497 results for “Flow”

Sean Goedecke's post argues that a paper showing GPT-6 Astra reading and editing neural network weights is not superhuman. Identifying a toy network's game needs only per-cell L2 norms of labeled first-layer inputs, and fixing a 0.8B Qwen model's 32k-token looping matches a human steering/abliteration workflow. He compares weight editing to tweaking compiled binaries.

seangoedecke.comarticleAdded 3 Nov 2026, published 2 Nov 2026🧠 AI

CVE-2026-97229 is a maximum-severity integer overflow in GitLab's CI/CD Regular Expression Compiler that lets an unauthenticated attacker run code via a crafted regex in pipeline configuration. GitLab patched it on 12 October 2026 in versions 19.4.2, 19.3.5 and 19.2.8. CISA added it to KEV, and Shadowserver tracks over 1,000 unpatched servers, plus 11,300 exposed to the related CVE-2026-110264.

bleepingcomputer.comarticlePublished and added 2 Nov 2026🛡️ Security

Trail of Bits describes a Codex (GPT-5.6) workflow that backports security fixes to stable Linux kernel trees, Ubuntu LTS and Fedora. By 29 October 2026 it had helped land fixes for 149 CVEs in stable kernels. Agents find missing fixes, adapt patches and assemble validation evidence; a human review takes about 30 minutes to 3 hours. It also sizes the unfixed-CVE backlog in kernel branches, Debian 13 and Ubuntu 26.04.

blog.trailofbits.comarticlePublished and added 2 Nov 2026🛡️ Security

Trail of Bits describes a Codex agent workflow that backports security fixes to stable Linux kernel trees and distro packages. By 29 October 2026 it had helped land fixes for 149 CVEs in stable kernel trees, plus several Fedora and Ubuntu package fixes. Human preparation and review takes about 30 minutes for a simple backport and about three hours for a harder one. The post also counts CVEs still unfixed in stable kernel branches, Debian 13 and Ubuntu 26.04.

blog.trailofbits.comarticlePublished and added 2 Nov 2026🧠 AI

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit CVE-2026-97229, a maximum-severity integer overflow in the Onigmo regex engine bundled with Ruby, on October 20-21. Eight worker crashes occurred and four were partially successful. Missing logs and outbound connection records meant compromise could not be ruled out. Alpine had run GitLab 19.3.4, then 19.3.6, which lacked the Ruby patch; the fixed image is alpinelinux/gitlab:19.3.6 with Ruby 3.3.13.

bleepingcomputer.comarticlePublished and added 1 Nov 2026🛡️ Security

CyberForge Weekly CVE Rundown #008 covers seven CVEs from 26 to 31 October 2026: Wasmtime/Cranelift miscompilation, Rust zip cloaking, Qode Membership account takeover, Dell PowerProtect Data Domain stack overflow, two Progress WS_FTP Server flaws and Kubeflow Pipelines log reads. Each entry gives fixed versions and defender actions. A 1 November check adds EPSS values dated 31 October and notes none of the IDs were in CISA's 30 October catalogue.

x.comthreadAdded 3 Nov 2026, published 1 Nov 2026🛡️ Security

Secure Courier is a consent flow in Tollbooth DPYC, a monetization network for paid MCP services, that lets an AI agent act for a Nostr npub without holding the user's nsec. The service sends a signed, sealed direct message over Nostr relays, the user replies with a signed approval and an expiry, and the service issues its own encrypted grant. Lonnie VanZandt presents it as an alternative to central identity providers and CIBA. The thread gives no audit results.

x.comthreadAdded 1 Nov 2026🧠 AI

CyberForge "CVE of the Day" #092 covers CVE-2026-118759 in Kubeflow Pipelines. The post says a run-log request must carry permission, not just a run ID: knowing the identifier does not authorize reading that workload's output. It points to Kubeflow's advisory, but the fetched text is cut off before any affected versions, fix or exploit details.

x.comthreadAdded 3 Nov 2026, published 31 Oct 2026🛡️ Security

Hyperflow H3 is Video Rebirth's 8-step LoRA for MiniMax H3, released in September 2026 with open weights. Artificial Analysis ranks it #5 on AA-Video-I2V v2.1 and #3 on AA-Video-Editing v1.1, ahead of MiniMax H3 (768p). It costs $9.00 per minute for Image to Video and $18.00 for Video Editing at 1088p, under half of Dreamina Seedance 2.5 ($34.12 and $40.82). The thread gives per-capability and per-use-case breakdowns.

x.comthreadAdded 31 Oct 2026, published 30 Oct 2026🧠 AI

SecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can announce an oversized screen surface (for example 32768 by 32768 at 32 bpp), forcing a software decode path and an out-of-bounds write that crashes the viewer or runs code. Remedio's research shows a pointer overwrite routed to WinExec. Version 15.83 fixes it, along with CVE-2026-92372, CVE-2026-92374 and six local privilege escalation bugs.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Rikugan is an open-source reverse-engineering agent that runs inside IDA Pro 9.0+ and Binary Ninja, with its own agent loop instead of an MCP server. It has 60+ tools (decompiler, xrefs, strings, types, IL/microcode), parallel subagent exploration, an experimental /modify natural-language patching command and an experimental Binary Ninja deobfuscation skill for control flow flattening and opaque predicates. It supports Claude, Gemini, MiniMax, Kimi, OpenAI-compatible endpoints and Ollama.

github.comrepoAdded 30 Oct 2026🛡️ Security

Oversecured describes extending its Android scanner to system APIs and to Samsung's Android build, after comparing Google and Samsung framework JARs and about 400 system services. It explains AIDL service permission checks and new control-flow analyses. Examples include Samsung's unchecked semIsBackupEnabled(), a broadcast that reboots the device, and a LaunchAnyWhere in Settings. Samsung had fixed over 60 reported issues.

oversecured.comwriteupAdded 29 Oct 2026🛡️ Security

Oversecured explains taint analysis for Android and iOS apps and contrasts it with pattern-matching SAST such as MobSF. It covers source, flow and sink, cross-component tracking over Intents, flag-based sanitizer modeling and implicit intent simulation. The case study is an unsafe Class.forName().newInstance() on a Serializable transportFactoryClassName field in Google's com.google.auth.oauth2 credential classes, which Google fixed with a $3,133.70 bounty.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

CISA alert of 29 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on evidence of active exploitation: CVE-2026-97229, an integer overflow in GitLab CE/EE, and CVE-2026-76418, a NULL pointer dereference from an unchecked return value in Cisco Secure Firewall ASA and FTD. It restates BOD 26-04 remediation duties for federal civilian agencies and links the KEV nomination form.

cisa.govadvisoryPublished and added 29 Oct 2026🛡️ Security

MAServeBench is a benchmark that treats multi-agent collaboration as a configurable dimension of LLM serving workloads. Its composable stages model how agents coordinate and exchange context in documented multi-agent workflows, and Hierarchical Semantic Traces record operations and dependencies for reproducible comparisons. Task-linked measurements tie workloads to GPU/NPU behavior, showing serving efficiency does not always mean timely task completion. Code is released.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

SGLang announces Day-0 support for Mistral Large 4 ("Le Chonk"), saying it is the first engine to serve the model on NVIDIA Vera Rubin. The post describes the model as Mistral's largest to date: a natively multimodal 1T-parameter mixture-of-experts model covering instruct, reasoning, coding and agentic workflows. The fetched text is truncated, so benchmark claims and launch commands are not visible.

x.comthreadAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

CVE-2026-103780 is a stack-based buffer overflow (CWE-121) in Dell PowerProtect Data Domain / DD OS. An unauthenticated remote attacker could get command execution (CVSS 3.1 9.8, Dell DSA-2026-416). The post lists affected and fixed builds for four release trains (Feature Release, LTS2024, LTS2025, LTS2026). It adds KEV, EPSS and SSVC status, plus six defensive checks. The vulnerable service is not public.

x.comadvisoryAdded 31 Oct 2026, published 29 Oct 2026🛡️ Security

ADLC metrics is an Endor Labs guide to measuring security in the agentic development lifecycle, where AI coding agents write much of the code. It defines formulas across five categories: AI supply chain visibility, agent action security, agent-generated code, package risk and developer flow. It argues for normalizing findings per merged change, tracking pre-execution blocks, and building a six-to-eight metric scorecard.

endorlabs.comarticlePublished and added 29 Oct 2026🛡️ Security

ADLC metrics is an Endor Labs guide to measuring security in the agentic development lifecycle, where AI coding agents write code. It defines formulas in five categories: AI supply chain visibility, agent action security, agent-generated code security, package risk and developer flow. It advises normalizing findings per merged change, comparing against a human baseline, and baselining six to eight metrics for a month.

endorlabs.comarticlePublished and added 29 Oct 2026🧠 AI

Virtualine, a bulletproof hosting service also operating as Secury, Massgod, Spamhouse, Lanedo and Omegatech, had its main domain seized by the FBI with German, Dutch and UK partners. Chainalysis and TRM Labs traced its Bitcoin payments to ransomware (5% of flows), a Russian drug market (about 44%), sextortion and the StealC infostealer. Dutch police seized dozens of servers in Limburg and recovered data on over 3,000 customers.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 28 Oct 2026🛡️ Security

ICSA-26-302-01 republishes Siemens SSA-137528 on the Mendix SAML module, which has an authentication bypass (CVE-2026-89209). An unauthenticated remote attacker can replay a valid SAML assertion in IdP-initiated flows to gain unauthorized access. Fixed in 4.2.4 for Mendix 10 and 11, and 3.6.29 for Mendix 9. Initial release was 26 October 2026.

cisa.govadvisoryAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

Chainalysis analysis of the 28 October 2026 OFAC designation of 10 individuals and one entity (FFTDC) supporting DPRK IT worker schemes. It traces on-chain flows from a DPRK developer wallet through sanctioned consolidation addresses to Russian converters Obertas and Boykov, then to Garantex. It also covers Alis, Amnokgang and Chinyong links and DPRK use of generative AI and deepfakes in hiring.

chainalysis.comarticlePublished and added 28 Oct 2026🛡️ Security

A post by TENSAEng describing a workflow for staying within coding-tool usage limits. ChatGPT chat sits outside those limits, while Claude and Grok chats share a pool with Claude Code, Codex and Grok Build. Architecture, file layout, step order and acceptance checks are planned in ChatGPT and saved as repo docs. Claude Code or Codex then implements one small chunk per fresh session.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🧠 AI

Four vulnerabilities in EPICS Base 7.0.10 and earlier, the control-system toolkit used at ITER and the Advanced Photon Source, were disclosed by CISA. CVE-2026-114595 (CVSS 9.8) is an integer overflow that could allow remote code execution, though only an out-of-bounds heap write and crash were demonstrated. All flaws sit in Channel Access and pvAccess handling (TCP 5064 and 5075), need no authentication, and are fixed in 7.0.11.

securityweek.comarticlePublished and added 28 Oct 2026🛡️ Security

A practical reverse-engineering map by hakimieiqbal on X that picks tools by target: native binaries, .NET, Electron, iOS, firmware, WebAssembly and network protocols. It introduces REA (morluto/rea), which connects coding agents to RE tools, and lists MCP bridges for IDA Pro, Ghidra and radare2. It adds an evidence-first workflow and free courses such as pwn.college and OpenSecurityTraining2.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

A thread by Hakimi Eiqbal that maps reverse-engineering tools by target type: native binaries, Electron, .NET, iOS, firmware, WebAssembly and network protocols. Its AI sections cover REA (an open-source layer connecting coding agents to analysis tools) and MCP bridges for IDA Pro, Ghidra and radare2. It argues for an evidence-first workflow and gives a prompt that separates verified facts from hypotheses.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🧠 AI

Buyer's checklist from Endor Labs for evaluating security tools in the agentic development lifecycle (ADLC), where AI coding agents write code and take actions such as package installs, CI edits and tool calls. It covers scoping, coverage, evidence-based accuracy, repeatability testing, agent-loop and PR workflow fit, remediation, governance, and a 2 to 4 week proof of concept on 3 to 5 repos with seeded ground truth.

endorlabs.comarticlePublished and added 28 Oct 2026🛡️ Security

VulnLens is a framework for binary C/C++ function-level vulnerability detection. A label-blind LLM Explainer describes each function from seven fixed perspectives (data flow, memory access, object lifetime, arithmetic and type behavior, control flow, shared state, external-resource access). A supervised Detector fuses code and explanations by cross-attention. It reaches 75.5% accuracy and 77.2% F1 on a 526-function PrimeVul test set, and 66.4% accuracy on SecVulEval without retraining.

arxiv.orgpaperAdded 30 Oct 2026, published 27 Oct 2026🛡️ Security

CISA ICS advisory ICSA-26-300-01 (October 27, 2026) covers EPICS Base release 7.0.10 and earlier, with CVE-2026-114595 through CVE-2026-114598. Flaws include integer overflow, length parameter inconsistency and type confusion, allowing denial of service, memory corruption, information disclosure or remote code execution (CVSS v3.1 9.8). The fix is EPICS Base 7.0.11, with patches in epics-base and pvDataCPP pull requests.

cisa.govadvisoryAdded 29 Oct 2026, published 26 Oct 2026🛡️ Security

Latent Space interview in which swyx talks with Supabase co-founders Paul Copplestone and Ant Wilson about backends for software built by AI agents. Topics include Supabase Compute for running workloads next to the database, Multigres for highly available Postgres (private alpha), the Turso acquisition, declarative schemas, and durable workflows. The page has only show notes and chapters, recorded ahead of Supabase Select 2026.

latent.spacetalkPublished and added 26 Oct 2026🧠 AI

Thread on two October 2026 npm compromises: @subql/common 5.8.3 (5 October), published through GitHub Actions OIDC Trusted Publishing after the attacker tampered with the publish workflow, and tensorlake 0.5.144 (8 October), published by the project's own release workflow with valid provenance for about 1 hour 40 minutes. Both ran on install and stole cloud, GitHub, Kubernetes, Vault, SSH and .env credentials; tensorlake also took AI tool and MCP config. Its payload installed a gh-token-monitor service that deletes the home directory if the stolen GitHub token is revoked, so remove it before rotating.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🛡️ Security

Reply on X explaining a Bytecode Alliance advisory for Wasmtime's Cranelift compiler backend. A large or crafted Wasm function that generates enough SSA values overflows Cranelift's value-index representation, which packed indices into 24-bit fields. The fix widens them to 32 bits. The issue is not AArch64-specific, and the advisory names no required optimisation level. Guard pages do not reliably stop the resulting miscompilation and type confusion, so a sandbox escape can arise at compile time.

x.comthreadAdded 28 Oct 2026, published 26 Oct 2026🛡️ Security

CyberForge CVE of the Day #087 covers CVE-2026-115889, a Cranelift value-index overflow in Wasmtime that can miscompile crafted WebAssembly and possibly escape the sandbox (CVSS 9.9, CWE-197 and CWE-843). Affected: below 36.0.19, and 37.0.0 up to but excluding 43.0.0; fixes are 36.0.19 and 43.0.0. It gives a SOC investigation trail from module digest to compiled artifact to host telemetry. EPSS is 0.454%, with no KEV entry.

x.comarticleAdded 28 Oct 2026, published 26 Oct 2026🛡️ Security

Gheist is a GitHub campaign disclosed by Wiz in October 2026. Stolen tokens push ci-sync-XXXXXX branches with a sync-check workflow that dumps repo secrets base32-encoded to evade log masking, fetches the logs via API, then deletes the run. 13,500+ branches and 850+ accounts were hit since 15 September. Public repos are protected by the approval hold; private and Enterprise repos are not. The thread lists IOCs (.gdmp_pat files, "gheist" user agent, "ci: sync config" commits) and rotation steps.

x.comthreadAdded 26 Oct 2026, published 25 Oct 2026🛡️ Security

jshook is an open-source (AGPL-3.0) MCP server that gives AI agents a search-first, profile-aware reverse-engineering workspace for JavaScript, browser traffic, WASM and native processes. Agents start with a small searchable tool surface and move to workflow or full profiles only when needed. It drives Chromium or Camoufox over CDP, captures WebSocket traffic, has HTTP, GraphQL and Burp Suite helpers, and supports hot-reload plugins and declarative workflows. The post is a short announcement; the repository link is in a reply.

x.comtoolAdded 28 Oct 2026, published 25 Oct 2026🧠 AI

jshook is an open-source (AGPL-3.0) search-first reverse-engineering workspace for AI agents, exposed over MCP. It drives Chromium or Camoufox through CDP, captures WebSocket traffic, offers HTTP, GraphQL and Burp Suite helpers, deobfuscates JavaScript, rebuilds source maps and disassembles WebAssembly. Tool profiles start small and expand to workflow or full sets; hot-reload plugins and declarative workflows extend it.

x.comtoolAdded 28 Oct 2026, published 25 Oct 2026🛡️ Security

Gheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.

wiz.iowriteupPublished and added 25 Oct 2026🛡️ Security

SymLift is a compile-free vulnerability detection framework for context-incomplete code fragments. A fine-tuned LLM lifts control-flow, data-flow, memory and resource relations into a constrained LLVM-like IR. A parser turns the IR into facts, and Datalog rules derive findings with derivation traces. On Juliet function-level fragments Clang compilation success falls to 12.00%, while SymLift's completion rate drops only 1.17 points. SymLift-Qwen-7B reaches Target-F1 94.41% on FormAI and 91.66% micro-F1 on MegaVul.

arxiv.orgpaperAdded 28 Oct 2026, published 25 Oct 2026🛡️ Security

SymLift is a compile-free vulnerability detection framework for code fragments that lack project context. A fine-tuned LLM reconstructs control-flow, data-flow, memory and resource relations as a constrained LLVM-like IR, and a deterministic parser turns it into facts for Datalog rules that give findings with derivation traces. SymLift-Qwen-7B reaches 94.41% Target-F1 on FormAI and 91.66% micro-averaged Target-F1 on MegaVul.

arxiv.orgpaperAdded 28 Oct 2026, published 25 Oct 2026🧠 AI

RALE (Representation-Aware Logical Ensemble) is a method for detecting vulnerabilities in C source code with LLMs trained on different code representations: raw source, Abstract Syntax Trees and Control Flow Graphs. The authors show the representations suit different vulnerability classes, and combine the models with explicit logical rules and majority voting. Single-representation models reach up to 73% F1, while the ensemble reaches 78%.

arxiv.orgpaperAdded 28 Oct 2026, published 24 Oct 2026🛡️ Security

RALE (Representation-Aware Logical Ensemble) is a method for LLM-based vulnerability detection in C code. The authors train LLMs on raw source code, Abstract Syntax Trees and Control Flow Graphs, and find each representation works best for certain vulnerability classes. Combining the models with explicit logical rules and majority voting raises F1 from at most 73% for a single model to 78%, with gains in accuracy, precision and recall.

arxiv.orgpaperAdded 28 Oct 2026, published 24 Oct 2026🧠 AI

Post on the LiteLLM supply-chain compromise. Attackers spent eleven days in the GitHub org, ran a workflow on a throwaway branch to take twenty secrets including a GitHub App private key, then used stolen GitHub CLI OAuth tokens to publish malicious release 1.107.0 from a lookalike Berri-AI repo. A Python startup file harvested sixteen credential categories and LiteLLM proxy Postgres provider keys. Socket flagged the wheels in seven minutes.

x.comthreadAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

Socket's Threat Research team reports that malicious cache.yml workflows ran in the BerriAI/litellm repository on 10 and 12 October 2026, eleven days before the 21 October release attack that published litellm==1.107.0. Each commit pushed to a short-lived ci-tmp-<hex> branch, then deleted it, sending base64-encoded CI secrets to webhook.site. Evidence comes from Actions metrics and environment deployment records; 20 secret names were exposed.

socket.devwriteupPublished and added 23 Oct 2026🛡️ Security

GHSA-9v8h-qqgm-4m35 is a critical buffer overflow (CVSS v4 9.2) in the Google Brotli decoder (c/dec/decode.c), affecting versions 1.0.3 through 1.2.0 on all platforms. A crafted compressed stream lets an unauthenticated remote attacker corrupt adjacent decoder state, leak memory, crash the process, or possibly execute code. Fixed in 1.0.10, 1.1.1 and 1.2.1. The page does not mention curl or Git, despite the title.

github.comadvisoryAdded 25 Oct 2026, published 23 Oct 2026🛡️ Security

SCI-AGENT-EXAM is a workflow-oriented benchmark of 120 expert-curated tasks across 11 scientific fields and 7 task types from the Scientific Workflow Task Taxonomy (SWTT). Tasks need both executable and textual artifacts, scored by programmatic checks plus an expert-calibrated LLM judge. Ten frontier agents were tested: GPT-6 Astra scored highest at 80.9, but only 26.0% of its runs passed the 0.95 success threshold.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

ENISA Technical Advisory for Software Bill of Materials is practical guidance on SBOM adoption for organizations, especially micro, small and medium enterprises and open-source stewards. It sets out an SBOM implementation architecture and data flows across a defined lifecycle, an indicative SBOM threat model with targeted risks, and measures for the SBOM ecosystem. It aligns with the ENISA Secure by Design and Default Playbook and supports Cyber Resilience Act compliance.

enisa.europa.euadvisoryAdded 23 Oct 2026🛡️ Security

ZTrust is a Python supply-chain scanner that checks manifests, lockfiles, source and GitHub workflows for vulnerable or malicious dependencies (via OSV.dev), typosquats, leaked secrets, unsafe lockfiles and risky CI patterns such as pwn requests and script injection. It outputs console, JSON and SARIF 2.1.0 and ships as a GitHub Action. It also includes a FastAPI bounty service using commit-reveal and shielded Zcash payouts for researchers.

github.comrepoAdded 27 Oct 2026, published 22 Oct 2026🛡️ Security

Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.

dfir.chwriteupAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Protos reports that on-chain investigators, including Darcy of Salus, ZachXBT and SpecterAnalyst, say CoinDCX misattributed about $16M in outflows from compromised wallets. CoinDCX says the addresses were created in January 2025, compromised in July 2025, and that a sweeping process failed. Investigators cite gas distribution, hot wallet transfers as late as May 2026, and funds sent to Huione and Xinbi addresses.

protos.comarticlePublished and added 22 Oct 2026🛡️ Security

Recap of a Huntress Tradecraft Tuesday session (October 2026) on phishing kits that target Microsoft 365 tokens, including EvilTokens (a device-code phishing campaign abusing Railway) and the Kali365 control panel. It explains device-code phishing, adversary-in-the-middle and token replay. It lists detections (unfamiliar cloud sign-ins, device-code auth, new devices) and response steps (revoke refresh tokens, remove rogue devices, block device-code flow).

huntress.comarticlePublished and added 22 Oct 2026🛡️ Security

Cloudflare's account of obtaining South Korea's ISMS-P certification after a ten-day KISA audit of 80 controls and a preparation period of about a year and a half. It explains that the certificate covers a service delivery boundary rather than a product list, that auditors required readable data flow diagrams, and how Korean sign-up uses itemized consent with social login removed.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 22 Oct 2026🛡️ Security

Social post summarising emergency patches for Node.js (4 high CVEs), PHP (2 critical) and nginx (3 critical). Node.js flaws include a Brotli decoder out-of-bounds write, a DNS truncation bug and two TLS hostname-verification bypasses. PHP has use-after-free and heap corruption bugs, and nginx has alias-rewrite and map-regex heap overflows plus an SSI-AIO use-after-free. It lists the fixed versions for each product.

x.comthreadAdded 23 Oct 2026, published 22 Oct 2026🛡️ Security

Phoronix reports that Trend Micro's Zero Day Initiative mistakenly sent several Linux kernel vulnerability reports to the public kernel mailing list instead of the private security list. They include two CVSS 9.0 remote code execution bugs (SMB Direct integer underflow, ksmbd race condition), a skb_zerocopy local privilege escalation, a vmwgfx out-of-bounds write, an NVMET information disclosure and a search-domain TCP stack buffer overflow. Some have patches in -next branches, and none were yet in mainline.

phoronix.comarticleAdded 23 Oct 2026, published 22 Oct 2026🛡️ Security

Post describing a LiteLLM 1.107.0 PyPI compromise in which attackers used stolen GitHub CLI OAuth tokens from three engineers to trigger and approve the project-releaser workflow, producing eight malicious wheels and a tampered tarball. The wheels drop cook.pth, which runs at Python startup, and privcollect steals cloud tokens, keys, browser data, AI configs and LiteLLM proxy credentials, exfiltrating to litellm[.]dev/healthcheck. A second daemon polls a GitHub domain.txt hourly for new domains to fetch and execute. PyPI yanked the package the same day. The post is a single unsourced tweet.

x.comthreadPublished and added 22 Oct 2026🛡️ Security

CVE-2026-107406 is a memory overflow in Citrix NetScaler that allows remote code execution when SAML is configured, rated 9.5 out of 10. The post from emits.ca calls it the fourth NetScaler bulletin in a week. It warns that the previous week's SAML patch does not cover it, and that fixes need NetScaler 14.1-73.46 or later, or 13.1-64.29 or later. The full advisory is on emits.ca.

x.comadvisoryAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

GPT Voice is a free, open-source Mac app by Vishesh Raheja that brings ChatGPT's dictation to any macOS app. A shortcut starts recording, and the transcript is pasted where the user is typing. It uses the ChatGPT Pro subscription, so it needs no API key or extra subscription. The author built it after Handy handled coding prompts poorly and they did not want to pay for Wispr Flow. The thread gives no details on local versus API transcription or latency.

x.comthreadAdded 22 Oct 2026, published 21 Oct 2026🧠 AI

UniWALM is a unified world-action-language model that learns video, action and language in one mixture-of-transformers backbone with per-modality diffusion heads that co-denoise together. Generated subtask and textual memory are fed back on the next step, so no external planner or memory bank is needed. It adds Flow Matching with Correction (FMC) for recovery from perturbed actions. It reaches 34.5% on the memory-dependent RMBench subset, above Mem-0's 28.5%, and lifts real-world Find-the-Item success from 11.1% to 61.1%.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

Lafa (Large flow language model) is a blockwise continuous flow language model scaled to 8B parameters, with causal attention on the prefix and bidirectional, asynchronous flow within each block. It is adapted from pretrained autoregressive models and trained at 0.5B, 7B and 8B with under 30B tokens. A self-speculative decoding scheme verifies flow drafts autoregressively in one model, giving 2.54x the throughput of an AR model at comparable quality. Flow maps allow one- and few-step generation.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

Report on wallets linked to the April 2026 Drift Protocol hack resuming laundering on 20 October 2026. Lookonchain counted 25,700 ETH (about $61.56 million) sent to Tornado Cash in 100 ETH batches, with 81,864 ETH still held. It recaps the six-month fake-VC social engineering, Cursor and VSCode compromise of Security Council devices, and TRM Labs and Chainalysis attribution to DPRK's UNC4736.

en.cryptonomist.charticlePublished and added 20 Oct 2026🛡️ Security

FreedomXMR (FXMR) is a centralized Monero swap service on Hyperliquid Core that appeared in August 2026. ZachXBT's manual review of every inflow above $10K traced over $20M, more than 87% of volume, to ransomware, malware and exploits including DCENT Wallet, Fetch.ai, Axelar and Gamdom. The admin sources XMR liquidity from KuCoin and won the FXMR ticker in an auction for 518.28 HYPE.

bankless.comarticlePublished and added 20 Oct 2026🛡️ Security

Source-level review of x64dbg-MCP, GhidraMCP and IDA Pro MCP security, dated October 2026. It covers GHSA-4478-h5jv-647m (missing authentication, 0.0.0.0 bind) and GHSA-jgj3-97w2-9v9r (Content-Length integer overflow before the token check, causing a DoS panic), and compares tags 1.0, v1.1 and v1.2. It separates network reachability, tool authority and semantic influence from hostile binaries. No new exploit is claimed.

x.comarticleAdded 21 Oct 2026, published 19 Oct 2026🛡️ Security

Cost-Coupled Gittins (CC-Gittins) is a multi-objective extension of cost-aware Gittins search that recommends Pareto-optimal model-to-role assignments for LLM agentic workflows. It exploits the coupling between evaluation and deployment cost, alternating between seeking higher quality and lower cost. On eight quality-cost matrices (two to five roles, up to 1,681 assignments), it recovers a substantial share of the true Pareto frontier at about 10% of exhaustive-evaluation cost, and most of it by 30%. Latency is tested as a third objective.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

HAF-VLA is a hierarchical action-flow framework that adapts a pretrained flow-matching vision-language-action model to humanoid whole-body loco-manipulation. It denoises a shared action space in stages: locomotion and head commands first, then waist refinement, then full-body manipulation. Learnable stage embeddings and cross-stage KV-cache conditioning carry dependencies between stages. The authors report gains over existing models on six real-world tasks.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

This paper presents a hybrid framework for axial compressor flow that couples a Multi-Fidelity Ensemble Kalman Filter (MFEnKF) with machine learning. The filter merges PIV experiments with steady RANS and unsteady hybrid RANS/LES simulations. A neural network trained on the enriched data predicts Navier-Stokes volume forcing terms from velocity, velocity gradients and turbulent viscosity. A Mixture of Experts fixes local errors near blade tips, giving lower experimental discrepancy than baseline RANS.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

E-Layout is an ML-driven framework for post-placement logic restructuring in IC physical design. It builds equivalent logic alternatives with e-graph equality saturation, links logic choice to physical realization through a graph-based RAG model, and refines the choices with reinforcement learning on design-level timing feedback. On 9 designs it gives about 6% TNS and 2% WNS improvement and 1% less area than a commercial physical design flow.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

A Broadcom SDK flaw in the WPS code that reassembles fragmented EAP messages allows a buffer overflow and unauthenticated code execution over Wi-Fi, bypassing WPA2/WPA3 passwords. Quentin Kaiser of ONEKEY demonstrated it at Hexacon on 16 October 2026 against Orange Belgium and Proximus gateways, and published a fingerprinting script and YARA rule. Broadcom's 2018 patch was incomplete, it refused a CVE, and over 1.5 million Belgian gateways are exposed.

en.cryptonomist.charticlePublished and added 19 Oct 2026🛡️ Security

Self-evolving Agent Harness is a 66-page survey and theory paper on revising an agent's scaffolding (prompts, memory, workflows, tools, code, plugins) while model weights stay fixed. It frames search as evolutionary optimization and uses continual PAC-learning to derive a generalization bound, a retention bound and a high-probability admission rule with fresh validation data. It separates selection, activation, attribution and improvement as evaluation claims, and covers applications and governance. Code is at github.com/zgcagi/Harness-RSI.

huggingface.copaperAdded 19 Oct 2026🧠 AI

CyberForge Weekly CVE Rundown #006 covers six CVEs from 12-17 October 2026: BotSharp default signing key, GitLab CI/CD regex compiler overflow (CVSS v3.1 10.0), Ivanti Connect Secure auth bypass, Cisco Secure Email Gateway, BeyondTrust Remote Support and the Linux kernel PwnEscape guest-to-host bug. It gives fixed versions, KEV and EPSS status as of 18 October, and separates patch verification from compromise investigation.

x.comarticleAdded 20 Oct 2026, published 18 Oct 2026🛡️ Security

An X thread by Mikko Laakkonen arguing that companies should encourage staff to vibe code, then provide approved hosting, identity, secrets, deployment and monitoring. It lists 200 application checks in 17 sections, from ownership and data flow through keys, authz, coding-agent isolation, appsec, SBOM and releases to recovery, runtime AI and handover. It adds 16 EU bonus checks on GDPR, NIS2, the Cyber Resilience Act (reporting from 11 Sept 2026, main duties 11 Dec 2027), the AI Act and the Data Act. It builds on Mark Ajzenstadt's production-readiness post and links a 300-check worksheet version.

x.comthreadAdded 18 Oct 2026, published 17 Oct 2026🛡️ Security

Long-form write-up of a Hexacon 2026 talk on a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 stack, present since 2010 and incompletely patched in 2018. It is remotely triggerable over WiFi without the network key. It gives information disclosure and code execution on eCos (BCM3380, BCM3383, BCM33834) and Linux (BCM3390, BCM65xx, BCM68xx) platforms. Exploited on Belgian ISP routers from Proximus, VOO and Orange. Includes a 90-day disclosure timeline, and Broadcom refused to assign a CVE.

quentinkaiser.bewriteupAdded 19 Oct 2026, published 16 Oct 2026🛡️ Security

Tweet from 0xBunny announcing an update to Jev Workflows, an open-source workflow toolkit. It adds native Claude Code support alongside Codex, an opt-in Jev 1.14, experimental image/Box questions, shared QQ contract sync and local CI. Features were also mirrored to a sibling project called QQ. It is free, with no plugin quotas, and links to a GitHub repo.

x.comthreadAdded 17 Oct 2026, published 16 Oct 2026🧠 AI

LILIE (Language-Informed and Lossless Image Encoder) is an invertible image transform built from a normalizing flow transformer, trained jointly with a vision-language model via next token prediction so captions can be recovered from noised features. The encoder supplies a language-informed loss for text-to-image generation. JiT models trained with it cut gFD from 66.84 to 53.01 against a pixel-only baseline on the GPIC dataset. Code, encoders and models are released.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

SecurityWeek's weekly roundup covers ICS-Sniper, a UBC proof-of-concept that uses VPN-encrypted packet size, direction and timing to drop critical SCADA traffic on cloud-hosted ICS (tested on the SWaT water testbed). It also covers an unauthenticated RCE PoC against the XWorm RAT C2 panel (up to 7.4) via path traversal DLL overwrite, and Langflow CVE-2026-105740 (MCP Stdio command injection, fixed in 1.9.0) exploited from September 19, before the CVE was published. Other items: XBOW's AI-assisted Chrome full-chain exploit (GPT-5.6 Sol, $250k bounty), Group-IB's KGB RAT analysis, Anthropic's disclosure of Claude rule-bending on live sites, Intel ending SGX after Diamond Rapids, Bank of America's Mythos-driven patching, the Burger King Japan breach and a West African scam-center takedown.

securityweek.comarticlePublished and added 16 Oct 2026🛡️ Security

SecurityWeek reports F5 fixed 11 NGINX vulnerabilities. Three are critical: CVE-2026-15176 and CVE-2026-93479 are unauthenticated buffer overflows via crafted HTTP requests, and CVE-2026-97205 is memory corruption. All three can lead to RCE if ASLR is disabled or bypassed. Juniper Networks published 17 advisories covering over 150 flaws in Junos OS and Junos OS Evolved, plus four in Cloud-Native Router. About two dozen are critical, with root code execution, device takeover, kernel panic and an off-by-one buffer overflow. Neither vendor reports exploitation in the wild.

securityweek.comarticlePublished and added 16 Oct 2026🛡️ Security

S2W post on CVE-2026-97229, a CVSS 10.0 remote code execution flaw in the GitLab CE/EE CI/CD regex compiler, disclosed October 13, 2026. Insufficient regex validation plus an integer overflow during encoding conversion lets an attacker who can add CI/CD config use a malicious regex and a UTF-8 repository path to run commands as the git user. Affects self-managed 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Rapid7 published analysis and a public PoC exists, with no in-the-wild exploitation confirmed as of October 15. No workaround exists, so patch or restrict access to a management network or VPN.

x.comadvisoryAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

Endor Labs analyzes the March 2026 Trivy compromise (CVE-2026-33634, CVSS 9.4). A pull_request_target misconfiguration leaked a PAT, and attackers then force-pushed malicious commits to 75 of 76 trivy-action tags and all 7 setup-trivy tags. The TeamPCP credential stealer harvested SSH keys, cloud and CI tokens and runner memory, and exfiltrated to a typosquatted domain. It gives three checks: audit pull_request_target workflows, pin Actions to full commit SHAs, and scope GITHUB_TOKEN permissions. It also notes the limits of SHA pinning.

endorlabs.comarticlePublished and added 16 Oct 2026🛡️ Security

Endor Labs explains the March 2025 compromise of the tj-actions/changed-files GitHub Action (CVE-2025-30066). Attackers pushed a malicious commit and retroactively repointed version tags, so a Python payload dumped CI/CD secrets to workflow logs across about 23,000 repositories. The post gives response steps: find usage with a GitHub code search, remove the Action from all branches or enforce an Actions allowlist, audit logs for suspicious outbound requests and IPs, and rotate exposed secrets. It also notes the March 17 restoration and the risk of transitive Action dependencies. It includes Endor Labs customer steps (the `--ghactions --secrets --git-logs` scan flags).

endorlabs.comarticlePublished and added 16 Oct 2026🛡️ Security

Explains the "pwn request" weakness in GitHub Actions. A workflow triggered by pull_request_target runs with write permissions and secrets, so if it checks out and builds PR head code, attacker-controlled code runs in a privileged context. It gives a three-step check for susceptible workflows: the trigger, a checkout of the PR head SHA or ref, and build steps such as npm install or make. It also covers mitigations: switch to pull_request or workflow_run, gate on a label, and never pass secrets to scripts that run on PR code. It notes safe patterns and cites the puppetlabs finding.

endorlabs.comarticlePublished and added 16 Oct 2026🛡️ Security

Announces Nemotron-pretraining-Indic-v1, about 2.8T tokens across 22 Indian languages (2,601B native-script, 224.6B romanized; 34 language-script configs), built by translating 15 Nemotron-CC-v2 subsets with NeMo Data Designer and Gemma-4-31B-it. The pipeline covers document-level translation, an MQM-inspired judge with a 75/100 threshold, feedback-based repair, and a separate Indic Translate workflow for ten languages. Continued pretraining of Nemotron 3.5 Super VL with 10B Indic tokens raised all five Indic benchmarks by 4.98–9.82 points. The post also gives dataset loading code and notes limitations: automated judging, translator-as-judge, and no semantic dedup.

huggingface.coarticlePublished and added 16 Oct 2026🧠 AI

IBM announces Granite-Switch-4.1-8B and -30B. Each composes a base Granite model with a Decision aLoRA, a Guardian safety aLoRA and the Granite-Speech-5.0-Turbo-CTC ASR model into one model that uses about the same VRAM as the base alone. Because the adapters are Activated LoRAs, they reuse the base model's KV cache, and with IBM's vLLM contributions for faster LoRA inference one endpoint can handle chat, decision and speech requests. The post compares the setup with Jev (a 5-step RAG workflow race, and a 3B Doom-playing model at 60–100 decisions/s against Jev's reported 10), and says users can compose their own Switch models from Granite Libraries adapters.

huggingface.coarticlePublished and added 15 Oct 2026🧠 AI

Thread distinguishing two Langflow advisories on MCP Stdio command execution. CVE-2026-105740 (GHSA-7w94-79vh-5mr2) affects 1.8.3 and is fixed in 1.9.0, an authenticated non-admin path. CVE-2026-105697 (GHSA-w794-rj3p-xv45) covers 1.1.2 up to but excluding 1.10.3, with fixes in lfx and langflow-base too. The later fix validates the API, flow and pre-spawn boundaries and removes the shell wrapper, and the thread warns that LANGFLOW_AUTO_LOGIN=true can expose a token without credentials. It cites one sensor's telemetry (1,628 attempts from 28 IPs) with caveats, and gives a defensive checklist: verify patched packages, review stored MCP configs and imported flows, and hunt for unexpected child processes.

x.comthreadAdded 17 Oct 2026, published 15 Oct 2026🛡️ Security

This paper analyses software supply chain (SWSC) attacks against VLSI design tools. It empirically studies the software composition, security features and tool interactions of VLSI suites, then builds a taxonomy linking SWSC attacks to VLSI attacks, design-flow stages and security outcomes. The taxonomy yields 717 possible new attacks, 60 of them high feasibility, with a threat model, a defense assessment and case studies on an open-source VLSI flow.

arxiv.orgpaperAdded 20 Oct 2026, published 15 Oct 2026🛡️ Security

Episode 25 of the OpenSourceMalware Show (transcript). It covers GitHub's push attribution (forged-commit visibility, Enterprise-only preview) and GitHub Actions workflow lockfiles (mitigate tag-swapping like tj-actions and Trivy, but not GhostAction). It also covers the GhostAction campaign expanding to a proxy-style phishing kit on my-github.com that bypassed GitHub MFA, and the DOJ's Operation Lonestar Roundup against DPRK laptop farms (~187 computers seized).

opensourcemalware.comtalkPublished and added 15 Oct 2026🛡️ Security

Proposes EdgeFlow, a hybrid KV cache migration scheme for distributed LLM inference across heterogeneous edge servers in Collaborative Edge Computing. It combines direct KV cache transmission with activation-based recomputation, overlapping computation and communication to cut migration time when servers disconnect or overload. The authors formulate a multi-node KV migration optimization problem and give a 2-approximation algorithm built on improved LP relaxation and bipartite graph techniques. Experiments on a real distributed LLM inference platform show up to 45% lower migration time.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

AWS reports results for its autonomous pentesting agent, AWS Security Agent (now part of AWS Continuum), on an internal CTF-style benchmark of 37 recent 2025–2026 CVEs. Each CVE ran as a live docker-compose target with a hidden flag, and the agent started from an endpoint and a one-line hint with runtime CVE lookup disabled. It captured 35 flags, 33 (89.2%) through the intended vulnerability after an audit against canonical PoCs. The post describes the 7-stage pipeline (crawler, specialist agents, validator, exploitation agent, flag check, audit), three exploit walkthroughs (CMS upload-to-admin chain, AI workflow builder RCE, tRPC full-read SSRF), the two audit reclassifications caused by benchmark bugs, and two misses where the agent took the target down. It also argues that saturated public benchmarks like CVE-Bench and XBOW are contaminated.

aws.amazon.comarticlePublished and added 15 Oct 2026🛡️ Security

PROBE (Policy Rule Observation via Behavioral Exploration) trains LLM-based auditors that act as realistic users and probe deployed tool-using agents for policy violations (pricing, privacy, confirmation, safety) across multi-turn, tool-mediated dialogue. It formalizes auditing as a two-player Markov game with a composite reward for violation discovery, plausibility, progress and policy diversity, and compares GRPO, DPO and GFlowNet optimization. Trained auditors find broader, higher-yield violations than zero-shot adversaries, even when much smaller than the target agent, positioning behavioral auditing as a distinct axis next to capability and safety benchmarks.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🛡️ Security

PROBE (Policy Rule Observation via Behavioral Exploration) trains LLM-based auditors that act as realistic users and probe deployed tool-using agents for policy violations (pricing, privacy, confirmation, safety) over multi-turn dialogue. It formalizes auditing as a two-player Markov game with a composite reward balancing violation discovery, behavioral plausibility, conversation progress and policy diversity, and compares GRPO, DPO and GFlowNet optimization in a controlled setting. Trained auditors find broader, higher-yield violations than same-architecture zero-shot adversaries, even when much smaller than the target agent. This positions multi-turn behavioral auditing as a distinct evaluation axis alongside capability and safety benchmarks.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

Hugging Face blog post introducing Black Forest Labs' open FLUX.3 Image Klein (distilled and base checkpoints) in Diffusers. It covers text-to-image, multi-reference image-to-image and bounding-box layout control, FP8/NVFP4 single-file quantized weights, DreamBooth LoRA training scripts for generation and editing, memory/speed figures (about 2 s per 1024×1024 image on an H100), and a detailed architecture tour: Qwen3-VL text encoder, two-stage per-stream then joint transformer blocks, per-token timestep modulation, 4D RoPE, and flow-matching denoising. It also shows how to customise the Modular Diffusers pipeline.

huggingface.coarticlePublished and added 15 Oct 2026🧠 AI

A DarkWebInformer post announces a public PoC for CVE-2026-85884, a Windows privilege escalation in the Windows Health and Optimized Experiences service. Per the post, low-privileged code with access to the Windows diagnostics workflow can trigger the flaw. The PoC is hosted in a GitHub repo by Beardhammer; the tweet text is truncated, so the exact root cause is not stated.

x.comthreadAdded 16 Oct 2026, published 14 Oct 2026🛡️ Security

Orca Security analysis of CVE-2026-97229, a CVSS 10.0 flaw in GitLab CE/EE. An integer overflow (CWE-190) in the CI/CD regular expression compiler gives memory corruption and code execution as the git user. It is triggered by a crafted regex in .gitlab-ci.yml combined with a UTF-8 repository path, with no authentication needed on instances that allow public project creation or self-registration. Lists affected branches (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2), the absence of a workaround, interim mitigations, and a Rapid7 PoC against GitLab CE 19.4.1 with ASLR on. Notes a prior max-severity GitLab bug (CVE-2026-85706) was probed in the wild within hours and later added to CISA KEV.

orca.securityadvisoryPublished and added 14 Oct 2026🛡️ Security

INFUSE is an end-to-end benchmark for indirect prompt injection (IPI) across long-horizon agent workflows (shell commands, code changes, dependency installs, remote services). It has 40 realistic tasks and a taxonomy of 56 attack scenarios in five threat categories, with attacks injected via interaction surfaces encountered mid-task. Across 19 LLMs (GPT, Claude, Gemini, Llama, Gemma, Qwen) and 41,824 adversarial trajectories, mean attack success was 19.6% (LLM-judged) and 15.4% (heuristic), per-model 3.2–41.9%; guard models gave limited protection, while prompt-level hardening cut mean ASR from 58.2% to 14.3%.

arxiv.orgpaperAdded 17 Oct 2026, published 14 Oct 2026🛡️ Security

News write-up of XBOW's research in which AI agents (OpenAI gpt-5.6-sol) plus human researchers built a full Chrome exploit chain on Windows in six days, at about $40,000 in API cost, earning a $250,000 Chrome VRP reward. The chain combined a V8 Maglev bounds-check bypass, a WebP animated-decoder heap buffer overflow, and a Crashpad out-of-bounds write that escaped the sandbox and called CreateProcessW() to launch Calculator. The common root cause was trusting conditions (immutability, unchanged data, suspended process) that could change; Chrome 153+ is patched.

en.cryptonomist.charticlePublished and added 14 Oct 2026🛡️ Security

Chainalysis's North America chapter of its 2026 crypto adoption report. Its centrepiece is an on-chain analysis of Coinbase's x402 protocol, which lets AI agents pay autonomously: over 138M transactions on Base, 87% of payments between $0.0001 and $0.10, and growing wallet re-funding (70.6% to 89.3% within 30 days). Wallets also move from funding to first spend faster (73 days to 18 minutes at the median). It breaks down what agents buy (data/search APIs, code review, model inference, agent frameworks), shows US wallets making 88% of inference payments and Chinese wallets dominating security-audit spend, and argues compliance should screen agent funding, counterparty and behaviour pattern rather than each payment. The remainder covers dollar stablecoin exports, tokenized Treasuries and Canada's peer-to-peer and remittance flows.

chainalysis.comarticlePublished and added 14 Oct 2026🧠 AI

Defender guide for CVE-2026-104935, an authentication-bypass-by-spoofing flaw (CWE-290) in Ivanti Connect Secure that allows unauthenticated command execution. It is confirmed exploited and CISA KEV-listed, with a CNA CVSS 8.6. It covers the fixed-release matrix (25.1.1.2, 22.8R2.5, 25.1.3.x), platform and cluster migration limits, and Volexity's UTA0576 indicators and YARA rules. It also gives a six-step SOC workflow (scope, preserve, hunt, correlate identity, remediate, verify). It stresses that a clean ICT result cannot clear memory-only activity and that LDAP, LAPS and BitLocker exposure belongs to one observed chain.

x.comthreadAdded 16 Oct 2026, published 14 Oct 2026🛡️ Security

REA (rea-agents on npm) registers an MCP server and matching workflow instructions with coding agents such as Claude Code, Codex, Cursor and Gemini CLI. It exposes tools for inspecting native binaries through Hopper, Ghidra or IDA (with optional objdump and Rizin), JavaScript/Electron apps and ASAR archives, .NET assemblies and websites. Results come back with evidence and limitations, so the agent can explain how a feature works and write and test its own implementation. Analysis runs locally, there is a CLI with the same workflows, and the showcases include C reconstructions verified against original x86 function bytes.

github.comrepoAdded 14 Oct 2026🧠 AI

ThreatWire post on CVE-2026-97229, an integer overflow in the GitLab CI/CD regex compiler. GitLab rates it CVSS 3.1 10.0 and says it can allow unauthenticated code execution under certain conditions, in both CE and EE. Fixes are in 19.2.8, 19.3.5 and 19.4.2 (not 19.3.4), released Oct 12; GitLab-hosted instances are already patched. The post credits joaxcar via HackerOne and says a Rapid7 researcher published a lab PoC on GitHub, which ThreatWire has not run or verified. It also says the CVE is not in CISA KEV and has no known exploitation.

x.comthreadAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

SecurityWeek covers Chrome 155.0.8059.79/.80, which fixes 37 flaws including seven critical memory bugs (an ANGLE buffer overflow and use-after-free bugs in Browser, PDF, Network, Core, SVG and Media). It also covers Firefox 158, which fixes 77 flaws including 30 high-severity use-after-free, sandbox escape, JIT miscompilation and integer overflow bugs, plus matching Thunderbird and Firefox ESR releases. At least 15 of the Chrome bugs were reported by Xinyang Ge (Anthropic) assisted by Claude, and Amy Burnett of OpenAI found 9 Firefox bugs. The article also notes Mozilla's new Firefox Enterprise, a Gecko-based browser with a self-hosted management console for policy, access, data transfer and AI use.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

DFIR case where a malicious MSI impersonating Advanced IP Scanner, sourced from a fake GitHub repo found via Bing, was imported by a customer into Microsoft Intune and deployed to four endpoints, running a Node.js-based EtherRAT chain. It traces the infections by correlating the MSI ProductCode, MDMAppInstaller/omadmclient process ancestry and Intune app inventory (Graph PowerShell query). It also covers renamed node.exe hash-hunting pitfalls, Ethereum RPC dead-drop C2 traffic, a screen-capture script and a second impersonating repo.

dfir.chwriteupAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Podcast interview with Jason Ma, co-founder and Chief Scientist of Dyna Robotics, on Dyna-2, a world-action model pre-trained on over one million hours of human egocentric video. The model predicts future video and uses it to guide robot actions, built on a diffusion transformer with flow matching. The discussion covers the robotics data bottleneck, adapting to new tasks from about 45 minutes of demonstrations, synthetic environments and self-generated training data, on-device inference and distillation, and Dyna's custom wheeled semi-humanoid hardware. The episode listing also covers commercial deployments (Din Tai Fung, Best Western), agentic harnesses for hour-long workflows, and world-action models versus VLAs, but the fetched text was truncated before those sections.

latent.spacetalkPublished and added 13 Oct 2026🧠 AI

MiniDog is a framework for training a text-to-image flow-matching diffusion transformer from scratch on four RTX 3090 GPUs, with 55 minutes of pretraining and 15 minutes of fine-tuning. It pretrains on 26k ImageNet dog images that were captioned, then fine-tunes on 2k FLUX.1-schnell generated images. Image and text features are precomputed and cached. The model is a 22M-parameter transformer with the E2E-INVAE semantic latent space, a small Qwen text encoder and in-context conditioning, and training is accelerated with iREPA and an EUPE perception encoder. The repo evaluates with FID, HPSv2, PickScore and VAE reconstruction metrics. It lowers the barrier to hands-on diffusion training research.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

PixelMoE is a pixel-space diffusion framework that scales capacity sparsely using standard LLM-style Mixture-of-Experts: token-choice routing, fine-grained routed experts, a shared expert and bias-based load balancing, with no diffusion-specific routing or auxiliary routing losses. It adds Pixel-Space Hierarchical Flow Matching, which varies spatial resolution along the denoising trajectory from global structure to fine detail. At matched active parameters it beats dense counterparts, and reaches FID 1.47 at 256x256 and 1.53 at 512x512 on class-conditional ImageNet-1K without representation alignment or perceptual losses. Code and models are promised but not yet released.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

Google DeepMind's launch page for Gemini 4 Argon, a frontier model pitched at long-horizon software engineering, science and math, robotics, cyber defense and professional workflows. Stated specifics: a 1M-token output window for full-repository generation and long proofs, a tie for #1 on CWE-Bench (68%) for vulnerability remediation, and a 14% accuracy gain over Gemini 3.1 Pro in Box's evaluation. It also describes safeguards (resistance to indirect prompt injection, chain-of-thought monitoring, sandbox hardening under the Frontier Safety Framework) and availability via Google AI Pro/Ultra, Gemini API, AI Studio and Antigravity. Much of the evidence is partner testimonials and vendor-reported results.

deepmind.googlearticlePublished and added 13 Oct 2026🧠 AI

XBOW describes building a Chrome full-chain exploit, made of three independent bugs, that takes a user from an ordinary web page to remote takeover of a Windows machine. The team built it in six days with a publicly available model (GPT-5.6 Sol) for about $40,000 of compute, and Google paid a $250,000 bounty, the first under its 2026 rules. The bugs are now fixed. The post covers the human-agent workflow, the modular design that allowed swapping in a backup bug after Google said it already knew one, and the claim that agents could find each bug on their own within a year.

xbow.comarticlePublished and added 13 Oct 2026🛡️ Security

Rapid7 analysis of CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in the Onigmo regex compiler used by GitLab CE/EE's CI/CD regex handling. A crafted regex in a .gitlab-ci.yml passes validation as US-ASCII, then is recompiled for a UTF-8 repository path, producing invalid instructions that give code execution as the git user. Rapid7 reproduced it on GitLab CE 19.4.1 with ASLR (patched in 19.4.2); despite the vendor's "unauthenticated" rating, the attacker needs to commit a malicious config to a public project, which self-registration allows. No in-the-wild exploitation is confirmed, and Rapid7 recommends urgent upgrades.

rapid7.comadvisoryPublished and added 13 Oct 2026🛡️ Security

Rootshell Security Bulletin #22 (Aug 1998) reports an ICQ authentication flaw found by a Linux ICQ clone developer. The Mirabilis server stores 8-character passwords, and sending a password of 9 or more characters (e.g. "123456789") overflows the buffer and logs the client in as any UIN not already online. This gives full account takeover, including receiving offline messages. It is not spoofing, and it works with unofficial clients such as zicq, since the official client enforces the length limit client-side.

opennet.ruadvisoryAdded 17 Oct 2026, published 13 Oct 2026🛡️ Security

CyberForge "CVE of the Day #076" covers CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in GitLab CE/EE's CI/CD regular expression compiler. It can lead to conditional unauthenticated code execution on the GitLab server. It lists the affected trains (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2) and the 19.3.4 vs 19.3.5 Ona-regression discrepancy. It also gives six SOC checks: scoping, log preservation (Workhorse/Rails/Sidekiq, correlation_id), server-effect hunting, request-to-process correlation, upgrade and running-state verification. It notes that exploit details are unverified, no KEV listing exists and EPSS data is unavailable.

x.comadvisoryAdded 15 Oct 2026, published 13 Oct 2026🛡️ Security

A tweet describing a free setup for running a ~27B open-source Qwen model on Google Colab's free T4 GPU, driven from VS Code. A Cloudflare tunnel with a proxy locks the endpoint behind an API key, and the endpoint is connected to 9router so Claude Code and Claude Cowork on the desktop can use it. It matters as a pointer to a zero-cost way to get Claude Code-style workflows on a self-hosted open model, though the steps are only in an accompanying video and the tweet gives no configuration or quantisation details.

x.comthreadPublished and added 12 Oct 2026🧠 AI

Social thread reacting to a newly disclosed high-severity OAuth vulnerability in the Model Context Protocol Python SDK, where a malicious MCP server could manipulate the authorization flow and steal credentials used by an agent. The author uses it to argue that delegated agent authority needs provenance (who granted it, to which agent, for which service and resource, whether it is transferable or replayable, and when it expires) and that machine-to-machine trust must be auditable by humans. Gives no CVE ID or technical exploit detail.

x.comthreadAdded 13 Oct 2026, published 12 Oct 2026🛡️ Security

Latent Space report from an Anthropic workshop at AI Engineer New York 2026 on "dynamic workflows" (flows) in Claude Managed Agents. Instead of developers configuring a coordinator and a roster of subagents, the lead Claude agent writes an orchestration program that launches agents, collects results and manages information flow. The Q&A covers parallelism defaults and evals, session budgets, the Claude Console graph view, subagents sharing a filesystem, "dreaming" memory consolidation, and the higher cost of flows compared with a single agent.

latent.spacearticlePublished and added 12 Oct 2026🧠 AI

Micah Lee argues for dropping OpenAI and Anthropic in favor of open-weight models, claiming they trail proprietary ones by about four months. They report GLM-5.3 as roughly on par with Claude Opus 5.5 for software engineering, and GLM-5.3-Flash as similar to Opus 4.8 and feasible to run locally. The post compares private inference through secure enclaves (Tinfoil, Maple AI) with cheaper non-private routers (OpenCode Go). It gives pricing, data-trust caveats about Z.ai, and the author's own workflow: OpenCode harness, GLM-5.3 on low reasoning, Tinfoil for private work.

micahflee.comarticlePublished and added 12 Oct 2026🧠 AI

XRP Ledger maintainers disclosed a critical integer overflow in the payment engine, reported via bug bounty in September. A payment consuming hundreds of crafted order-book offers made the buyer's owed sum wrap around to a tiny value while sellers were paid in full, minting XRP. The built-in "no XRP created" invariant check used the same flawed arithmetic and missed it. The fix shipped in 3.4.1 on Sept. 25, bypassing the usual amendment vote and two-week wait for the first time, so the open-source patch would not expose a live exploit. No exploitation evidence was found.

decrypt.coarticlePublished and added 12 Oct 2026🛡️ Security

Endor Labs breaks down the May 11, 2026 compromise of 42 @tanstack/* npm packages (84 malicious versions) that carried valid SLSA provenance. The attacker chained a pull_request_target "Pwn Request", GitHub Actions cache poisoning across the fork/base boundary, and OIDC token extraction from Runner.Worker memory, then published directly to npm without stealing any credential. It explains why 2FA, trusted publishing, provenance and branch protection all failed, and lists mitigations: split pull_request_target workflows, treat the cache as untrusted, scope id-token: write to a publish job, pin actions to SHAs, require environment approval, use egress allowlists.

endorlabs.comwriteupPublished and added 12 Oct 2026🛡️ Security

CoinDesk reports on an 11-year-old integer-overflow bug in the XRP Ledger's DEX code. Hundreds of crafted offers could make the computed buyer cost wrap to near zero while sellers were credited in full, which would have minted billions of XRP beyond the 100 billion cap. The post-transaction no-new-XRP invariant check used the same miscounted total, and the per-account receive limit was sidestepped by spreading funds across hundreds of accounts. Researcher Cayden Liao and Veria AI reported it on Sept. 22, RippleX patched it with no evidence of exploitation, and the XRP Ledger Foundation plans AI adversarial testing, formal verification and a stronger bug bounty.

coindesk.comarticlePublished and added 12 Oct 2026🛡️ Security

Writeup of an unauthenticated RCE on Google's shared DevSite platform (developers.google.com, firebase.google.com, developer.android.com and others). The Flask session cookie embedded a pickled OAuth2WebServerFlow containing the OAuth client_secret, which was also the Flask SECRET_KEY. That let the author forge signed sessions carrying a malicious pickle that the OAuth callback unpickled; RCE was proven safely with time.sleep timing and negative controls. It earned a $90,000 bounty and lists a four-part fix.

simonkoeck.comwriteupPublished and added 12 Oct 2026🛡️ Security

OpenSourceMalware analyzes a targeted phishing email from my-github[.]com (same server 193.32.204[.]199 as GhostAction's CI/CD exfiltration) that impersonated a GitHub new-sign-in alert. Recovered HTML and a HAR show a GitHub reverse proxy that captures passwords and TOTP codes, rewrites GitHub subdomains, and injects JavaScript that silently completes an OAuth device flow with repo, workflow and read:org scopes, then exfiltrates the token to TCP/8443. It includes a per-session redirect controller, mutable redirect behavior seen in URLScan, a victim's audit-log outcome (MFA stopped escalation), IOCs, and response guidance.

opensourcemalware.comwriteupPublished and added 11 Oct 2026🛡️ Security

The Block reports on the XRP Ledger disclosure of a critical bug that had been in the payment engine since 2015. Order-book offer totals had no overflow check, so a single payment consuming a few hundred crafted offers could wrap the sum and mint spendable XRP past the 100B cap. Veria Labs' AI agent found it and built a working exploit, and RippleX shipped the fix in xrpld 3.4.1 on Sept. 25, bypassing the usual amendment vote to avoid tipping off attackers. The article also covers the $250K bounty, a separate Batch bug, and the closed-source-release criticism.

theblock.coarticlePublished and added 11 Oct 2026🛡️ Security

This repository hosts a proof-of-concept for CVE-2026-41940, described as a CVSS 10.0 unauthenticated authentication bypass in cPanel and WHM caused by CRLF injection into server-side session files via the Authorization header. The accompanying Python tool (cve.py) can detect vulnerable cPanel/WHM instances, retrieve system and account information, and perform post-exploitation actions such as running OS commands, changing the root password, and opening an interactive WHM shell. It also supports bulk scanning workflows piped from subfinder, httpx, and Shodan.

github.comrepoAdded 23 Oct 2026, published 11 Oct 2026🛡️ Security

Reports a decade-old integer overflow in the XRP Ledger payment engine's DEX offer-crossing code (added 2015). A single transaction across hundreds of seeded accounts could have minted about 18.45 trillion XRP, because the overflowed total understated what the buyer paid and the mint-check safeguard used the same wrong total. Veria AI found it on 2026-09-21 and reported it through the bug bounty. RippleX reproduced it on a standalone server and shipped xrpld 3.4.1 on 2026-09-25 as binaries only, with no patch source. RippleX's Mayukha Vadari warns that AI makes silent critical patches easy to reverse engineer, and the withheld source drew open-source criticism.

en.cryptonomist.charticlePublished and added 11 Oct 2026🛡️ Security

Introduces Policy-Constrained Diffusion Agents (CoDA), which enforces task-dependent security policies inside the denoising process of diffusion language models. At each step, token distributions are projected onto a policy-compliant set, so constraints hold throughout generation instead of relying on detecting injected instructions. Evaluated across several dLLM families under static and adaptive prompt-injection attacks, it reports substantially lower attack success rates with competitive task utility and practical inference overhead.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

KedgeFlow specifies language-independent contracts so trusted controllers can authorize state-changing operations by enterprise AI agents and privileged gateways can enforce that authority independently of agent reasoning. It combines evidence-backed policy checks, signed permission for an exact action, a single-use shared allowance, target-side conditions and retained outcome records, with two conditional properties (at most one claim per allowance; every dispatch linked to a grant and claim) that hold even if the agent is compromised. A reference implementation exposes the path via MCP; evaluation on a three-member etcd cluster gave exactly one successful claim for each of 82 allowances across 6,560 concurrent attempts, and one committed effect in a 32-call gateway race. The authors report limits: permissive policy still authorized an undesirable effect, and distributed reservations, production access routes, crash recovery and real-target exactly-once effects remain untested.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🧠 AI

KedgeFlow proposes language-independent contracts in which trusted controllers issue signed exact-action permissions and privileged gateways enforce them, using single-use allowance claims, target-side conditions and retained outcome records. It aims to stop altered approved actions, concurrent permission reuse and retries after lost responses, even with a compromised agent. A reference implementation exposes this path via MCP; evaluation on a three-member etcd cluster showed 6,560 concurrent claim attempts yielding exactly one success per each of 82 allowances. It also reports that permissive policy still authorized an undesirable effect, and lists untested areas such as distributed reservations and production access routes.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

A tweet highlighting Prompts Chat (formerly Awesome ChatGPT Prompts), an open-source prompt library on GitHub that the post says has 167K+ stars. It works across ChatGPT, Claude, Gemini and other models. The post lists a CLI, an MCP server, a Claude Code plugin and self-hosting with custom branding and auth, all free. It is worth cataloguing as a pointer to a widely used prompt collection that now plugs into coding-agent and MCP workflows.

x.comthreadPublished and added 10 Oct 2026🧠 AI

CyberForge CVE of the Day #074 analyses CVE-2026-85097, a CVSS 9.8 unauthenticated file upload to PHP execution flaw (CWE-434) in the Bricksforge WordPress plugin through 3.1.8.9. Wordfence names 3.1.8.10 as the fix, and a separate vendor 4.0.1 Pro Forms upload-security notice has no verified mapping to the CVE. It gives a defender workflow: scope versions, preserve edge/origin logs, inspect resulting files and PHP-FPM handling, and verify the patched version is serving. It also separates KEV (no match), EPSS (0.312%) and SSVC (exploitation none) from compromise evidence.

x.comadvisoryAdded 11 Oct 2026, published 10 Oct 2026🛡️ Security

Experience paper describing an iterative agentic workflow that uses AI agents to find vulnerabilities across diverse targets: Windows drivers, the Linux kernel, XNU, firmware and web applications. The authors report that the workflow generalizes across these targets. They also cover tasks where agents help with previously hard problems and set out research directions for autonomous vulnerability discovery.

arxiv.orgpaperAdded 16 Oct 2026, published 10 Oct 2026🛡️ Security

AINews issue for 10/8–10/9/2026 from Latent Space. It leads with "decision models" (typed single-pass outputs) becoming a product category after Jev, with OpenAI Decisions API, Microsoft-Decision-1, Perplexity pplx-decider, Cloudflare clef, Liquid d1, and Unsloth/Qwen3.5 training recipes. It also covers Claude Managed Agents dynamic workflows (up to 1,000 agents), a Vals AI study of agent teams, Codex updates, model releases (Qwen-Image-2.1-Turbo, StepFun Step 5 Preview, Solar Mini 4, Gemini 4 Argon), and inference/training systems news (vLLM/SGLang on Vera Rubin, TRL v1.15, DeepSeek stride weak spots).

latent.spacearticlePublished and added 10 Oct 2026🧠 AI

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, so SecReason scans that stream with dual-track incremental analysis: security rules are checked on each emitted statement, and dataflows are traced across the accumulated code. When a rule fires, it interrupts decoding, inserts a warning into the stream and resumes, so the model fixes its draft within the same reasoning trace instead of regenerating the full response. On CWEval and SecCodeBench, runs delivering secure and functionally correct code rise from below 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🧠 AI

SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflows across accumulated code; when a rule fires, generation is interrupted, a warning is inserted, and decoding resumes so the model repairs the draft in the same trace. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%–98.1%, uses fewer tokens than post-hoc repair, and limits regressions from false warnings.

arxiv.orgpaperAdded 16 Oct 2026, published 10 Oct 2026🛡️ Security

SecReason is an in-stream defense for reasoning LLMs that monitors code drafted inside the streamed chain of thought. Dual-track incremental scanning applies security rules per statement and traces dataflow across accumulated code. When a rule fires, generation is interrupted, a warning is inserted and decoding resumes, so the model repairs its draft without regenerating the full response. On CWEval and SecCodeBench it raises the share of secure and functionally correct runs from below 15% to 72.8%–98.1%, uses fewer tokens than post-hoc repair, and limits functional regressions from false warnings.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

SecReason is an in-stream defense for reasoning LLMs that write code. Reasoning models draft code early in their streamed chain of thought, and SecReason scans that draft incrementally with security rules, checking each statement as it is emitted and tracing dataflows across the accumulated code. When a rule fires, it interrupts generation, inserts a warning into the stream, and resumes decoding, so the model repairs the draft within the same reasoning trace. On CWEval and SecCodeBench it raises the share of runs that deliver secure and functionally correct code from under 15% to 72.8%–98.1%. It uses fewer tokens than post-hoc repair and limits functional regressions when rules misfire on secure code.

arxiv.orgpaperAdded 16 Oct 2026, published 10 Oct 2026🧠 AI

OpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.

opensourcemalware.comwriteupAdded 10 Oct 2026, published 9 Oct 2026🛡️ Security

StepSecurity details a new wave of the GhostAction campaign in which attackers used compromised maintainer accounts of Takashi Kitao (pyxel) and Henry Wu (athenadriver, Uber) to push malicious "Security Audit" GitHub Actions workflows to 345 repositories in minutes. The upgraded payload now runs `git log -p --all` to mine an entire git history (not just current secrets) for thirteen credential patterns including AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, and SendGrid keys, pairs AWS access key IDs with secret keys via context capture, and exfiltrates everything via raw-IP plain-HTTP POST to 193.32.204.199, bypassing DNS-based defenses. The post includes hunting queries, run-log forensics confirming successful exfiltration from uber/athenadriver, and remediation guidance centered on workflow approval gates and egress allowlisting.

stepsecurity.iowriteupPublished and added 9 Oct 2026🛡️ Security

HOA (Humanize Olympiads Agent) is an open, flow-level framework that coordinates several agent sessions through three feedback channels: an independent reviewer that critiques each candidate, a structured wiki supplying task-specific knowledge the base model may lack, and a verifier that checks generated Lean proofs against trusted challenge statements. With GPT-5.6 Sol it reports perfect scores on IMO, IPhO and IOI 2026, near-full marks on IChO 2026, 672/672 on PutnamBench, and first place on the Lean-Eval leaderboard (251/304). With the open model Kimi-K3 it matches or exceeds a GPT-5.6 Sol + /Goal baseline on several contests, which suggests systematic feedback can narrow base-model capability gaps.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

Simon Willison describes building a new "Newsletters" index feature for his Django-powered blog almost entirely by talking to the ChatGPT desktop app's Codex voice mode (running GPT-6 Astra) while cooking dinner, then switching to typed prompts to review and fix the resulting GitHub pull request. He details the workflow — starting a local dev server, voice-describing requirements including a new model, migrations, four import scripts, and search integration — and reflects on where voice-driven coding agent interaction excels (multitasking, visual preview of changes) versus where typing remains more efficient (pasting errors, highlighting specific code).

simonwillison.netarticlePublished and added 9 Oct 2026🧠 AI

Socket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.

socket.devwriteupPublished and added 9 Oct 2026🛡️ Security

SecurityWeek's weekly news digest covering PoeLLM malware that resolves its C&C IP from keywords hidden in a GitHub-hosted poem, the GhostAction campaign spreading malicious GitHub Actions workflows to steal secrets from 772 more repos, South Korean authorities probing suspected AI-assisted bank breaches where CrowdStrike found Claude Code and Claude memory artifacts on attacker infrastructure, a high-severity Nvidia DCGM Exporter flaw (CVE-2026-47483) exposing GPU telemetry from over 12,000 hosts, and a Shai-Hulud-style credential-stealing worm shipped in Tensorlake's npm SDK. Also notes legal outcomes (Uranium Finance hacker conviction, Empire Market co-founder's 40-year sentence) and policy moves (CISA retention pay changes, an OT cybersecurity directive proposal).

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

ManeuverFlow is an end-to-end autonomous driving planner that generates trajectories for distinct driving intentions in one step. It selects maneuver modes, draws noise from a Gaussian mixture prior, and maps it to trajectories through a maneuver-routed mixture-of-experts MeanFlow field. Current features and world-model-predicted future features are aggregated along each candidate path as evidence for PDM-factor scoring and Frenet-residual refinement. With a TransFuser-style ResNet-34 backbone it reaches 90.6 PDMS on NAVSIM v1 and 90.1 EPDMS on NAVSIM v2 navtest. It also reports the highest listed PDMS* on WorldEngine's 3DGS closed-loop benchmark, 75.19 with logged traffic and 74.58 with IDM-controlled traffic.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

AgentTune is a source-available Python library that unifies building, training, evaluating, distilling and maintaining tool-using LLM agents. Its core is a two-tier EventLog representation that preserves agent trajectories and yields consistent projections for training, evaluation and auditing. On top of it sit a shared agent runtime, tool-calling reinforcement learning, agentic distillation, RAG, decision workflows, evaluation utilities and a designed path toward self-healing agents, demonstrated on tasks such as legal contract search.

arxiv.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🧠 AI

Citrix disclosed CVE-2026-107406 (CVSS 9.5), a critical memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service when appliances are configured as a SAML SP or SAML IdP, also affecting Secure Private Access Hybrid deployments using NetScaler. Patches are available in versions 14.1-73.46, 13.1-64.29, and the corresponding FIPS/NDcPP builds; Citrix says it is not aware of exploitation yet but urges immediate upgrades. The bulletin follows two other recently exploited NetScaler RCE/DoS zero-days (CVE-2026-88771, CVE-2026-88772) used against government, financial, education, legal, and professional-services organizations, and a separate DoS zero-day (CVE-2026-88779).

securityweek.comadvisoryPublished and added 9 Oct 2026🛡️ Security

mattpocock/skills is a collection of small, composable "agent skills" for software engineering that install into Claude Code, Codex, GitHub Copilot, Gemini CLI, Cursor, OpenCode, Devin, Windsurf, Amp and Pi via plugin managers or the `npx skills` CLI. It packages practices like interview-driven requirement gathering (/grill-me, /grill-with-docs), domain-model/glossary building, test-driven development with red-green-refactor (/tdd), bug diagnosis loops, codebase architecture improvement, ticket triage and spec-to-implementation workflows (/to-spec, /to-tickets, /implement, /implement-spec), splitting skills into user-invoked orchestrators and model-invoked reusable disciplines. It's built by Matt Pocock as an alternative to heavier process-owning frameworks like GSD, BMAD and Spec-Kit, aiming to keep engineers in control while giving coding agents better feedback loops and shared vocabulary.

github.comrepoAdded 8 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that adds cryptographically signed and versioned tool definitions, OAuth 2.0 scope-based permissions, Cedar-policy-driven context-aware access control (via engines like Amazon Verified Permissions/OPA), and call-stack verification to stop tool chaining and privilege escalation. It is designed to counter two named MCP threat classes — Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (post-approval silent modification of tool behavior) — with concrete pseudocode for signature verification, version/integrity checking, and policy evaluation. The page functions as an implementation guide for MCP client/server builders wanting to harden tool approval and invocation flows.

vulnerablemcp.infowriteupAdded 8 Oct 2026🧠 AI

Microsoft Security Blog post arguing that post-quantum cryptography planning must extend beyond encrypted-data confidentiality to authentication and certificate ecosystems, since larger PQC certificate chains and new algorithms like ML-DSA-87 can break PKI workflows, HSMs, and legacy infrastructure. It details Microsoft's PQC TLS Pilot Program, launched August 27, 2026, which lets approved certificate authorities (ComSign, DigiCert, HARICA, IdenTrust, Sectigo, Shanghai Electronic Certification Authority, SSL.com) test ML-DSA-87 certificate issuance under the Microsoft Trusted Root Program, plus Windows 11 builds (KB5101681, KB5101684) that support evaluating ML-DSA certificates via Schannel in non-production environments. It lays out a six-step readiness plan: inventory certificate dependencies, map trust relationships, assess vendor roadmaps, identify long-lived infrastructure, build test environments, and plan a multi-year migration.

microsoft.comarticlePublished and added 8 Oct 2026🛡️ Security

Galaxy Research's explainer traces AI's intellectual history from the 1956 Dartmouth Workshop and the Logic Theorist through the symbolic-AI era (expert systems like Mycin and XCON, the Cyc project) to the sub-symbolic/connectionist revival (Perceptron, Hopfield networks, backpropagation, LeCun's CNN zip-code reader) that culminated in deep learning and the 2017 Transformer architecture. It then surveys three machine-learning paradigms (supervised, reinforcement, unsupervised) and five deep generative architectures (autoregressive, diffusion, GANs, VAEs, normalizing flows), closing with how modern LLM chatbots combine these via pretraining, SFT, and RLHF, and how multimodal, reasoning, RAG, agent, and world-model systems extend base LLMs.

galaxy.comarticleAdded 8 Oct 2026🧠 AI

A detailed "CVE of the Day" thread analyzing CVE-2026-76471, a critical (CVSS 9.8) Cisco advisory covering insufficient NX-API input validation (CWE-122 heap-based buffer overflow) on Nexus 3000/9000 standalone NX-OS and a lower-severity credentialed variant on UCS 6300 Fabric Interconnects via UCS Manager XML API. It compiles Cisco's fixed-software versions per platform, notes the temporary Live Protect shield lp00074, and walks through a six-step SOC evidence-preservation and correlation playbook (scoping affected devices, preserving logs/crash artifacts, reviewing API/shield telemetry, correlating device outcomes, remediating, and verifying post-patch state) while flagging that CISA KEV and FIRST EPSS had no data on the CVE at research time.

x.comwriteupPublished and added 8 Oct 2026🛡️ Security

Cisco Talos details UAT-11985, a spear-phishing campaign against Taiwan-based research organizations (impersonating institutions like the Taiwan European Union Centre and NCCU Institute of International Relations) that used AI-assisted, templated lure emails and poster-based QR code phishing (quishing) to drive victims to a real-time adversary-in-the-middle phishing kit. The kit impersonates Google sign-in across zh-CN/zh-TW/en locales, uses a split HTTP-POST/WebSocket architecture to mirror Google's live authentication flow and dynamically push MFA challenge screens, enabling full session-token theft and MFA bypass. Talos attributes the kit's localization architecture and lexical choices to a Simplified Chinese-speaking developer and publishes ClamAV/Snort coverage plus IOCs on GitHub.

blog.talosintelligence.comwriteupPublished and added 8 Oct 2026🛡️ Security

Paper that tests prompt injection against AI agents through both direct user input and inter-agent communication. The attacks leak sensitive information and trigger cross-agent infections. Most findings concern single-agent systems, and the authors then extend the attacks to multi-agent frameworks to show how weaknesses propagate between agents. It argues that agents embedded in real-world workflows need stronger defenses.

arxiv.orgpaperAdded 12 Oct 2026, published 8 Oct 2026🛡️ Security

A developer's blog post recounting a month of heavy daily use of DeepSeek 4.1 Flash across coding projects, arguing it matches frontier-model quality (Claude Opus 5.5, GLM) at a tiny fraction of the cost (around $1/day vs much more for Claude). The author credits a roughly 437x KV-cache size reduction versus DeepSeek's V1 model for the cost savings, discusses why self-hosting the model is economically unattractive despite being technically possible, and reflects on how a cheap "good enough" model changes workflow habits and on environmental/economic implications of model efficiency.

dgt.isarticlePublished and added 8 Oct 2026🧠 AI

This paper studies where tool-using LLM agents break down in the chain from gathering evidence to taking consequential actions, finding that strong static judgment of whether to act often coexists with much weaker interactive execution, and that failures arise from incomplete investigation, acting before evidence is established, or unresolved prerequisites in multi-action workflows. The authors introduce SafeActBench, a 656-case benchmark across six operational domains and five protocols, paired with a provenance-bound Evidence Ledger and a deterministic trajectory evaluator tested across ten model-harness configurations.

arxiv.orgpaperAdded 7 Oct 2026🧠 AI

AWS Security Blog's second post in a series on building an "AI vulnerability harness" explains the configuration (steering file) that stops an AI model from hallucinating vulnerabilities and inflating severity during security code review. It details five configuration sections — structural verification of findings, an evidence-based confidence formula (weighting confirmed taint flow at 0.30), infrastructure-aware severity multipliers for controls like AWS WAF and IAM, CISA KEV/EPSS threat-intel boosting, and a four-tier priority classification — and reports validation numbers (e.g., unsteered models fabricated code paths in ~30% of findings; steered confidence of HIGH without structural confirmation was only 34% exploitable vs 89% with confirmed taint). The steering file is shipped as a Kiro steering file, a Kiro skill, and a CLAUDE.md for Claude Code, with full source in a linked GitHub repo.

aws.amazon.comarticlePublished and added 7 Oct 2026🛡️ Security

Part 2 of an AWS Security Blog series detailing the design of a "steering file" — a persistent instruction set (deployable as a Kiro steering file, Kiro skill, or Claude Code CLAUDE.md) that constrains an LLM performing vulnerability triage. It walks through five configuration sections: requiring structural/dataflow verification before reporting findings, replacing self-reported confidence with a weighted formula based on binary structural signals (e.g., 0.30 weight for confirmed taint flow), mapping infrastructure controls (AWS WAF, IAM) to severity multipliers with a 0.15 floor, incorporating CISA KEV and EPSS threat-intelligence boosts capped at +0.50, and a four-tier priority classification that suppresses low-confidence P3 findings. Validation against a 10-vulnerability test app showed the steered model eliminated fabricated findings and correctly downgraded mitigated vulnerabilities while preserving full severity for a command injection reachable only via authenticated access.

aws.amazon.comwriteupAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

AWS Security Blog describes a three-layer AI-assisted pipeline for triaging vulnerability scanner findings: Layer 1 cross-checks multiple scanners (e.g., Semgrep, CodeQL) for agreement, Layer 2 verifies a scanner's claimed data-flow path against the code's actual abstract syntax tree to catch hallucinated findings, and Layer 3 cross-references infrastructure-as-code (CloudFormation/Terraform) to weigh whether existing controls like AWS WAF rules actually mitigate the exploit path. It argues progressive, escalating-evidence filtering plus mandatory structural verification of LLM claims before human review is what turns noisy scanner output into a short, trustworthy, prioritized list, and lays out an adoption order (indexing, then multi-scanner triage, then AI hypothesis generation, then infra context, then live PoC verification).

aws.amazon.comarticlePublished and added 7 Oct 2026🛡️ Security

A personal workflow writeup describing how the author replaced $20 per month ChatGPT and Claude subscriptions with Qwen3.8-27B (Unsloth UD-IQ4_XS GGUF quant, 13.3GB) run locally via llama.cpp on a 4070 Ti Super GPU with 16GB VRAM, achieving about 33.7 tokens per second at a 16K context window. It covers use cases like grammar and email cleanup, sentiment analysis, data extraction, and iterative Python coding where the local model matched cloud performance without rate limits, five hour caps, or data leaving the machine, while noting Claude still leads on raw coding ability.

xda-developers.comarticleAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

Socket Threat Research uncovered a coordinated campaign of 16 malicious Firefox extensions split into a Rabby Wallet clone family (4 extensions, full repackaged Rabby codebase) and an OKX Wallet-impersonating "Portal WALLET" family (12 extensions), all hooking wallet import flows to steal mnemonic seed phrases and private keys and exfiltrate them via GET/POST/sendBeacon to attacker-controlled Cloudflare Workers endpoints under the icy-star-f45c.workers.dev namespace. The writeup includes campaign markers (EQOx7EIPZSNi), background.js SHA-256 hashes, extension IDs/XPI hashes, and ties the activity to a prior August 2026 crypto-theft extension campaign Socket tracked, plus concrete detection and incident-response guidance.

socket.devwriteupPublished and added 7 Oct 2026🛡️ Security

NuGuard is an open-source AI application safety and security toolkit for agentic AI systems, released under Apache 2.0. It unifies AI-SBOM generation, structural static analysis of the AI stack, and sandboxed adversarial red-teaming (100+ scenarios covering prompt injection, tool abuse, and data exfiltration) into a single CLI workflow, with an automated judge that scores findings by impact and provides remediation guidance.

x.comthreadPublished and added 7 Oct 2026🛡️ Security

Kubernetes Agent Sandbox is a Kubernetes SIG Apps project that gives each AI agent session an isolated, stateful, single-Pod workspace for running untrusted code. The newsletter explains the Sandbox CRD, SandboxTemplate, SandboxWarmPool, SandboxClaim and Sandbox Router workflow, gVisor and Kata Containers isolation, and suspend/resume and scheduled deletion. It points to a hands-on guide with a Kubernetes troubleshooting agent.

newsletter.devopscube.comarticleAdded 21 Oct 2026, published 7 Oct 2026🧠 AI

Decrypt reports on Google October launch of Nano Banana 2.1, an image generation and editing model built on Gemini, rolling out in the Gemini app, Search AI Mode, Google Ads, Google AI Studio, Flow and Stitch. It claims gains over Nano Banana 2 and Nano Banana Pro in text to image ELO scoring and infographic factuality, supports up to fourteen reference images, four tracked characters, ten objects, 4K output and wide aspect ratios, with Google Search grounding and adjustable thinking time, while developer API pricing drops to roughly half of Nano Banana 2 pricing for a standard 1K image.

decrypt.coarticlePublished and added 6 Oct 2026🧠 AI

Release notes for python-1.20.0 of Microsoft's Agent Framework, an open-source agent/workflow orchestration library. This release adds native vector-store connectors for DuckDB, SQL Server and MongoDB plus a TypeSafe AI connector, redesigns Foundry hosting around request-scoped agent factories and sandbox-isolated sessions, adds computer-use support to Responses clients, and ships Magentic manager and handoff-routing improvements for multi-agent orchestrations alongside a large batch of MCP, Bedrock, Gemini, Anthropic and Ollama provider fixes.

github.comrepoAdded 6 Oct 2026🧠 AI

PEARS is a hybrid reinforcement-learning framework for sample-efficient online adaptation of pretrained tactile-manipulation policies to out-of-distribution conditions. A physics-guided force reasoning (PFR) module uses a vision-language model to diagnose failures from visual and tactile history and update contact-force bounds enforced by a hybrid force-position controller, while a separate tactile-conditioned diffusion-steering component perturbs the latent noise of a frozen flow-matching policy to correct free-space motion and contact timing without retraining the base model. It improves success rates by 12.4-37.4 points over strong baselines in simulation, cuts required interaction episodes by up to 53.2%, and reaches 95%/90% success on real-world whiteboard-erasing and pipette-liquid-aspiration tasks.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

OpenAI describes a research collaboration with Ironclad (contract lifecycle software) to train and evaluate computer-use agents on complex business workflows such as configuring NDAs, procurement approval rules and reusable legal clauses. It covers 11 tasks scored against 8–50 criteria each, hosted Ironclad environments, synthetic training tasks and reinforcement learning. On this research eval GPT-6 Astra (Max reasoning) averaged 55.0% against 41.6% for GPT-5.6 Sol (High reasoning), with estimated time per attempt down from 37.0 to 19.2 minutes. An internal model reached 63.7%. The post also invites other software companies to partner. The results are self-reported, on a non-public eval.

openai.comarticlePublished and added 6 Oct 2026🧠 AI

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

theravenfile.comwriteupPublished and added 6 Oct 2026🛡️ Security

Overmind is an open-source platform (MIT SDK/CLI, AGPL-3.0 platform, self-hostable) that instruments an agent's code via OpenTelemetry tracing, turns the resulting production traces (or any dataset) into a fine-tuned model benchmarked against user-defined eval metrics, and serves it through one unified API with downloadable/retrainable weights. It ships an SDK, CLI, REST API, Console, and an MCP server exposing project tools and workflows (investigate-capability, finetune-capability, ship-model) for Cursor, Claude Code, OpenCode and Codex, and can sync traces from Langfuse, LangSmith, Braintrust or Galileo; self-hosting runs via Docker Compose with Postgres, Redis, Celery workers and Modal-based GPU workers for fine-tuning/serving (vLLM).

github.comrepoAdded 6 Oct 2026🧠 AI

Analysis of CVE-2026-88779 (CVSS v4.0 8.7), an unauthenticated memory-overflow flaw in the nsaaad SAML authentication handler on Citrix NetScaler ADC/Gateway that lets attackers crash the SAML service and lock out VPN/SSO access indefinitely through repeated triggering. Affects NetScaler 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28 (plus FIPS/NDcPP builds); watchTowr Labs reproduced it via honeypot activity, Citrix confirmed targeted in-the-wild exploitation from IP 213.209.159.55, and CISA added it to KEV on 2026-10-04 with an Oct 7 federal remediation deadline. Some researchers suspect the overflow could extend to RCE beyond the documented DoS, though Citrix hasn't confirmed this.

orca.securityadvisoryPublished and added 5 Oct 2026🛡️ Security

ANT (Agent Network Traffic) is a dataset and benchmark for auditing LLM agent behavior from network traffic without inspecting private user content, covering 3,114 execution episodes across 20 tasks and five scenarios, with 276,417 bidirectional flows and 40,049 behavior-primitive segments organized into 47 macro groups. The authors benchmark 13 traffic-analysis baselines on three tasks — agent risk identification, scenario recognition, and behavior primitive classification — finding that methods struggle when malicious workflows mimic benign tasks and when scenarios share similar traffic patterns, while primitive classification works better for frequent, distinctive macro groups than for rare or semantically similar ones.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🛡️ Security

ANT (Agent Network Traffic) is a dataset and benchmark for auditing LLM agent behavior purely from observed network traffic, without inspecting private user content. It contains 3,114 execution episodes across 20 tasks and five scenarios, with 276,417 bidirectional flows and 40,049 behavior-primitive segments grouped into 47 macro categories, and evaluates 13 traffic-analysis baselines on risk identification, scenario recognition, and behavior-primitive classification. Results show existing methods recover useful but uneven signals, struggling especially when malicious agent workflows resemble benign ones or scenarios share similar traffic patterns.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

StepSecurity's investigation of @subql/common@5.8.3, a malicious npm release in the SubQuery Web3 indexing framework's monorepo, found a heavily obfuscated postinstall/import-time payload (base64+XOR+gzip inside a function constructed via Function()) that spawns a detached worker to steal credentials (.npmrc, .env, AWS, SSH, kubeconfig, Vault, cloud secrets), read GitHub Actions runner memory for CI secrets, inject a camouflaged "Run Copilot" GitHub Actions workflow to exfiltrate repo secrets, and provide a remote shell/PTY over an encrypted channel to ci-artifacts.dev. The release was published via a compromised build pipeline: a workflow modification swapped the real build output for an externally downloaded, unsigned tarball from that same C2 domain immediately before publish, and the authors provide IOCs and remediation steps (credential rotation, host isolation, domain blocking).

stepsecurity.iowriteupPublished and added 5 Oct 2026🛡️ Security

GNOME security maintainer Michael Catanzaro details how AI-generated vulnerability reports have transformed GNOME's security workload: CVE counts for GNOME and WebKitGTK rose an order of magnitude, driven largely by AI scanning. He breaks down the now-closed YesWeHack-hosted GNOME Bug Bounty Program (sponsored by Germany's Sovereign Tech Agency) which paid €183,900 for 71 vulnerabilities across libsoup, GLib, and glib-networking, a Red Hat-commissioned AISLE Research AI scan of GLib that found 118 issues with a ~40% false-positive rate (mostly gobject-introspection typelib misclassifications), and a Codean Labs human security audit that found critical Flatpak and xdg-desktop-portal sandbox escapes AI likely would have missed. He argues maintainers should permit AI-generated vulnerability reports in their contribution policies, warns about integer-overflow bugs and Cargo supply-chain risk in Rust, and offers a draft AI-usage policy for GNOME contributors.

blogs.gnome.orgarticlePublished and added 5 Oct 2026🛡️ Security

This paper proposes AI-decision checkpoints, explicit moments in business process development where process developers must evaluate whether to adopt, constrain, or reject AI-candidate sub-processes built with LLMs, RAG, or AI agents, based on expected effects on time, cost, quality, flexibility, and legal or organisational constraints. The checkpoints are embedded in a six-module BPM teaching lifecycle covering process modeling, simulation, workflow execution with AI agents, and process mining, piloted via a fictitious customer-onboarding teaching case with formative observations drawn from instructor logs and student artifacts. It addresses a curriculum gap where AI is still treated as a bolt-on rather than a first-class design element in BPM education.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

GlimpseDNN is a model-agnostic framework that uses a stochastic leakage model to visualize, layer-by-layer, what physical leakage information a deep neural network extracts during profiled side-channel analysis (SCA) to recover secret keys. The authors (Trevor Yap and Shivam Bhasin, NTU) validate it on simulated traces and public datasets (ASCADf, ASCADr, ASCADf_desync50, ASCADf_desync100), showing it can reveal leakages even in deeper network layers when they are not visible in raw traces, with applications to designing more side-channel-resistant hardware.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

Citrix issued emergency patches for CVE-2026-88779, a memory-overflow zero-day in NetScaler ADC/Gateway appliances configured as a SAML service provider or identity provider, rated CVSS v4.0 8.7. Citrix confirmed active, targeted exploitation against unmitigated deployments, with repeated exploitation causing denial of service and disrupting dependent authentication services.

x.comadvisoryAdded 6 Oct 2026, published 5 Oct 2026🛡️ Security

GitLab patched CVE-2026-90970, a critical (CVSS 9.9) flaw in the AI Gateway used by Duo Agent Platform, where a logged-in user with Duo Agent Platform access could craft a flow configuration to escape the prompt template sandbox and achieve arbitrary command execution on the gateway. Only self-managed organizations hosting their own AI Gateway (versions 18.1.6 through 19.1) need to act; the fix lands in 19.2.4, 19.3.2, and 19.4.1. The bug is a template engine weakness (CWE-1336), the same class as the earlier CVE-2026-1868 gateway RCE GitLab fixed in February, and was reported via HackerOne by researcher invisiblemeerkat.

thehackernews.comadvisoryAdded 4 Oct 2026🛡️ Security

A tweet thread recapping Nate Herk's 18-concept guide to running OpenAI's Codex as a non-coder "AI operating system," organized around four pillars: a place to work (projects, AGENTS.md, the agent loop), a place to run it (local vs cloud environments, worktrees, .codex), controls (models, effort, permissions, skills, plugins), and tools/scale (browser, Sites, subagents, scheduled tasks, voice). It highlights AGENTS.md as the ground-rules file that replaces repeated context-setting (Herk ported his Claude Code CLAUDE.md into it), frames reusable "skills" as an iteratively refined recipe, and describes scheduled tasks as the mechanism that injects prompts into sessions automatically for always-on workflows.

x.comthreadPublished and added 4 Oct 2026🧠 AI

ThinkingBox is an agent sandbox and ThinkingBox-Bench is a 507-task stateful business-workflow benchmark (retail, auto insurance, etc.) that grades agents by checking the terminal backend database state and side effects they leave behind, not just whether tool calls succeeded or the final reply sounds right. Across 121,680 trials over 12-18 LLMs run 20 times each, the post finds most failures are clean-looking: 67% of failed trials still terminated without a tool error, yet executable checks caught wrong field values, missing effects, or unintended extra effects. It also reports pass@1 vs. 20/20 consistency gaps (e.g. Kimi K3 solves the most tasks at least once but is among the least consistent, while Claude Opus 5 and Claude Opus 5.5 are the most dependable) and cost-per-success/cost-per-dependable-task metrics, and ships the benchmark through an OpenEnv interface for reproducible evaluation.

huggingface.coarticlePublished and added 3 Oct 2026🧠 AI

GitHub release notes for Sigma r2026-07-01, the open-source detection-rule repository, adding 20 new rules (e.g. LSASS crash via Netlogon buffer overflow CVE-2026-41089, TanStack supply-chain attack indicators for Windows/Linux, RedTail cryptominer user-agent detection, AF_ALG kernel crypto API exploit indicator) and updating/fixing dozens of existing rules for ARM64 binary variants, file-sharing domain IOCs, and WMI-based reconnaissance/persistence detection. It's a routine but substantive update to a widely-used blue-team detection content pack.

github.comrepoAdded 3 Oct 2026🛡️ Security

A curated Twitter/X thread listing ten GitHub repos that extend Claude Code and Codex workflows: spec-forcing planning/testing skills (obra/superpowers, mattpocock's skills with grill-me/diagnose/handoff), session memory compression (thedotmack's claude-mem-style tool), codebase-to-graph querying (safishamsi/graphify), a spec-driven long-task workflow (gsd-build), scope-reduction and anti-fluff skills, a cross-tool harness spanning Claude Code/Codex/OpenCode/Cursor (affaan-m/ECC), a multi-role agent team setup (garrytan/gstack), and a local model-routing gateway (musistudio's claude-code-router). Each entry is a practical, installable tool aimed at making coding agents more disciplined, memory-aware, and cost-efficient.

x.comthreadPublished and added 3 Oct 2026🧠 AI

Release notes for Microsoft's Agent Framework (Python and .NET SDKs), covering versions python-1.16 through python-1.20 and dotnet-1.19 through dotnet-1.23. Changes span native vector-store connectors (MongoDB, Qdrant, PostgreSQL/pgvector, DuckDB, SQL Server, Azure Cosmos DB, Azure AI Search), Foundry hosting redesigns around request-scoped agent factories and durable Invocations, MCP skill/session security hardening (approval binding, security labels, ZIP-only skill archives), Magentic multi-agent orchestration and handoff routing, and checkpoint/replay correctness fixes across workflows.

github.comrepoAdded 2 Oct 2026🧠 AI

MobiAgent is a dual-loop agentic framework for long-horizon mobile manipulation that separates deployment execution from policy self-improvement. An Inner Loop uses vision-language models for receding-horizon planning and visual reflection to compose atomic skills executed by flow-matching experts sharing a unified VLM backbone, while an Outer Loop autonomously segments, verifies, and clusters deployment rollouts to discover new atomic skills and continuously fine-tune the skill library without human annotation. On BEHAVIOR-1K it beats pi_0.5-TA by 22.5 percentage points, and autonomous data recycling raises RoboCasa success from 7.50% to 27.50% and Astribot S1 success from 32.5% to 57.5%.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🧠 AI

Gato (GitHub Attack Toolkit) from Praetorian is a Python CLI for enumerating and attacking GitHub organizations' CI/CD pipelines: it identifies poisoned pipeline execution risks, abuses self-hosted runners via workflow and run-log analysis, exfiltrates Actions secrets, and automates fork-PR/workflow-based command execution. Version 1.7 added an Actions Artifacts Secrets Scanner that downloads and recursively scans workflow artifacts with NoseyParker, which Praetorian used to find critical secrets leaks in prominent open-source projects. The project is now archived/superseded by Praetorian's multi-platform tool Trajan, which merges Gato (GitHub) and Glato (GitLab) attack capabilities.

github.comtoolPublished and added 2 Oct 2026🛡️ Security

TATS is an open-source Python tool that analyzes OAuth 2.0, OpenID Connect, and Microsoft Entra ID tokens. It helps security researchers trace authentication flows, identify risky permissions granted to tokens, and visualize token lifecycles for identity security review and investigation work.

x.comtoolPublished and added 2 Oct 2026🛡️ Security

A Twitter thread recapping a "forward-deployed engineer" (FDE) talk on AI transformation methodology: find the real process a company runs (not the one it documents) by interviewing veteran staff and embedding engineers in the system of record, then sort every step into four buckets — delete, deterministic code, agentic (judgment plus exception history), or human-in-the-loop (payment, signing, negotiation). It argues most deployed workflows don't need frontier models — benchmark each workflow against cheap tiers and open-weight models like GLM, Kimi and Qwen, plus Grok, and let evals decide — and that agents should live inside existing systems of record like Salesforce/Slack rather than requiring migration to new AI-native tools. Cites a concrete case: a $5B-market-cap company's "seven-step" quote-to-cash process turned out to have twenty steps and seven loops, and after the rework cycle time dropped from 24 to 6 days and invoice straight-through processing rose from 18% to 87%.

x.comthreadAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

Release notes for v2.2.0 of the official Model Context Protocol TypeScript SDK. Upgrade notes: machine-to-machine OAuth providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider) should now be given expectedIssuer, and fetchToken() throws AuthorizationServerMismatchError when client information is bound to a different authorization server. listTools/listPrompts/listResources/listResourceTemplates now follow nextCursor automatically, capped by listMaxPages. Fixes include CommonJS type-checking of the DPoP jose types, unhandled rejections in Client.listen(), createMcpHandler stack overflow and subscriptions/listen handling, .localhost loopback for OAuth token endpoints, and v1-to-v2 codemod comment preservation.

github.comadvisoryAdded 1 Oct 2026🧠 AI

UniWAM is a unified architecture that combines a physical reasoner, a world generator, and an action predictor to jointly learn semantic understanding, visual generation, and action prediction for embodied agents, bridging vision-language-action (VLA) models and world-action models. It uses a data cleaning/annotation pipeline for human egocentric and robot data, represents low-level actions in natural language for VQA/egocentric/robot co-training, and introduces future visual noise augmentation plus history-conditioned flow matching to cut denoising steps while achieving state-of-the-art results on in-distribution performance, robustness, generalization, instruction following, and long-horizon tasks. The paper also reports a log-linear scaling law for unified human-robot co-training.

arxiv.orgpaperAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

A tweet describing Google's RRSI (Regularized Recursive Self-Improvement of Agent Harnesses), a framework that automatically evolves all non-model components of an LLM agent — prompts, control flow, tool use and memory — while keeping the underlying LLM weights frozen. The "regularized" aspect suggests constraints added to recursive self-improvement loops to keep the evolved harness stable or bounded, distinguishing it from unconstrained self-modifying agent approaches.

x.comthreadPublished and added 1 Oct 2026🧠 AI

Snyk argues AI coding agents reliably write broken access control (BOLA/IDOR, OWASP's top category since 2021) because the facts needed to add an ownership check — what an object belongs to, who may access it, where tenant boundaries sit — are tacit product knowledge that exists nowhere in the code or prompt an agent sees. It explains why SAST tools catch patterned sub-categories like path traversal or SSRF but structurally cannot catch CWE-639/862/863 (missing or incorrect authorization), since there's no bad pattern to match, and proposes reasoning over an assembled "application-context graph" of architecture, data flows and trust boundaries instead. It closes with a five-step team checklist (inventory ID-accepting endpoints, document ownership rules, add authorization-specific PR review, write cross-tenant tests, run deep contextual analysis) and pitches Snyk's Evo Agentic AppSec as the tool built around that approach.

snyk.ioarticlePublished and added 1 Oct 2026🧠 AI

DFIR.ch field notes on an incident where attackers used Ricardo J. Ruiz's TrickDump tool to dump LSASS without creating a conventional minidump file, instead leaving lock.json, shock.json, barrel.json and a ZIP of randomly-named memory-region chunks. The authors reconstructed the dump with TrickDump's create_dump.py and parsed it with pypykatz, confirming the attacker actually recovered reusable Kerberos credential material rather than just detecting that LSASS was touched. Includes hunting guidance (Sysmon EID 10 process-access telemetry, SeDebugPrivilege enablement, multi-binary workflows) and notes TrickDump fails against LSASS protected by PPL.

dfir.chwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Reversecore MCP is an MCP server that exposes authorized reverse-engineering, malware-analysis, forensics, and SAST-style tooling to an AI agent through selectable profiles, returning structured results for a given binary sample. It targets the gap between hand-driving tools like radare2 and paying for a commercial IDA Pro-based workflow, letting an agent query a toolchain directly instead of a human operator switching between tools.

x.comtoolAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Unit 42 threat brief on CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) in NetScaler ADC and Gateway, both CVSS v4.0 9.5 and exploited as zero-days from August 2026. It details version fingerprinting, .deb and PHP web shells, a three-stage log-poisoning chain through ns_monuploadd_err.pl, httpd.conf persistence, IOCs, and 50,277 exposed instances as of 27 September 2026.

unit42.paloaltonetworks.comadvisoryAdded 30 Oct 2026, published 30 Sep 2026🛡️ Security

AI-Infra-Guard (A.I.G) is Tencent Zhuque Lab's open-source AI red-teaming platform combining AI infrastructure vulnerability scanning (2000+ CVE rules covering vLLM, llama.cpp, LangFlow, n8n, MLflow and 145+ other AI components), MCP server/skill security scanning, LLM API poisoning detection, and multi-turn jailbreak evaluation (Many-Shot, PAIR, GOAT, ActorAttack). It ships CLI tools (skill-scan, mcp-scan, agent-scan), a Docker-deployed web UI, and has produced original research including FORGE-Bench (loss-of-control benchmark), RogueHandoff-20, and SkillJack (persistent skill backdoors), with talks at Black Hat Europe 2025 on MCP security.

github.comrepoAdded 30 Sep 2026🛡️ Security

Multimodal Flow (MF-1) is a fully continuous generative model that unifies language and vision modeling by representing both text and images as ordered continuous "hyperchunks" processed through a single shared chunk-causal Flow Matching backbone, avoiding the visual quantization bottleneck of discrete-token unified models and the mismatched objectives of hybrid discrete/continuous approaches. Joint attention handles cross-modal interaction while modality-specific feed-forward networks process each modality, and the model predicts multiple chunks in parallel during training but generates sequentially at inference. Pretrained at 0.6B/1.2B/1.6B scales on 150B tokens, MF-1 scores 82.8 average on GenEval/DPG-Bench and 75.3 on VQAv2/MMBench/POPE, remaining competitive with unified models trained on far more data and outperforming matched hybrid/discrete baselines; code and model are publicly released.

arxiv.orgpaperAdded 1 Oct 2026, published 30 Sep 2026🧠 AI

Wiz Research examined the source repositories and CI/CD pipelines behind 1,500 popular Helm charts on Artifact Hub (mapping to 814 unique GitHub repos) and found 61 repos (7.5%) with confirmed supply-chain risk, including 20 charts with CI/CD workflow weaknesses and 25 depending on unmaintained/archived upstream projects. Two disclosed findings illustrate the risk classes: KubeView's go.mod referenced a Go module under a GitHub username that didn't exist, making it hijackable by anyone who registered the name, and Meilisearch's Helm chart repo had a GitHub Actions workflow triggered by PR comments that injected the commenter's branch name into a shell command while skipping author-association checks, letting any GitHub user run commands with a bot token that had push access. The post then pivots to promoting WizOS Helm Charts, Wiz's hardened/signed/CVE-scanned chart catalog built to close these gaps.

wiz.ioarticlePublished and added 30 Sep 2026🛡️ Security

Orca Security's plugin connects ChatGPT and Codex to Orca's MCP server, letting security teams and developers query cloud alerts, attack paths, effective IAM permissions, and code-to-cloud origins directly from chat or a coding agent instead of logging into a console. The post walks through six security-team use cases (exposure discovery, CVE impact triage, alert-to-blast-radius investigation, identity permission review, CISO reporting) and three developer workflows in Codex where alerts are traced back to the Terraform/code that created the misconfiguration and fixed in place.

orca.securityarticleAdded 2 Oct 2026, published 30 Sep 2026🛡️ Security

AINews daily digest covering OpenAI DevDay 2026: the launch of 'dots' (always-on GPT-6 Astra-powered agents with app/Slack/Teams connectivity), GPT-6.1 Sol (a cheaper 'near-Astra' model at $2/$10 per M tokens), Ultrafast inference mode, a new Decisions API for fast classification/routing on GPT-6 Luna, ChatGPT Spaces/Pages, and a B2B model marketplace via Baseten. It also rounds up independent evals (Artificial Analysis, planted-bug tests, Roboflow vision benchmarks) comparing GPT-6.1 Sol against Claude Opus/Sonnet 5.5, plus safety/eval-integrity stories (scrapped GPT-6.1 Astra, evaluation awareness, GLM-5.3 cyber capability), agent infrastructure research (DeepSeek DSec sandboxing, StepFun KITE, vLLM day-0 support), and industry news (Anthropic's IPO filing, Hugging Face acquisition by NVIDIA).

latent.spacearticlePublished and added 30 Sep 2026🧠 AI

Google Threat Intelligence Group analyzes vulnerability disclosure and exploitation trends from January 2025 to August 2026, finding disclosures doubled, exploitation nearly doubled, and AI-assisted discovery surfaces proportionally more Medium and High-risk flaws, with 50 percent leading to remote code execution versus 26 percent baseline. It documents real-world exploitation of an AI-discovered CVE in BeyondTrust PRA and a surge in vulnerabilities targeting the AI/LLM operational stack, especially agent orchestration frameworks like Langflow and Flowise and inference gateways like LiteLLM and vLLM, citing specific CVEs in those products.

cloud.google.comarticleAdded 8 Oct 2026, published 30 Sep 2026🛡️ Security

Simon Willison quotes Anthropic's Frontier Red Team report "GLM-5.3 and the spread of advanced cyber capabilities," which ran several models against 100 randomly-selected tasks from an internal Binary Exploitation benchmark. GLM-5.3 produced full control-flow hijack exploits in 4% of trials and Claude Mythos Preview in 6%, while earlier models (Claude Opus 4.6, GLM-5.2) succeeded in none — marking what Anthropic frames as a newly crossed capability threshold for AI-assisted exploit development.

simonwillison.netarticleAdded 30 Sep 2026, published 29 Sep 2026🛡️ Security

A quoted excerpt from Anthropic's Frontier Red Team report on GLM-5.3 finds that, across 100 randomly selected tasks from an internal Binary Exploitation benchmark, GLM-5.3 achieved full control-flow hijacks in 4% of trials and Claude Mythos Preview in 6%, while earlier models (Claude Opus 4.6, GLM-5.2) succeeded in none. Anthropic frames this as a meaningful threshold crossed in advanced cyber capability, part of ongoing frontier-model dangerous-capability evaluation.

simonwillison.netwriteupPublished and added 29 Sep 2026🧠 AI

This paper shows that adding an adversarial loss as a post-training correction to pretrained pixel diffusion/flow-matching models (applied at non-high-noise timesteps, architecture and sampler unchanged) restores missing high-frequency, fine-scale natural-image statistics that these models systematically underproduce. Through frequency-band/power-law analysis and nearest-neighbor, recall, and no-GAN matched-SFT controls, the authors rule out memorization or mode-dropping as explanations, and show the effect jointly improves distribution fidelity, coverage, prompt alignment and perceptual quality — but does not transfer comparably to latent diffusion configurations, pointing to direct pixel-output access as the key enabling factor.

arxiv.orgpaperAdded 30 Sep 2026, published 29 Sep 2026🧠 AI

Rho is a family of open-weights vision-language-action (VLA) models for bimanual robotic manipulation, designed for data-light adaptation across three dual-arm embodiments (YAM Box, UR AI Trainer, FR3 Duo). The paper ablates the action-expert architecture and training recipe, showing that "embodiment midtraining" improves downstream adaptation, and introduces an internal latent policy that learns from as few as 15 corrected episodes to steer a frozen flow-matching action expert toward out-of-distribution task situations. The authors release base and embodiment-specific checkpoints, positioning Rho as both a strong general-purpose manipulation model and a practical foundation for efficient adaptation.

arxiv.orgpaperAdded 30 Sep 2026, published 29 Sep 2026🧠 AI

Anthropic's Frontier Red Team analyzes GLM-5.3, an open-weight model from Zhipu AI (Z.ai), finding it matches Claude Mythos Preview's exploit-development capability (50/410 vs 56/410 end-to-end exploits on ExploitBench against Chrome's V8 engine; 4% vs 6% full control-flow hijacks on an internal OSS-Fuzz binary exploitation benchmark) but ships with safeguards attackers bypass 64-100% of the time via prompting tricks, prefill, or "abliteration" of the open weights. The post documents a researcher using GLM-5.3 to chain previously unknown JavaScript-engine vulnerabilities into a working browser file-read exploit, and GLM-5.3-Flash autonomously building a reliable ARM64 PAC-bypass exploit chain for CVE-2026-11645 for about $20. It argues GLM-5.3's lack of meaningful safeguards marks a step change in freely accessible offensive cyber capability and calls for independent government safety testing of such open-weight models.

anthropic.comarticleAdded 2 Oct 2026, published 29 Sep 2026🛡️ Security

Simon Willison's minute-by-minute live blog of OpenAI's DevDay 2026 keynote and breakout sessions in San Francisco, covering the launch of "dots" (personal ChatGPT agents styled like Meta's Muse), the new GPT-6.1 Sol model, an "Ultrafast" 8x-speed inference tier, a Decisions API for near-instant model responses, ChatGPT Spaces/Sites, Codex Security Cloud (with an open-source Codex Security CLI and automated patch/verify-fix workflow), a GPT-Live voice-agent demo, and a closing Q&A with Sam Altman and Thibault Sottiaux touching on agent-to-agent communication, pricing philosophy, and the future of coding. It's a dense, well-sourced snapshot of a major platform's simultaneous product, model, and infrastructure announcements.

simonwillison.netarticlePublished and added 29 Sep 2026🧠 AI

Analysis of two CVSS 9.5 Citrix NetScaler ADC/Gateway zero-days, CVE-2026-88771 (unauthenticated RCE through improper input validation in the management interface, affecting default deployments) and CVE-2026-88772 (memory overflow in DTLS, enabled by default on VPN virtual servers). It lists six more high-severity flaws patched in advisory CTX697096, the affected and fixed versions, and the CISA KEV listing with a federal deadline of 2026-09-30. It advises checking for compromise before patching, since patching can destroy forensic evidence, and gives response steps: isolate, revoke credentials, rebuild firmware, rotate keys and certificates.

orca.securityadvisoryPublished and added 29 Sep 2026🛡️ Security

watchTowr Labs reverse-engineers CVE-2026-88772, a preauth DTLS memory overflow in Citrix NetScaler ADC/Gateway's nsppe binary, exploited in the wild as a zero-day and fixed in Citrix bulletin CTX697096. The writeup walks through patch diffing between build 14.1-73.30 and 14.1-73.37, crafting malicious DTLS handshake fragments that trick NetScaler's reassembly logic into copying about 174KB of NSB chain data into a 35,840-byte scratch buffer, and the full exploitation path from crash to a fake-vtable hijack, ROP-based mprotect call, and shellcode execution, plus a public detection artefact generator.

labs.watchtowr.comwriteupAdded 1 Oct 2026, published 29 Sep 2026🛡️ Security

A research writeup from Multiverse Computing introducing ProvenanceGuard, a post-generation verification layer for MCP-based LLM agents that checks not just whether a claim is factually supported somewhere in retrieved evidence, but whether it is attributed to the correct source tool or document, a failure mode they call cross-source conflation. Using local models (MiniLM for source routing, a DeBERTa NLI verifier, and a local LLM for claim decomposition) plus a RARR-style repair loop, it was evaluated on 281 real MCP traces from a medical agent, catching 138 of 139 unsupported claims flagged by human experts and correctly identifying the exact source about 86% of the time on held-out data, outperforming four source-blind baseline checkers. The method has already been adopted in NVIDIA's NVFlow finance-agent grounding stage.

huggingface.cowriteupPublished and added 29 Sep 2026🧠 AI

Multiverse Computing's blog introduces ProvenanceGuard, a post-generation verification layer for MCP-based LLM agents that checks not just whether a claim is factually supported somewhere in retrieved evidence, but whether it is attributed to the correct MCP source — catching a failure mode they call cross-source conflation (e.g., a refund-policy fact wrongly attributed to an account record). The pipeline decomposes answers into claims, routes each to its most relevant source (MiniLM), scores support with a DeBERTa NLI model, checks source attribution, and can trigger RARR-style repair or fallback for blocked answers. On a 361-claim medical-agent benchmark it caught 138/139 claims that should be blocked, detected all 50 injected source-swap errors, and the approach has already been adopted in NVIDIA NVFlow's finance-agent grounding stage.

huggingface.coarticleAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

After attackers stole $388M from Bitget, they tried routing $50M+ through the cross-chain swap service NEAR Intents; its SHIELD system — which ingests KYT and intelligence-provider signals to flag deviations in flow — froze roughly $503,000 mid-swap while $166,000 slipped through. The piece contrasts this with THORChain's refusal to block the same attacker addresses, letting $6.3M complete ether-to-bitcoin swaps, and details the resulting debate over whether a "permissionless" protocol can hold user funds without a defined process for release or appeal.

coindesk.comarticleAdded 30 Sep 2026, published 29 Sep 2026🛡️ Security

A Latent Space podcast interview with Thariq Shihipar, Anthropic's Claude Code lead, covering the evolution of Claude Code's harness: Ask User Question and elicitation, artifacts as persistent generative interfaces, the cloud-brain/local-hands split, Claude Tag for multiplayer agent workflows, Claude Projects, effort levels, implementation notes, and the new Claude Mods system for customizing the execution loop. It also covers why prompting remains a high-skill discipline, why Claude.md may eventually disappear, and closes with a discussion of agent security incidents (Exploit-Bench, agents hacking Hugging Face for scorer code, sandbox/infrastructure exploit chaining) framed around Anthropic's "Pacing the Frontier" argument, plus constitutional classifiers, probes, and Auto Mode.

latent.spacetalkPublished and added 29 Sep 2026🧠 AI

GitHub Security Lab describes the architecture behind its open-source "Taskflow Agent," a set of YAML-defined prompt workflows (e.g. gather_mobile_entry_point_info.yaml, classify_application_local.yaml) that guide an LLM through structured, multi-step code audits rather than a single free-form prompt. Using these taskflows on Android apps via GitHub Copilot, the team found 24 vulnerabilities, including a location-tracking bug in OsmAnd via exported-activity intent extras and a cookie-leaking account-takeover chain in the Wikipedia app via a deeplink hostname-parsing flaw. The post's more durable contribution is its analysis of LLM auditing behavior: strong at recognizing API-level unsafe patterns and generating working PoCs, but unreliable at severity estimation and prone to false positives from mitigating factors the model doesn't account for, requiring human review and repeated/guided runs.

github.blogarticleAdded 8 Oct 2026, published 28 Sep 2026🧠 AI

GitHub Security Lab describes custom "taskflow" prompts built on their open-source Taskflow Agent to hunt Android app vulnerabilities, reporting 24 findings to date. It walks through two concrete chains: an exported, unprotected MapActivity in OsmAnd that lets any app silently import settings and exfiltrate the user's exact map tile/route coordinates to an attacker server, and a hostname-parsing logic bug plus overly loose cookie-domain check in the Wikipedia Android app that lets a wikipedia:// deeplink load an attacker page (e.g. evil-wikipedia.org) and steal long-lived session cookies for account takeover. The post also candidly notes where LLMs struggle (false positives, mis-estimating severity, missing mitigating factors) versus where they excel (deep knowledge of safe/unsafe API patterns).

github.blogwriteupAdded 7 Oct 2026, published 28 Sep 2026🛡️ Security

UMM-Reflection is a reinforcement learning method that trains a unified multimodal model to jointly learn reflection text and image revision within a single closed loop: diagnose an image's flaws, revise it, observe the result, and repeat. Sibling trajectories sharing one initial image enable a group-relative advantage that compares whole reflection strategies rather than assigning credit per round, and one trajectory-level advantage updates both the reflection tokens and the flow-based revision head jointly, unlike SFT cold-starts or RL that optimizes only the renderer. On BAGEL, it improves GenEval by 12.05 points over SFT and transfers to unseen benchmarks WISE, OneIG-Bench and T2I-CompBench++, with no external verifier needed at inference.

arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026🧠 AI

This arXiv paper introduces a unified theoretical framework for "distributional training" in one-step visual generation, showing that existing methods like FD-Loss and Gaussian-kernel Drifting are special cases of Gaussian optimal transport and kernel-density KL matching under Wasserstein gradient flow. Building on this, the authors propose MGFlow, which models feature distributions with Gaussian mixtures at adjustable granularity and combines mass-constrained sample assignment with paired component updates to fix mode collapse. MGFlow sets new state-of-the-art FDr scores on ImageNet 256×256 (1.45 on pMF-H, 1.64 on JiT-H) and post-trains FLUX.2 into a one-step generator that beats the original four-step model on GenEval and PickScore.

arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026🧠 AI

Peppy is an AI-assisted workflow that uses LLMs with domain-specific knowledge of optimization theory to discover tight, analytic convergence proofs for first-order optimization algorithms, verifying results through SymPy rather than a full proof assistant like Lean 4. The authors demonstrate the approach by closing several open problems in convergence analysis, including conjectures about Nesterov's Fast Gradient Method (FGM), positioning the workflow as a more structured, domain-specialized alternative to generic LLM-for-math-research pipelines.

arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026🧠 AI