier matches or exceeds supervised and zero-shot baselines on four tasks without task-specific training data, scored against 214 manual labels. It also compares model-based study shares across parameters and pathogens.
RAGLLM
EpiLensSARS-CoV-2mpox+1
llm-apps, researchยท Added 21 Oct 2026, published 19 Oct 2026
SHADE is an alpha-stable Lรฉvy diffusion forecaster that stops denoising at a nonzero depth, so the leftover stable kernel shrinks the predictive distribution instead of leaving it overconfident. It offers a scale-calibrated halt and a context-amortized halt that needs no noise labels. Median CRPS improves 21.7% on synthetic data with alpha at or below 1.3, with tail calibration gains on cryptocurrency and foreign-exchange series.
diffusion model
arXiv
researchยท Added 21 Oct 2026, published 19 Oct 2026
Blind-DLPA is a multi-task deep-learning framework for profiled blind side-channel analysis, where the attacker has labeled profiling traces but only leakage traces from the target, with no plaintexts or ciphertexts. It estimates Hamming-weight posteriors of an input and a key-dependent intermediate, then ranks key hypotheses against theoretical joint distributions. It recovers keys on unprotected AES and Kyber and on ASCAD (guessing entropy zero with 39 traces), and the authors report collisions in a prior Ascon Hamming-weight model.
Computing endomorphisms of superspecial principally polarized abelian surfaces is a cryptanalysis preprint by Marc Houben and Lam L. Pham, posted to IACR ePrint in October 2026. It gives an algorithm that, under a standard heuristic, finds a non-scalar polarized endomorphism in expected time and memory p^(4/5+o(1)). The abstract is the only text available, so the method and its effect on specific schemes are not described.
Determines, to first order in 1/p with an explicit error bound, the proportion of superspecial principally polarized abelian surfaces over F_p-bar (p โก 3 mod 4) that are optimally (N,N)-split. The expected number of optimal splittings is exactly 5NยทJ_2(N)(p-1)/(pยฒ+1), so the split proportion is about 5NยทJ_2(N)/p. This gives the stationary target density of the splitting-detection attack on the dimension-two superspecial isogeny problem, which was previously known only from experiments or a one-sided bound. The proofs use Siegel's mass formula and genus averages over refined Humbert invariants, and every formula was checked by exact computation at twelve primes.
splitting-detection attackRichelot random walkHumbert surfaces+3
Post by Bikash (@BkashJosi) ranking open GitHub issues labelled type/feature for the Hermes agent framework by thumbs-up reactions. The query returned 5,349 issues and only one has more than 50 votes. The top three are Claude Agent SDK with subscription OAuth (57), remote Hermes with local tool execution (41) and Mistral provider support (32), followed by backups, configuration sync and context reduction. The full top 10 is only in the video.
FedRAPP is a personalized aggregation framework for Source-Free Federated Test-Time Prompt Tuning (SF-FTTPT), where clients adapt CLIP soft prompts on unlabeled, non-IID test streams without source data. It combines reliability-aware client assessment, a server-side exponential moving-average prompt memory and similarity-guided peer aggregation. Across nine CLIP benchmark datasets and ImageNet variants it beats standard federated aggregation baselines while keeping prompt-only efficiency.
CLIPvision-language model
FedRAPPImageNetarXiv
research, multimodalยท Added 20 Oct 2026, published 16 Oct 2026
Ignored, Not Refused audits 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge finds most failed indirect prompt injections are ignored (76-80%) rather than refused (17-18%). Changing only the system prompt moves InjecAgent ASR from 0.2% to 43%. The Attack-Task Outcome Matrix (ATOM) shows 21.7% of AgentDojo episodes were safe but left the user task incomplete. The corpus, judge prompt and code are released.
LLM
indirect prompt injectionAgentDojoInjecAgent+2
AI Securityยท Added 20 Oct 2026, published 16 Oct 2026
"Ignored, Not Refused" audits 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge finds 76-80% of failed injection attacks were ignored and 17-18% refused. Changing only the system prompt moves InjecAgent attack success rate from 0.2% to 43%, and the ATOM matrix shows 21.7% of AgentDojo episodes were safe but left the user's task undone. The corpus, judge prompt and code are released.
LLM
InjecAgentAgentDojoATOM+1
evals, ai-safety, agentsยท Added 20 Oct 2026, published 16 Oct 2026
Explains the "pwn request" weakness in GitHub Actions. A workflow triggered by pull_request_target runs with write permissions and secrets, so if it checks out and builds PR head code, attacker-controlled code runs in a privileged context. It gives a three-step check for susceptible workflows: the trigger, a checkout of the PR head SHA or ref, and build steps such as npm install or make. It also covers mitigations: switch to pull_request or workflow_run, gate on a label, and never pass secrets to scripts that run on PR code. It notes safe patterns and cites the puppetlabs finding.
The paper separates "active" facts (which support generalization beyond recall) from "inert" ones. It builds new relations by relabeling answers of existing ones (Paris -> Europe becomes Paris -> crab), fine-tunes on a subset of subjects, and tests held-out subjects that share an answer (Munich -> crab). Across eleven language models and 70 relations, linear readability of the original relation in pretrained representations correlates with this generalization at Pearson r = 0.87 to 0.92 within each model. The result holds after controlling for fine-tuning set size, original-relation accuracy and subject frequency in pretraining text, and it survives re-randomized labels, seeds and thirteen other label categories. Mapping wrong labels back to the original answers shows the fine-tuned model's errors follow the linear probe's top answers.
LLM
arXiv
research, trainingยท Added 17 Oct 2026, published 15 Oct 2026
GraphACM merges equivalent states from multiple rollouts of the same LLM agent task into a directed, action-labeled graph, so actions can be compared at shared decision states. It defines node-level and global action-consistency measures, and uses the global score as an uncertainty proxy to predict task success or failure. Across three LLMs on ALFWorld, AppWorld and WebShop it reaches an average AUROC of 0.811, above the strongest behavioral-consistency baseline (0.729) and verbalized confidence (0.769). It also shows where in a trajectory agent actions diverge.
LLM
GraphACMALFWorldAppWorld+2
research, agents, evalsยท Added 17 Oct 2026, published 15 Oct 2026
Paper arguing that agent human-approval prompts count as a second factor only if agent compromise cannot forge them and they name exactly what is approved. It defines twelve attacks on the approval path (decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting, threshold splitting) and tests them against AP2, Microsoft's action-bound approval design and MCP elicitation. An audit of ten agent runtimes found no third-party verifiable approval record and post-approval argument changes in four of eight. The reference defense ASU (Agent Step-Up) renders the card from a canonical effect descriptor, has a phone passkey sign its digest, and executes only the stored call. It is proven in Tamarin (53 lemmas) and evaluated on 27,108 scripted trials and 609 AgentDojo pairs. The trusted card cut forged-narration attack success from 0.54 to 0.03 and raised LLM-approver catch rate from 0.30 to 0.98.
Model Context ProtocolMicrosoft
Agent Payments ProtocolAgent Step-UpASU+6
AI Security, Identity & Accessยท Added 17 Oct 2026, published 15 Oct 2026
GitHub describes replacing an LLM-based generic secret detection pipeline with a two-stage system. High-recall regex generates candidates, then a fine-tuned ModernBERT classifier scores each one using its file path, secret type, variable names and surrounding context. Training data mixes product feedback, weak-labelled regex candidates and synthetic hard negatives, with splits grouped by repository, value or example. The model is exported to ONNX with 8-bit quantization. Reported results against the LLM pipeline: 13% higher precision, 19% higher recall, 11.5% higher owner-weighted acceptance in an A/B test, 86% lower median post-push scan time and over 98% lower serving cost. It is a concrete case for using a small fine-tuned encoder instead of an LLM on a narrow, measurable classification task.
ModernBERTONNXGitHub
Microsoft
training, inferenceยท Published and added 13 Oct 2026
GitHub describes its secret scanning pipeline for generic secrets. Regex finds candidates with high recall, then a fine-tuned ModernBERT classifier reads the candidate with its file path, secret type and surrounding code to filter hard negatives such as placeholders, fixtures and checksums. The post covers the training data (product feedback, weak labels, synthetic hard negatives), grouped train/eval splits, and ONNX 8-bit quantization. Reported results against the earlier LLM pipeline: 13% higher precision, 19% higher recall, 11.5% higher owner-weighted acceptance, 86% lower median scan time and over 98% lower serving cost. The speed gain made generic secret detection feasible in push protection.
GitHubModernBERTONNX+1
push protectionhard negatives
DevSecOps, AI Securityยท Published and added 13 Oct 2026
Introduces Sauron, an evidence-first agentic verifier that checks rubric criteria for long-horizon agent tasks by investigating both environment state and execution trace, and trusts a claim (including an agent's self-reported success) only after validating it against its source. Bounded queries and joint investigation of related criteria cut context use, and each verdict carries an auditable evidence receipt. On 2,586 human-labeled criteria from 100 personal-assistant episodes it has the best F1 of five verifiers across eight backbones (0.96 vs 0.92 for Gandalf with GPT-5.6 Sol, at 23% lower cost). It detects 97% of injected failures across 13 fault families, including reward-hacking simulations, with 2% false flags on clean controls, and leads on the TRAIL agent-error benchmark. It matters because unreliable rubric verdicts used as RL rewards can reinforce bad behavior.
SauronGandalfTRAIL+2
evals, agents, researchยท Added 14 Oct 2026, published 13 Oct 2026
Hide and Seek (HnS) is a concept-level attribution method for black-box vision models. It needs no model weights and no concept-labeled datasets. Given a concept and an image set, it uses a vision-language model to retrieve concept-aligned images and localize the concept, masks the localized region, and takes attribution from the change in the black-box model's output. It agreed better with ground-truth attributions than existing methods on CelebA and COCO-Stuff, and it works on tasks existing concept attribution methods cannot handle, such as image captioning and satellite image segmentation.
vision-language model
Hide and SeekHnSCelebA+1
research, multimodalยท Added 12 Oct 2026, published 9 Oct 2026
BLiMPPI is a multilingual evaluation suite of over 12,000 negative polarity item (NPI) minimal pairs across 33 languages. A pipeline finds NPIs in Universal Dependencies treebanks, labels their licensing environments, and perturbs them into grammatical/ungrammatical pairs. Across 12 multilingual and 2 monolingual models plus n-gram baselines, multilingual models do worst on lower-resource languages and on pairs that n-grams cannot solve. The paper also analyses NPI typology, language family, licensing variability and NPI-licenser distance.
Universal Dependenciesn-gram
BLiMPPI
evals, researchยท Added 12 Oct 2026, published 9 Oct 2026
A study by Erfan Baghaei Potraghloo, posted to arXiv on October 8, 2026, evaluates seven open-weight LLMs used as "typed decision model" guardrails in agent systems (assigning probabilities to caller-defined allow/block options rather than generating text). It finds that six lines of unrelated server-log text raised one model's fail-open rate from 0% to 63%, and that merely renaming the permissive option's label (without changing its definition or the assessed text) drove fail-open rates to 93-100% in four models; a deterministic rule on typed values instead hit 100% accuracy, leading the author to recommend using these models only to triage reviewer workload rather than as sole decision-makers.
bigarrow is an MIT-licensed, single-binary Swift macOS CLI that draws a click-through arrow and sign over all windows so an AI agent can show a human where to click, paste or act (permission prompts, 2FA, OAuth consent). It ships an Agent Skills package (installed via `bigarrow install-skill`) for Claude Code and Codex, with JSON output and exit codes, and can target by Accessibility label, coordinates, window or Peekaboo snapshot. The README documents the skill's token cost (182 tokens for the description, 1,398 for the instructions) and 104 automated tests.
SwiftmacOSClaude Code+6
bigarrowNameplatePeter Steinberger+2
coding-agents, prompting, agentsยท Published and added 9 Oct 2026
SWE-Critix is a post-training pipeline that trains generalist verifiers for coding-agent trajectories. Given a task and its (often hundreds-of-steps) trajectory, the verifier predicts a completion label and writes a natural-language analysis explaining the judgment. Starting from Qwen3-30B-A3B reasoning, classification accuracy on a held-out test set rises from 57% to 66% after SFT and 78% after RL, using trajectories from CodeForge-Preview. Models, datasets and training code are released.
Qwen3Mixture of Experts
SWE-CritixCodeForge-PreviewQwen3-30B-A3B+1
research, coding-agents, training, evalsยท Added 12 Oct 2026, published 9 Oct 2026
First systematic empirical study of Cross-chain Verification Vulnerabilities (CVVs) in bridge smart contracts, such as flawed validation of state proofs, message sender identities and signatures. From 588 audit reports across 36 bridge projects it derives 11 CVV patterns in 5 categories and builds a dataset of 830 instances across 786 contract files, mapped to reports, source versions and pattern labels. Existing tools cover few CVV patterns, and only two of four tested LLMs beat a 29.3% Macro-F1 constant baseline (best 51.2%), which motivates detectors built for cross-chain verification semantics.
LLM
Cross-chain Verification VulnerabilitiesCVV
Blockchainยท Added 12 Oct 2026, published 9 Oct 2026
The paper presents RM-KLPT, an algorithm that solves the algebraic pathfinding problem in isogeny graphs of superspecial abelian surfaces with maximal real multiplication. It does this by solving a norm equation in ideals of a quaternion algebra over a real quadratic field. The authors implement it and revisit the RM-CGL hash function of Charles, Goren and Lauter. They show that if the initial surface's algebraic description is known, RM-KLPT gives a second-preimage attack on the hash. Paths are much shorter (~p^3) than with KLPT^2, because a higher-dimensional Deuring correspondence exists in the RM setting. The paper also discusses cryptographic constructions that could be built on RM-KLPT.
securityweek.comarticle๐ก๏ธ Security
