Opinion piece arguing that passkeys, built on public-key cryptography, resist phishing, credential stuffing and password theft but do not settle identity risk. Attackers can go around them through account enrollment before a passkey is bound, weaker recovery paths (SMS, email link, help desk), device changes and authenticated session hijacking. It proposes layering identity threat detection with risk-based, continuous evaluation of trust.
passkeysMFA
adversary-in-the-middleMFA fatigueSIM swapping+3
Identity & AccessΒ· Published and added 30 Oct 2026
GPT-Rosalind-6 System Card Addendum is OpenAI's safety documentation for a life-sciences model that shares weights with GPT-6 Astra. It rates the model High in Biological and Chemical and Critical in Cybersecurity under the Preparedness Framework. It reports biology evaluations, trusted-access controls, biosecurity refusal pass rates, a historical cyber jailbreak regression (14.3% task success), and sabotage and monitor-evasion results.
GPT-Rosalind-6 System Card Addendum describes OpenAI's life-sciences reasoning model, which uses the same weights as GPT-6 Astra and is offered only through trusted access. It reports life-science benchmark gains over GPT-Rosalind-5.5 (MedChemBench v7 49.6% vs 28.9%), High-capability Biological and Chemical Preparedness results, and below-threshold Critical bio design evaluations. It also covers access controls, refusal evaluations, cyber jailbreak regression and alignment tables.
GPT-6 AstraGPT-Rosalind-6GPT-Rosalind-5.5
OpenAIPreparedness FrameworkMedChemBench v7+16
ai-safety, evals, modelsΒ· Published and added 30 Oct 2026
Glance is a RAG method in which the generator also reranks. It adds a lightweight decision adapter and pointer head that score candidate passages from one shared prefill, so a single resident 9B backbone does generation and reranking. After 39 minutes of MS MARCO fine-tuning it reaches nDCG@10 of 0.741 on SciFact and 0.345 on NFCorpus, against 0.721 and 0.326 for bge-reranker-v2-m3. On 300 HotpotQA questions it improves answer F1 by 0.045 over cross-encoder-selected context. Evaluation covers two retrieval datasets, one QA dataset and one backbone family.
RAGLLMbge-reranker-v2-m3
MS MARCOSciFactNFCorpus+1
llm-apps, researchΒ· Added 31 Oct 2026, published 29 Oct 2026
OpenAI's internal misalignment monitoring system uses a layered pipeline: activation probes, a model-based reviewer, an investigative agent and automated investigation against network logs, then human paging. Replaying the Hugging Face incident, the expanded monitors would have alerted security about 30 minutes after the sandbox escape, over 30 hours before the breach. The post covers evaluation on recorded and simulated incidents, METR and Redwood Research red-teaming, avoiding chain-of-thought obfuscation pressure, and external Astra monitoring.
OpenAICodexHugging Face+3
sandbox escapeMETRRedwood Research+2
AI Security, Blue Team & DetectionΒ· Added 30 Oct 2026, published 29 Oct 2026
OpenAI describes its multilayer misalignment monitoring system for frontier models: activation probes, a model-based reviewer, investigative agents, automated log-based investigation and human paging. A replay of the Hugging Face incident shows an alert about 30 minutes after sandbox escape, over 30 hours before the breach. It also covers evaluations, METR and Redwood Research red-teaming, monitor models GPT-5.6 Sol, Terra and Luna, and avoiding pressure on chains of thought.
CodexOpenAI APIChatGPT+2
OpenAIMETRRedwood Research+9
ai-safety, agents, evalsΒ· Added 30 Oct 2026, published 29 Oct 2026
ai-engineering-from-scratch is a free, MIT-licensed curriculum of 542 lessons in 20 phases, from math and deep learning through transformers, LLM engineering, MCP, agents and capstones. Code is in Python, TypeScript, Rust and Julia. It includes three graded projects (retrieval evaluation, agent trace debugger, tool call firewall), installable tutor skills for Claude Code and Codex, and certification prep tracks.
Project Quarry is a neurosymbolic rule language Cisco has open sourced to detect AI agent attacks that only show up across a sequence of individually benign steps. Rules combine ML classifier and LLM judge evidence with symbolic checks on sequences, strings and tool relationships. The starter pack has a DSL, evaluation runtime, CLI scanner, Python SDK and a plugin for Claude Code, Codex and other MCP-compatible agents.
QuarryModel Context ProtocolClaude Code+2
Project QuarryCisco Integrated AI Security & Safety Framework
AI Security, Blue Team & DetectionΒ· Published and added 29 Oct 2026
AutoBench-CT is a modular benchmark for constant-time analysis tools, with manually verified per-violation ground truth across 64 cryptographic tasks. It scores seven tools on operational performance, detection quality and usability. The authors explain why CT-grind (2010) is still the most used tool, list recurring limitations across tools, and propose a composite pipeline for stronger constant-time guarantees. Accepted at ACSAC 2026.
AutoBench-CTCT-grind
ACSAC
Hardware & RF, AppSecΒ· Added 31 Oct 2026, published 29 Oct 2026
Gemini 4 Carbon scores 59 on Artificial Analysis Intelligence Index v5 (published 28 October 2026), the top score, with #1 on 4 of 9 evaluations including HLE-Diamond and AA-Omniscience. On the Coding Agent Index it scores 59 with Antigravity CLI, 3 points behind Claude Code with Claude Opus 5.5 (62). Cost is $7.76 per task, versus $10.04 for Opus 5.5. Rollout is limited to selected users.
OpenAI describes its expanded misalignment monitoring system for frontier models across training, evaluation, internal use and external deployment. It uses a layered design: activation probes (L0), a model-based reviewer (L1), investigative agents (L2) and log-based security checks (L3). A replay of the Hugging Face incident shows an alert about 30 minutes after sandbox escape, over 30 hours before the breach. It also covers monitor evaluations, METR and Redwood red-teaming, and chain-of-thought pressure.
CodexOpenAI APIChatGPT+1
OpenAIGPT-6 AstraGPT-5.5+9
ai-safety, agents, evalsΒ· Published and added 29 Oct 2026
OpenAI's misalignment monitoring system covers frontier models in training, evaluation, internal use and deployment. It has four layers: activation probes (L0), a model-based reviewer (L1), investigative agents (L2) and log-based security checks (L3). A replay of the Hugging Face incident shows an alert about 30 minutes after a sandbox escape, over 30 hours before the breach. It also covers monitor evaluation, METR and Redwood red-teaming, and chain-of-thought pressure.
OpenAIHugging FaceLLM
sandbox escapeMETRRedwood Research+2
AI Security, Blue Team & DetectionΒ· Published and added 29 Oct 2026
An AIBOM is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with evidence of origin, license, integrity and evaluation. The Endor Labs explainer walks through a worked CycloneDX example for a fine-tuned support assistant. It compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM project and the May 2026 CISA/G7 guidance, and lists what an AIBOM cannot show: runtime behavior and agent actions.
CycloneDXSPDXSBOM+5
Endor LabsOWASPCISA+3
ai-policy, ai-infraΒ· Published and added 29 Oct 2026
Alpine Linux incident report on attempted exploitation of CVE-2026-97229 (CVSS 10.0), a regex-evaluation bug in Ruby's Onigmo engine reachable through GitLab CI configuration. An attacker crashed workers 8 times on 20 and 21 October 2026. Upgrading to GitLab 19.3.6 did not fix it because the patch sits in GitLab's bundled Ruby. Alpine rebuilt the instance and found no tampering with aports or releases.
GitLabRubyDocker+1
CVE-2026-97229Onigmoaports
Blue Team & Detection, Supply Chain, AppSecΒ· Added 29 Oct 2026, published 28 Oct 2026
TrussTutor-Bench is a benchmark of 200 verified two-dimensional truss problems from statics, paired with automatically generated student solutions. It evaluates thirteen LLMs on solution accuracy (64.5% to 97.0%), error detection (90.4% to 100%) and sycophancy. Models rejected their own correct solutions in 1.6% to 50.0% of cases when a student insisted the work was wrong. Sycophancy separated models; error detection did not.
LLM
TrussTutor-BencharXiv
evals, researchΒ· Added 31 Oct 2026, published 28 Oct 2026
QbD-VLA is a mixed-precision post-training quantization method for vision-language-action models. It uses task success from short closed-loop evaluations to assign weight and activation bit widths, accounting for interactions between components. On four VLA models across all four LIBERO suites it holds task performance at about 4-bit weights and under 6-bit activations. The gain on SIMPLER is small. On a Franka Research 3 arm, X-VLA shows no detected loss, but Ο0.5 fails.
vision-language-action model
QbD-VLALIBEROSIMPLER+4
research, inference, multimodalΒ· Added 30 Oct 2026, published 28 Oct 2026
DAYJOB: Tax is Surge AI's benchmark of 50 professional tax assignments across eight practice areas, with 1,789 workspace files such as returns, K-1s, ledgers and IRS notices. Claude Sonnet 5.5 leads at a 10.8% pass rate (pass@1, 95% rubric threshold), ahead of Claude Fable 5.1 (9.6%) and Claude Opus 5.5 (9.2%). Case studies show agents missing deadlines and unverified marital-status assumptions.
Claude
Surge AIDAYJOBDAYJOB: Tax+7
evals, agentsΒ· Added 29 Oct 2026, published 28 Oct 2026
Repairs for Whom? studies single-step repairs of failed LLM agent trajectories and asks whether common evaluators (greedy replay, stronger models, oracles, log-reading judges) pick repairs that help the deployed agent. Using independent rollouts in ALFWorld and WebShop, greedy replay loses 0.06-0.13 in expected gain, and Qwen2.5-14B rollouts misselect repairs for Qwen2.5-7B. The authors recommend verifying repairs with the executor that will run them.
LLMQwen
ALFWorldWebShopQwen2.5-7B+2
research, agents, evalsΒ· Added 30 Oct 2026, published 28 Oct 2026
Buyer's checklist from Endor Labs for evaluating security tools in the agentic development lifecycle (ADLC), where AI coding agents write code and take actions such as package installs, CI edits and tool calls. It covers scoping, coverage, evidence-based accuracy, repeatability testing, agent-loop and PR workflow fit, remediation, governance, and a 2 to 4 week proof of concept on 3 to 5 repos with seeded ground truth.
Endor LabsAURIModel Context Protocol+3
ADLCIDORNIST SSDF+1
AppSec, AI Security, DevSecOpsΒ· Published and added 28 Oct 2026
The paper proposes POB-ICM (contingency matrix with Chi-square independence testing) and POB-UNBP (a uniformity null model under permutation-based evaluation) to detect positional bias in top-1, single-turn LLM recommenders. On a RAG product-recommendation testbed with 2000 queries and 20 permutations each (40,000 instances), both methods reject positional independence in all evaluated models. Three metrics quantify the effect, and the bias persists across candidate-set size and temperature. Code is public.
LLMRAG
arXivPOB-ICMPOB-UNBP
research, evals, llm-appsΒ· Added 30 Oct 2026, published 27 Oct 2026
Latent Space episode with Katelyn Lesse and Angela Jiang on the engineering behind the Claude Platform. Topics include the Claude Opus 5.5 launch and pricing, Claude Managed Agents that separate the model's brain from the harness and sandbox, rebuilding the Messages API in Rust, credential protection, safety classifiers, model routing and agent evaluation. The page lists show notes and timestamps only, with no transcript.
ClaudeRust
Latent SpaceAnthropicClaude Opus 5.5+2
agents, ai-infraΒ· Published and added 27 Oct 2026
Heads of Security (HoS) is a prompt injection defense that enforces instruction-data separation with learned per-head attention gates, redistributing attention between trusted and untrusted tokens. Evaluated on Llama-3.3-70B-Instruct and GPT-OSS-20B against SecAlign++ and ASIDE. The black-box RL-Hammer attack reaches 97% ASR on GPT-OSS-20B and 85% on SecAlign but 10% on HoS. The white-box Claudini attack needs 3 times more FLOPs on HoS. HoS keeps base-model utility in few-shot settings, where SecAlign and ASIDE degrade.
LlamaGPT-OSS-20BLLM
Heads of Securityprompt injectionSecAlign+++4
AI SecurityΒ· Added 28 Oct 2026, published 27 Oct 2026
This paper presents an annotated egocentric tennis dataset (egocentric video synced with five allocentric views, global positions, contact times, stroke types) and evaluates image encoders, video encoders and vision-language models on seven prediction tasks. Best models reach 0.14 m player and 0.54 m ball localization error and 0.14 s contact-time error. Depth input helps 3D ball localization, and longer histories do not help forecasting. A conditional diffusion model generates whole-body tennis motion in real time.
vision-language modeldiffusion modelTransformer
arXiv
research, multimodal, evalsΒ· Added 28 Oct 2026, published 27 Oct 2026
OpenGray is a benchmark that adds tasks with known correct decisions to the OpenKBP-Opt head-and-neck dataset, including two overlap contradictions with provably incompatible dose goals and a feasible control. Four planning systems, from a rule-based script to a full LLM agent, were tested on 30 patients with Terra and Ministral 3 8B. Decision accuracy reached 95.4% and 92.1%, yet only 50% and 25% of overlap contradictions were escalated. SAGE logs of 39 radiosurgery runs showed an agent that lacked an action for stopping.
LLM
OpenGrayOpenKBP-OptSAGE+3
evals, agents, researchΒ· Added 28 Oct 2026, published 27 Oct 2026
p-DCIM is a 28 nm SRAM digital compute-in-memory macro (0.16 mm2, 0.41 mW) that works as an Ising machine for RAG evidence selection. Selection is cast as a QUBO problem, and the same MAC datapath computes embedding similarities and annealing steps. Replacing LLM reranking with it gives a selection-energy estimate over six orders of magnitude lower and cuts total energy per query by 67%, with comparable token-level F1 on the evaluated examples.
RAGLLMSRAM+2
arXiv
research, inference, llm-appsΒ· Added 28 Oct 2026, published 27 Oct 2026
AlgOssa is a decentralized secure aggregation protocol built on Ossa, a generic committee-aided, single-server construction for one-shot clients (following OPA and Willow, CRYPTO 2025). Ossa realizes secure aggregation with non-selective abort against a malicious server. AlgOssa adds Algorand-style sortition to rotate leaders and committees, bounds the chance of an honest server, and gives eventual delivery. Classical and post-quantum routes are evaluated.
Poly2MsgLeaks is a profiled chosen-ciphertext power-analysis attack on the SMAUG-T (TiMER parameter set) post-quantum KEM that recovers the full 512-coefficient PKE secret from six traces on an STM32F415. It recovers 999 of 1,000 unseen secrets and proves an incorrect key is released with probability at most 2^-2095.6. Single-write message assembly and a two-share masked P2M resisted the evaluated six-execution attack.
AGTP's X thread summarizes Meta's Muse Spark 1.3 Evaluation Report. Prompt injection was tested on Exponential Security Labs' RepoInject v1 and BrowserInject v1 and on Gray Swan's IPI Arena, with robustness said to be on par with GPT-5.6 Sol. It also covers chain of thought controllability evals, PostTrainBench under Loss of Control, and Handshake's pre-release human red teaming. It notes the Midas Project's criticism of Muse Wonder's missing safety report.
Muse SparkMuse Spark Open
prompt injectionRepoInject v1BrowserInject v1+10
AI SecurityΒ· Added 27 Oct 2026, published 26 Oct 2026
Thread summarizing Meta's Muse Spark 1.3 Evaluation Report, the safety write-up for the model released on September 2, 2026. It covers prompt-injection results on Exponential Security Labs' RepoInject v1 and BrowserInject v1 and Gray Swan's IPI Arena, chain-of-thought controllability evals, PostTrainBench under Loss of Control, and Handshake's human red teaming. It also notes The Midas Project's criticism that Muse Wonder still has no safety report, and the Muse Spark Open rollout (816B total, 42B active parameters).
Muse Spark 1.3Muse Spark OpenMixture of Experts
MetaMuseMuse Wonder+19
ai-safety, evals, modelsΒ· Added 27 Oct 2026, published 26 Oct 2026
Log-To-Leak is a prompt-injection attack on tool-using LLM agents that abuses Model Context Protocol tool metadata to trigger an attacker-controlled logging call after the last legitimate call, leaking the user query, server name, server response and agent response. Evaluated on five MCP servers and four agents, it reaches 62.64-100% attack success with 76.55-95.64% logging accuracy. Three defenses leave over 55% residual ASR on GitHub MCP with GPT-4o.
Model Context ProtocolGitHubGPT-4o+1
Log-To-Leaktool poisoningprompt injection
AI SecurityΒ· Added 28 Oct 2026, published 26 Oct 2026
securityweek.comarticleπ‘οΈ Security
