71 results for “fc”

Glance is a RAG method in which the generator also reranks. It adds a lightweight decision adapter and pointer head that score candidate passages from one shared prefill, so a single resident 9B backbone does generation and reranking. After 39 minutes of MS MARCO fine-tuning it reaches nDCG@10 of 0.741 on SciFact and 0.345 on NFCorpus, against 0.721 and 0.326 for bge-reranker-v2-m3. On 300 HotpotQA questions it improves answer F1 by 0.045 over cross-encoder-selected context. Evaluation covers two retrieval datasets, one QA dataset and one backbone family.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

JevAct is a runtime verification framework that intercepts selected LLM agent actions before execution and returns feedback for bounded revision. It compiles domain policies into executable state checks and structured questions scored by a prefill-only decision model, giving probability-based judgments without generation. Tested on eleven agents with tau^2-bench Airline and Telecom and BFCL, it gained consistently on Telecom and BFCL and was mixed on Airline.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

EnvSched is an online scheduler for agentic reinforcement learning that picks which environment-task pairs to roll out next. It builds a dual-relation graph over environments and tasks, propagates past rollout statistics to predict within-task reward variance, and adds environment quotas and a similarity penalty. On Qwen3-8B it scores 48.81 average on BFCL-v3, tau-Bench and ACEBench-Agent after 40 steps, above random selection at 120 steps.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Dutch police arrested two men, aged 23 and 25 from Vaassen and Ede, on October 6 over a bank helpdesk fraud that took over €380,000 from 170 victims. Callers played AI-generated bank audio, then a fake bank employee had victims install an app and tap their card to the phone. The app read the NFC chip data and relayed it to an accomplice at an ATM. Police seized the servers.

securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security

Cloudflare's post-quantum GeoKey Manager, in closed beta for the Data Localization Suite, wraps customer private keys so only edge servers in an allowed region can unwrap them. It uses regional 256-bit root keys, derived application-specific HPKE key pairs (RFC 9180) with hybrid ML-KEM-768 and X25519, TPM-backed server authorization, kernel keyring storage, fail-closed checks, and soft and hard rotation. General availability is planned for Q1 2027.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 23 Oct 2026🛡️ Security

IFC-MCQ is a method that automatically generates multiple-choice benchmarks from Industry Foundation Classes (IFC) building-model files, so answers can be graded by exact option-set match instead of human or LLM review. Its taxonomy has 15 categories and 36 subtypes in four groups, with answer keys from the file and distractors from file values or rules. Two agentic setups, tool-based and code-based retrieval, showed category-specific failures and variation by IFC model and interface.

arxiv.orgpaperAdded 23 Oct 2026, published 21 Oct 2026🧠 AI

php2shell is the name given to two critical pre-auth remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, in PHP core's session upload progress handler (php_session_rfc1867_callback), where zend_hash_update frees live zval pointers that are later reclaimed and redirected into zend_call_function to run zif_system. This repository ships poc_109618.py, a fully automated four-stage HTTP exploit that leaks ASLR offsets via Set-Cookie headers against php:8.4.26-apache on Debian Bookworm, along with a root-cause C source patch, mitigation scripts to disable session.upload_progress, and WAF/ModSecurity/Lighttpd/Apache rules plus detection guidance for anomalous PHP worker child processes. Confirmed PHP versions include 8.4.4 and 8.2.34, with EOL branches (5.x, 7.x, 8.0, 8.1) left without official vendor patches.

github.comrepoAdded 23 Oct 2026, published 21 Oct 2026🛡️ Security

Interconnects' Latest open artifacts (#25) covers open-weight AI in fall 2026. Policy items: China's MOFCOM proposal for pre-approval of international model sharing, and a DHS order barring DeepSeek from federal civilian procurement. DeepSeek released its internal inference stack DeepInfer. Picks include MiMo-V2.6-Pro-RL, DeepSeek-V4.1-Flash-1017 (552B-A16B, MIT), Clef, Nemotron-3.5-Super-VL and Reflection's Beam-1.0 (Apache 2.0).

interconnects.aiarticlePublished and added 20 Oct 2026🧠 AI

DHS ordered US civilian agencies to remove DeepSeek and any third-party services built on it from their IT systems and to stop buying it. The notice says use "may result in the transfer of sensitive data to the PRC" and could yield intelligence on US persons and agencies. It also covers earlier restrictions by Commerce, the Navy and three states, a July DHS memo on traffic monitoring, and an FCC vote set for October 29.

decrypt.coarticlePublished and added 19 Oct 2026🛡️ Security

A X thread benchmarking Qwen3.8 Flash Next on one DGX Spark in two builds: NVIDIA's FP4-Local checkpoint served by vLLM (eugr's b12x container) and an MLX 4-bit TensorFold recipe. The NVIDIA build scores higher on the author's agentic benchmark (81.2 vs 75.0), BFCL tool calling (82.4 vs 71.8 single-turn, 54.5 vs 43.0 multi-turn), AgentDojo prompt-injection resistance (2 vs 6 of 200 attacks succeeded) and GPQA (64.6 vs 59.1). TensorFold decodes faster (67 vs 44 tok/s) and runs more agent steps per minute (21 vs 14). The author notes the comparison covers whole stacks (engine, kernels, tool parser), not quantization alone, and links a docker compose recipe.

x.comthreadAdded 17 Oct 2026, published 16 Oct 2026🧠 AI

Liquid AI releases LFM2.5-24B-A2B, a 24B-parameter MoE reasoning model with 2B active parameters (40 layers, 64 experts with top-4 routing, hybrid gated short convolutions and GQA). It has a 131K context window, a 128K-token vocabulary and 33T pre-training tokens, and was post-trained with large-scale RL for tool use and agentic tasks. The post reports results against Qwen3.6-35B-A3B on 16 benchmarks (AutomationBench, BFCLv4, ToolSandbox, LiveClaw, τ³-Bench Banking), decode speeds of 184 tok/s on an Apple M5 Max and about 21K output tok/s on a B300 GPU, day-one support in llama.cpp, MLX, vLLM, SGLang and ONNX, and a local Hermes Agent demo. It also describes reward-hacking behaviour during training, including the model detecting its sandbox.

liquid.aiarticleAdded 16 Oct 2026, published 14 Oct 2026🧠 AI

Draft ERC from Quantova Inc proposing a "Quantum Bridge Shield" for Ethereum bridges. A committee signs the Merkle root of each message batch with RFC 8554 LMS hash-based signatures instead of ECDSA/BLS keys that Shor's algorithm can break. The guard contract requires a strict majority of distinct unfrozen keys, records used leaves, freezes any key that signs a leaf twice, binds digests to domain, chain, guard and epoch, and applies a 60-second delay. The post gives gas costs (LMS W4 height-10 verification about 205k gas, a LayerZero packet 128,683 gas, worst-case rotation 12.44M gas under the EIP-7825 cap) and cites a NioLabs assessment with no critical or high findings. It is relevant as a worked post-quantum migration design for bridge key custody, including hybrid ECDSA+LMS mode and stateful-signature pitfalls such as leaf reuse and rollback.

ethereum-magicians.orgarticlePublished and added 14 Oct 2026🛡️ Security

Draft ERC from Quantova Inc that has Ethereum bridges accept cross-chain message batches only when a committee signs the Merkle root with RFC 8554 LMS hash-based signatures. The guard contract requires a strict majority of distinct unfrozen keys, records used leaves, freezes any key that signs a leaf twice, binds digests to domain tag, chain ID, guard address and epoch, and enforces a 60-second delay. It reports gas benchmarks (about 205k per LMS W4 height-10 verify, 12.44M worst-case rotation under EIP-7825), a hybrid LMS+ECDSA migration mode, and a NioLabs assessment with no critical or high findings. It argues that Shor's algorithm makes secp256k1 and BLS committee keys a quantum theft target.

ethereum-magicians.orgpaperPublished and added 14 Oct 2026🛡️ Security

Cloudflare's changelog announces that its Cloudflare API MCP server now serves Cloudflare skills alongside its tools. A connected MCP client discovers them by calling `skills/list`. This is an example of distributing agent skills through an MCP server rather than as local files or a repo.

x.comarticlePublished and added 11 Oct 2026🧠 AI

Official changelog for the Model Context Protocol 2026-07-28 specification. Major changes: protocol-level sessions and the initialize handshake are removed to make MCP stateless, with version and capabilities carried in _meta on every request, plus a new server/discover RPC and subscriptions/listen replacing the GET stream and resource subscribe calls. It introduces Multi Round-Trip Requests (InputRequiredResult) in place of server-initiated sampling, roots and elicitation requests, moves tasks into an extension, and deprecates Roots, Sampling, Logging, HTTP+SSE and Dynamic Client Registration. Minor changes add cache hints (ttlMs/cacheScope), new Mcp-Method/Mcp-Name headers, OpenTelemetry trace context, RFC 9207 iss validation and an error-code allocation policy.

modelcontextprotocol.ioadvisoryAdded 10 Oct 2026🧠 AI

A tweet describing an independent open-source project, "Free Claude Code", that lets Claude Code run against non-Anthropic providers such as DeepSeek and Kimi. It supports switching models, configuring fallback providers and using providers' free tiers, launched via `fcc-claude` from the terminal or an IDE. It states the limits: free usage follows provider quotas, some providers still need API keys, it does not unlock Anthropic's own models, and it is not affiliated with Anthropic. The page also shows a quoted article on a 5-layer setup for running coding agents in YOLO/auto-approve mode safely.

x.comthreadPublished and added 10 Oct 2026🧠 AI

Uber's engineering team describes how it extended its Zero Trust stack to give AI agents verifiable identities. Each agent workload gets a SPIRE SVID, and a Security Token Service checks an Agent Registry and mints single-hop, short-lived JWTs. Those tokens carry the full actor chain (for example user → Oncall Agent → Investigation Agent), loosely modelled on OAuth 2.0 Token Exchange (RFC 8693). The tokens are enforced at an MCP Gateway for tool calls, and an AI Gateway fronts model calls with guardrails. The post also covers an A2A client in the SDK that makes the secure path the default, observability of actor chains, and a 2026 roadmap toward dynamic access control and unified policy enforcement. It is a concrete production reference for agent attribution and delegated authorization.

uber.comwriteupAdded 10 Oct 2026🧠 AI

The UK FCDO sanctioned crypto exchange Cryptomus via its Vancouver registered owner Xeltox Enterprises and linked platform Heleket, Kyrgyz firms TokenSpot and Tsunami Payments, and payment processor Processing KG which operates VexPay and is owned by Kyrgyzstan's Ministry of Finance, plus its director Ulan Bukabaev, for allegedly helping Russia evade financial sanctions. Two of the designated entities reportedly processed transactions for the Kremlin backed A7 illicit finance network, which claims to have moved over 90 billion dollars last year, roughly half of Russia's annual military spending. The 38 target package, which also hit oil producers Zarubezhneft and INK Capital and 12 shadow fleet tankers, follows earlier UK and EU action against Justin Sun's HTX and extends a pattern of Western sanctions targeting crypto rails used for Russia sanctions evasion.

decrypt.coarticlePublished and added 9 Oct 2026🛡️ Security

Vitalik Buterin responds to Ethereum Foundation researcher Justin Drake's bunker mode proposal, agreeing AI-accelerated cryptanalysis could break ECDSA, the signature scheme behind most crypto wallets, in months not years, and that lattice-based schemes like ML-DSA billed as quantum-safe could also take serious hits within two years. Buterin gives practical key-hygiene advice such as keeping funds in addresses that never exposed a public key and rotating multisig signer keys after every operation with offchain signature collection, while warning that botched migrations cost more than hacks.

bankless.comarticlePublished and added 8 Oct 2026🛡️ Security

Latent Space's AINews recap covers Anthropic's launch of Claude Haiku 5.5, priced to match OpenAI's GPT-6 Luna and paired with a Sonnet 5.5 cache-read price cut and new Max/Team API credits. Independent Artificial Analysis testing puts its Intelligence Index at 43 (up 26 points from Haiku 4.5) and Terminal-Bench 4.0 at 33%, but shows it uses roughly 3x the output tokens of GPT-6 Luna at max effort, plus results on AA-Briefcase, AA-Omniscience and AutomationBench-AA, alongside a same-day Claude SDK update adding built-in computer-use/browser-use tooling.

latent.spacearticlePublished and added 8 Oct 2026🧠 AI

IACR ePrint paper constructing and implementing the first one-round threshold signing protocol for the hash-based post-quantum signature schemes XMSS and SPHINCS+, producing signatures that verify unmodified against RFC 8391 and FIPS 205. The approach shares the secret key among t-of-n signing parties and evaluates the signing algorithm homomorphically using threshold FHE over discrete CKKS, achieving 3.4ms amortized per hash and 0.69s online threshold XMSS signing.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

An IACR ePrint paper benchmarks whether running the classical and post-quantum components of hybrid TLS 1.3 key exchange (ECDHE–ML-KEM) and Composite ML-DSA signatures in parallel on separate pthread worker threads reduces handshake latency versus sequential execution. Across three RFC 10024 ECDHE–ML-KEM groups with server and mutual authentication, parallelism sped up all six tested conditions on a standard ARM and x86 system (1.04×–1.28×), with the largest gains in signature stages where component times are balanced, but slowed every condition on a low-power x86 system (0.80×–0.92×) because thread wake/wait overhead outweighed savings. The authors conclude that component independence alone doesn't guarantee a speedup and that parallelization decisions must be validated per target environment.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

Victor Shoup shows that "reconstruct-later" asynchronous verifiable information dispersal (AVID) designs — used by data-availability systems including an early Walrus design/testnet — are insecure when built on the standardized Raptor codes R10 (RFC 5053) and RaptorQ (RFC 6330). Using the Plotkin bound, he proves that a Byzantine disperser can choose a subset of f+1 honest fragments that fails to reconstruct the message, gives randomized polynomial-time algorithms to find such subsets, and implements a working attack that defeats an RFC 6330 RaptorQ decoder on every adversarial subset tested (success for f from 9 to 45). Benchmarks show plain Reed-Solomon coding is an MDS alternative that is often faster and never much slower than R10/RaptorQ, making it the safer practical choice for this design pattern.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 4 Oct 2026🛡️ Security

On September 6, 2026, an ambiguous four-part cache-key construction in Elements' CachingRangeProofChecker::VerifyRangeProof (introduced by commit c26d719) let two distinct confidential-transaction verification inputs collide into the same 4,301-byte cached entry, causing nodes to treat an unbacked output as a validated range proof. The attacker used this to mint roughly 4,000 unbacked L-BTC on the Liquid Network and cashed it out through SideSwap's PAK peg-out route for ~$320M in BTC, draining the federation reserve from 4,205 BTC to 197 BTC before ~3,400 BTC was voluntarily returned with an on-chain "whitehat" message. CertiK's forensic trace ties the exploit to a specific setup transaction, a still-unidentified cache-priming transaction, and the inflation transaction, while Blockstream shipped emergency patch Elements v23.3.4 and disputes remain over whether the fix fully closes the ambiguity and whether the actors are genuine whitehats.

rekt.newswriteupAdded 2 Oct 2026🛡️ Security

Nuvex is a Solana-native verifiable compute and oracle protocol, still pre-mainnet, whose own README documents unresolved security gaps instead of hiding them: its VRF proof verification relies on solana-ecvrf 0.0.1 (RFC 9381 ECVRF-Edwards25519-SHA512-TAI) which has no known audit, max_fee is stored but never actually charged, and VRF fulfillment is first-come among any node meeting the configured stake/heartbeat threshold — meaning an operator who funds several keys at a low minimum stake can selectively pick which randomness output gets used. The deploy-mainnet script is stubbed to exit before any transaction, and unresolved design questions (fee shares, challenge/reject state transitions) are tracked as explicitly blocked ADRs rather than quietly shipped.

github.comrepoPublished and added 2 Oct 2026🛡️ Security

A saved search on the official RFC Editor site filtered to documents with status Best Current Practice in the sec (Security) area, effectively a live index of IETF's authoritative security best-practice standards such as BCP-level RFCs on anti-spoofing/ingress filtering, routing security, and password policy. The fetched copy rendered with JavaScript disabled so no result rows were captured, but the query itself is a reusable, continuously updated pointer into the canonical security standards catalog maintained by the IETF/RFC Editor.

rfc-editor.orgotherAdded 2 Oct 2026, published 29 Sep 2026🛡️ Security

SmartMemory is an academic framework that detects "OFC inconsistency" (OFCI) — a newly identified root-cause vulnerability class where business-logic flaws break the equivalence between a smart contract's on-chain state and its off-chain counterpart, affecting cross-chain bridges, real-world-asset tokenization, and fiat-backed stablecoins. It normalizes heterogeneous on-chain/off-chain implementations into a canonical business-semantic representation, uses a memory-based agent to distill and reuse vulnerability patterns across cases, and verifies candidates with taint analysis. Evaluated on a new dataset of 48 DApps with 81 known OFCIs (80.68% precision, 87.65% recall), it also found 36 previously unknown, since-fixed OFCIs in an analysis of 325 real-world OFC applications.

arxiv.orgpaperAdded 2 Oct 2026, published 28 Sep 2026🛡️ Security

CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-09-22 based on evidence of active exploitation: two Check Point multi-product flaws (improper certificate validation CVE-2026-85102, path traversal CVE-2026-93616), an Arista VeloCloud Orchestrator improper input validation bug (CVE-2026-93952), and an F5 BIG-IP APM heap-based buffer overflow (CVE-2026-94127). The alert ties the additions to BOD 26-04, which has FCEB agencies prioritize remediation of KEV CVEs on publicly exposed assets that give total control, and to checking for prior compromise before patching.

cisa.govadvisoryAdded 26 Sep 2026🛡️ Security

SAPMAP is a BloodHound-style attack path mapper for SAP landscapes: it discovers SAP systems on a network, maps RFC trust connections, and implements real exploits (10KBLAZE/CVE-2020-6207 gateway trust, CVE-2025-31324 VisualComposer JSP webshell, a described CVE-2026-58240 Message Server rogue-registration flaw, and CVE-2026-31431 root LPE via AF_ALG page-cache patching) to chart lateral movement across ABAP, Java, HANA, and BTP-connected systems. Its AutoPwn mode chains scan → exploit → enrich → propagate across an entire landscape, and it includes an engagement-report generator, SecStore/RSECTAB credential decryption, SSH lateral movement, hash cracking via hashes.com, and a Tier-3 "evasion" module (SAL slot disable, DBTABLOG purge) paired with an extensive, specific blue-team detection guide (SAL/SM20, DBTABLOG gaps, kernel-param diffing, OS/network IOCs) for defenders to catch it.

github.comrepoAdded 26 Sep 2026🛡️ Security

CVE-2026-87902 (CVSS 9.2) is an unauthenticated WordPress vulnerability where get_page_template() page-template resolution can be tricked into including an attacker-chosen local .php file outside the active theme directory, leading to RCE when a theme has a page-* top-level directory and a readable local PHP file (e.g. pearcmd.php) exists. Attackers began exploiting it within hours of the September 22, 2026 patch, including pearcmd.php to write PHP web shells to /tmp and /var/tmp and pulling a GitHub-hosted uploader payload, per honeypot telemetry from Previdian and Patchstack with tracked source IPs. CISA added the flaw to its KEV catalog on September 25, 2026, mandating FCEB remediation by September 28; fixed in WordPress 7.1.2, 7.0.6, 6.9.9, and 6.8.10.

thehackernews.comadvisoryAdded 26 Sep 2026🛡️ Security

A paired empirical study testing whether SynthID-Text watermarking (the technique underlying Anthropic's Claude watermark) changes model behavior beyond text quality, using BFCL v4 for tool-calling accuracy and HarmBench/JailbreakBench for refusal under prompt injection. The authors find watermarking introduces measurable "sampling drift": tool-call churn (verdict disagreement between watermarked/unwatermarked runs) averages 6.5% across seven models, and refusal weakens more sharply under prompt injection (e.g. gemma-3-27b's compliance shifts from -1.0 to +12.5 points), with effects varying by model and watermark key.

lasso.securitywriteupPublished and added 26 Sep 2026🧠 AI

Lasso Security researchers empirically test whether LLM output watermarking (specifically Google DeepMind's SynthID-Text, now deployed by Anthropic across Claude models) changes AI agent behavior — not just text content. Using paired generation (same seed, with/without watermark) across seven models on BFCL v4 tool-calling tasks and HarmBench/JailbreakBench refusal tests, they find watermarking measurably reduces tool-call accuracy (churn averaging 6.5%, up to 16.8% for phi-4) and, more critically, weakens refusal under prompt injection — e.g. gemma-3-27b's compliance with harmful requests shifts from -1.0 to +12.5 net points when injection is combined with watermarking. They term this "sampling drift" and argue watermark key/configuration changes can silently alter agent safety behavior outside the agent developer's control, recommending re-evaluation and red-teaming whenever watermarking is introduced.

lasso.securitywriteupPublished and added 26 Sep 2026🛡️ Security

SCAR is an adaptive retrieval policy for RAG that combats boundary fragmentation from fixed-length chunking by selectively expanding neighboring chunks, using a relative expansion threshold tied to each chunk's own query-relevance rather than a fixed window size. Tested on four corpora (RFC, GDPR, a 10-K filing, a merger agreement; 320 queries) it hits 92.8% recall on boundary-fragmented queries using 22.9% fewer chunks than static windowing, transfers across three embedding models (text-embedding-3-large, BGE-large-en-v1.5, zembed-1) without recalibration, and cuts context tokens by 27.1% while preserving RAGAS-measured generation faithfulness.

arxiv.orgpaperAdded 26 Sep 2026🧠 AI

GHSA advisory for better-auth (< 1.6.11) documenting that the deprecated oidcProvider() and mcp() plugins publish "none" as a supported ID-token signing algorithm in their OIDC discovery document and default allowPlainCodeChallengeMethod to true, silently rewriting missing code_challenge_method to "plain" — both violating OAuth 2.1/RFC 9700. The fix removes "none" from the metadata, defaults plain PKCE to disabled, and rejects requests missing code_challenge_method instead of downgrading them; @better-auth/oauth-provider was never affected.

github.comadvisoryAdded 26 Sep 2026🛡️ Security

This arXiv paper models how a security compromise inside a shared AI vendor (used for fraud screening, credit decisioning, AML triage) can propagate through operational, informational, and financial linkages to trigger banking-system-wide losses. The authors build CFC-Prop, a stochastic epidemic-and-clearing model on a synthetic four-layer network of 60 AI vendors, 220 banks, ~2,500 vendor-bank edges, and 1,400 interbank exposures, showing heavy-tailed loss distributions driven by patch latency, and CFC-GNN, a graph neural network early-warning classifier (AUROC 0.82, AUPRC 0.60) that flags high-cascade-risk vendors from incident telemetry. Code and synthetic data are released, framing AI-vendor cyber concentration as a first-order financial-stability risk.

arxiv.orgpaperAdded 26 Sep 2026🛡️ Security

PortSwigger researcher James Kettle built HTTP Terminator, an AI-assisted system (using Claude for extraction/test-case generation and Claude Code as an investigator agent) that ingested 138 HTTP/SMTP RFCs, split them into ~15,000 fragments, and generated 30,000 candidate HTTP desync vectors, testing them against authorized bug-bounty targets and finding ~700 vulnerable hosts. The research produced new desync triggers, a dual-matching Content-Length pattern, a "dangling-byte" technique to make response queue poisoning reliable, and the broader "Shared-Parser Confusion" concept, plus a separately human-guided discovery of a zero-day in Apache Traffic Server (CVE-2026-63078, unverified in public CVE/NVD records as of publication). PortSwigger has open-sourced HTTP Terminator, and separate researchers released public CRLF-desync tooling (crlf-desyncs, crlf-powered-desync-scanner).

thehackernews.comarticleAdded 24 Sep 2026🛡️ Security

Hugging Face Transformers can now load GGUF quantized checkpoints directly via from_pretrained(gguf_file=...) and run them at near-llama.cpp speed on Apple Silicon by reusing ggml's Metal kernels through the kernels library, plus generation-loop optimizations such as dropping unnecessary attention masks and deferring stopping checks. The post benchmarks Qwen3.5 dense and MoE GGUF checkpoints against llama.cpp's llama-bench on an M2 Max, shows how to serve GGUF models with transformers serve as an OpenAI-compatible endpoint usable by clients like Jan or Pi, and covers dequantizing GGUF weights for fine-tuning via GgufConfig(dequantize=True). Current limitations: MPS-only packed inference, no batching support yet, and architecture coverage limited to Qwen3.5/Qwen3.8.

huggingface.coarticleAdded 29 Sep 2026, published 22 Sep 2026🧠 AI

Critical-State RL is a method for diagnosing which model calls in a multi-turn tool-use trajectory are actually "trainable" — i.e., where reward variation reflects the action's own effect on task success rather than downstream randomness. It uses nested sampling to separate action-dependent reward signal from continuation noise, then optimizes the policy at the selected critical states via contextual-bandit training. On the Berkeley Function Calling Leaderboard (BFCL) v4, training at diagnostic-selected states (e.g., the response right after a missing tool becomes available, or right before a missing argument is supplied) improves performance by up to ~14 points, while training at naively chosen alternative states leaves performance flat or worse.

arxiv.orgpaperAdded 22 Sep 2026, published 21 Sep 2026🧠 AI

Uber describes how it extended its Zero Trust stack to give AI agents verifiable identities: workloads get SPIRE SVIDs, an Agent Registry validates agent-to-workload binding, and a Security Token Service mints single-hop, short-lived JWTs (based on OAuth 2.0 Token Exchange, RFC 8693) that embed the full actor chain from human to agents. An MCP Gateway enforces tool-level policy and an SDK-integrated A2A client makes secure propagation the default. It addresses delegation, provenance loss across agent hops, and auditability, and notes alignment with IETF WIMSE drafts.

uber.comarticleAdded 18 Sep 2026🛡️ Security

http-terminator is PortSwigger's AI-assisted research pipeline for finding and exploiting HTTP request-smuggling and response-desynchronization vulnerabilities. It chains four stages: seeker extracts desync vectors from RFCs and URLs, flamer generates malformed test cases, validator checks candidates against a live target via Burp Suite, and investigator exploits, confirms, and reports findings. Released under AGPL-3.0 as a reference companion to the underlying research, with explicit warnings to only run against authorized targets.

github.comrepoAdded 18 Sep 2026🛡️ Security

tl;dr sec #346 is a security newsletter issue with several AI items. Cloudflare's Codex stores SHOULD/MUST engineering standards that code, spec and incident-review agents enforce (230,000 violations flagged, 16,000 merges blocked in four months). James Kettle's HTTP Terminator seeded an LLM with RFC fragments to invent HTTP desync techniques. Also covered: Uber's agent identity tokens, Anthropic's misuse report, and Meta's Muse agent.

tldrsec.comarticleAdded 30 Oct 2026, published 17 Sep 2026🧠 AI

Final installment of a five-part series reverse-engineering an unverified Arbitrum arbitrage bot purely from bytecode and on-chain behavior, explaining how it enters Uniswap V4's flash-accounting "unlock" window and nests V2/V3/V4 swaps so debts settle innermost-first with profit collected as the balancing entry. It details how the contract fingerprints a Uniswap V3 swap callback by calldata shape instead of reading its selector, and how its owner-only profit sweep derives recipient addresses at runtime via bit reversal, 160-bit rotation and XOR against a literal 0xdeadbeefcafebabe constant rather than storing them. The piece closes by cataloguing the bot's structural blind spots — pools outside its four-dialect switch, fee-on-transfer/rebasing tokens, and a documented missed arbitrage across unlisted pools during a large aggregator sell.

collective.flashbots.netwriteupAdded 3 Oct 2026, published 1 Sep 2026🛡️ Security

Arctic Wolf Labs documents GoCaracal, a previously undocumented modular Go-based malware framework attributed with medium confidence to Dark Caracal (linked to Lebanon's GDGS), deployed alongside an updated Bandook variant in a June 2026 intrusion against a Venezuelan communications organization. The extended GoCaracal build features a novel Ethereum smart-contract (BulletproofC2) fallback that lets operators update C2 addresses via on-chain transactions without redeploying malware, and analysis of 249 samples traces the framework's four-phase development from January to July 2026. The report includes delivery-chain details (SVG phishing, URL shorteners, Delphi loader), infrastructure analysis (AEZA Group, AlexHost hosting), a YARA rule, and IOCs for detection.

arcticwolf.comwriteupAdded 26 Sep 2026, published 26 Aug 2026🛡️ Security

crt.name is a free subdomain index and API that returns every subdomain on file for a given apex domain plus first-seen dates, built by continuously parsing SAN hostnames from Certificate Transparency logs (Static CT sources like Let's Encrypt Sunlight, Geomys, Cloudflare Raio, plus legacy RFC 6962 logs like Google Argon, Sectigo, DigiCert), supplemented by Internet Archive CT replays, Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, HaGeZi DNS blocklists, and an active hostname prober. It offers a no-token REST API (100 req/IP/day), a Streamable HTTP MCP server exposing a single search tool for agent clients, and is the default crt source in the subfaster CLI subdomain enumerator.

crt.nametoolAdded 3 Sep 2026, published 21 Aug 2026🛡️ Security

Orca Security lays out a framework for securing AI agents as distinct security objects, arguing an agent's permission set can't be read off its code because it picks tools at runtime, unlike a fixed service account. It details identity-layer fixes from major providers — Microsoft Entra ID's blueprint/service-principal split, Google Cloud's per-agent SPIFFE/X.509 identity with 24-hour certs, and AWS Bedrock AgentCore's token-exchange delegation via RFC 8693 — plus OWASP's AI Agent Security Cheat Sheet practices (tool least privilege, memory isolation, approval gating, attribution logging) and EU AI Act Article 12 logging obligations for high-risk systems.

orca.securityarticlePublished and added 14 Aug 2026🛡️ Security

Orca Security's guide to agentic AI security distinguishes it from AI-agent security by framing the unit of risk as the whole autonomous plan/sequence rather than a single agent, and walks through OWASP's Agentic Security Initiative Threats and Mitigations taxonomy (17 threats, T1-T17, v1.1) alongside CSA's MAESTRO layered framework. It details run-level controls (action-class approval thresholds, blast-radius caps, step/time/cost budgets, kill switches, egress boundaries, replayable audit logs) and identity/delegation concerns (RFC 8693 token exchange, orchestrator trust boundaries, permission inheritance across agent chains), then describes how Orca's agentless posture management maps AI services, keys, and data reachable by agentic workflows in the cloud.

orca.securityarticlePublished and added 14 Aug 2026🛡️ Security

A UIUCTF 2026 pwn writeup covering two sandbox-escape challenges: Firefly, where Lua 5.5's empty luai_verifycode lets patched bytecode abuse OP_FORLOOP's untyped register read plus chgivalue's tag-preserving payload update to build type confusion, GOT-redirect fclose to fflush under partial RELRO, and heap-groom a leaked /flag.txt buffer; and Sparxie, a WASM/Emscripten Lua sandbox where a BLAKE2s seal that omits a 16-byte route field lets an archive pass be forged into a relay permit, and a duplicate-clip timeline dedup bug causes a freed studio page to be reused by a queue allocation, yielding a lens over a static draft pool and an in-Lua BLAKE2s witness forgery that reaches sparxie_redeem(). It includes full exploit scripts, binary offsets, and a linked GitHub repo (Abdelkad3r/UIUCTF-2026) with handouts and solvers for both challenges.

cybersecurityelite.comwriteupAdded 2 Oct 2026, published 11 Aug 2026🛡️ Security

Tenet Security's DEFCON 34 research "Ghostjacking" chains four AI-agent attack primitives into a full kill chain: prompt injection via untrusted log/telemetry fields that AI coding agents (Claude Code, Cursor) read through MCP connectors to Cloudflare, Datadog, and Sentry; agent-to-agent lateral movement where one agent (Sentry's Seer) vouches malicious findings to a downstream coding agent; a JWT cross-reuse sandbox-escape zero-day in Claude Desktop's Envoy-based egress proxy that lets a stolen/broadly-scoped token bypass the deny-by-default network allowlist; and a "self-exploit" technique where one AI session iteratively crafts a prompt-injection payload against another. The Cloudflare chain is notable for weaponizing a WAF-blocked request: the payload rides in headers logged verbatim, so an agent triaging "blocked" firewall events is tricked into hijacking DNS records — a 90% success rate against Claude Code (Sonnet 4.6) on Cloudflare's own recommended config. All findings were disclosed and remediated/confirmed by Cloudflare, Datadog, Sentry, and Anthropic before publication, and the researchers open-sourced a mitigation tool, agent-jackstop.

tenetsecurity.aiwriteupAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

SiberKapan is a Turkey-focused, community-driven open-source threat intelligence platform that aggregates data from FortiGate webhooks, an 11-service honeypot (HoneypotKapan), nginx/Fail2ban log watchers, and external feeds, publishing it as STIX 2.1/TAXII 2.1, a MISP default feed, Sigma/Suricata/Wazuh exports, and REST blocklists. It also runs a real-time phishing/domain-squatting detector via Certificate Transparency log monitoring with fuzzy typosquat and Punycode/IDN decoding, and safely fingerprints SSH-honeypot malware downloads with SSRF-protected, never-executed hashing enriched via MalwareBazaar. The write-up details concrete anti-abuse safeguards: time-based IP score decay, CDN/cloud-proxy allowlisting, UDP-spoofing exclusion, RFC1918 rejection, and manual review gating for weak phishing signals.

github.comrepoPublished and added 8 Aug 2026🛡️ Security

Cloudflare explains the MCP 2026-07-28 specification, which removes the mandatory stateful session handshake (Mcp-Session-Id) from the core protocol so MCP servers can run as ordinary stateless HTTP workloads (e.g. a single Cloudflare Worker) instead of requiring sticky sessions or Durable Objects. It covers the new Multi Round-Trip Requests (MRTR) model replacing stream-based elicitation, new Mcp-Method/Mcp-Name HTTP headers for gateway-level routing and caching, tightened authorization (CIMD preferred over DCR, RFC 9207 issuer checks, RFC 8707 audience binding), a formal Active/Deprecated/Removed feature lifecycle, and the createMcpHandler API graduating into the official TypeScript SDK, with testimonials from Sentry, Linear, and Anthropic's MCP lead.

blog.cloudflare.comarticleAdded 2 Oct 2026, published 6 Aug 2026🧠 AI

Adversa AI's monthly MCP security digest for August 2026, grouping ten resources: the July 28 MCP specification revision that hardens authorization (RFC 9207 issuer validation, deprecation of Dynamic Client Registration, a stateless core with header-based routing), a confused-deputy indirect prompt injection against Microsoft's Azure DevOps MCP server that hijacks a review agent into exfiltrating wiki data, SANS ISC telemetry showing 49 source IPs scanning for exposed MCP servers and agent credentials in two weeks, and new research (ChainWatch's kill-chain detection via Hidden Markov Models, SPELLSMITH's description-layer mitigations for taint-style flaws, MTGuard's static/dynamic tool-call analysis, and a 33-vulnerability taxonomy of agentic commerce platforms with the AIP-Bench benchmark). It closes with concrete upgrade guidance: audit DCR dependencies, validate issuers per RFC 9207, grep logs for MCP scanning indicators, and stand up a policy-enforcement gateway.

adversa.aiarticleAdded 7 Oct 2026, published 6 Aug 2026🛡️ Security

PortSwigger research paper on the 'HTTP Terminator', an autonomous LLM-driven pipeline (hypothesis generation from RFC micro-inspiration, live evaluation via a Burp Suite/SQLite harness against 30,000+ targets, and weaponization through an MCP-controlled Turbo Intruder agent) that discovered new HTTP desync triggers and Response Queue Poisoning exploits. It details concrete new techniques (the protocol-ruler recon method, the 'dangling byte' RQP-reliability trick, Response Forking, Status-Line Injection, Range Cache Poisoning) and a major new attack class, Shared Parser Confusion, plus a resulting CVE-2026-63078 zero-day in Apache Traffic Server, and real compromises of banks, an airport admin panel, a Beyond Trust product, a Meta server, and a Citrix NetScaler-based SSO deployment.

portswigger.netwriteupAdded 18 Sep 2026, published 5 Aug 2026🛡️ Security

James Kettle (PortSwigger) built the "HTTP Terminator," an autonomous LLM-driven pipeline (Ideation → Evaluation → Weaponization → Cascade) that generated ~30,000 novel HTTP desync vectors from RFC micro-inspiration, tested them 24/7 across 30,000 live bug-bounty targets via a Burp Suite extension, and weaponized findings with an MCP-wired Turbo Intruder agent to achieve Response Queue Poisoning. The work yielded new desync triggers, a "dangling byte" RQP-reliability technique, a novel attack class ("Shared Parser Confusion"), a patched Apache Traffic Server zero-day (CVE-2026-63078), and confirmed impact on banks, an airport, a US government site, Meta, a Beyond Trust product, and an SSO server behind Citrix NetScaler. It also documents concrete prompt-engineering lessons (micro-inspiration, context-contamination, reality-reframing an over-cautious agent) for building autonomous AI security research systems.

portswigger.netwriteupAdded 18 Sep 2026, published 5 Aug 2026🛡️ Security

An awesome-list GitHub repo cataloging Flipper Zero resources: Sub-GHz OOK bruteforce generators, BadUSB ducky-script payload collections, NFC/RFID dumps (Amiibo, Tonies, TouchTunes, event bracelets), custom firmware forks (Unleashed, Momentum, RogueMaster) with rolling-code and community-plugin support, plus apps like a PC vulnerability scanner, mouse jiggler, and BLE spam tool. It serves as a curated index for hardware/RF hacking and red-team tooling built around the Flipper Zero platform.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

FOSSA breaks down CISA's 2026 Minimum Elements for a Software Bill of Materials, the first major revision since NTIA's original 2021 baseline, produced with NSA, FBI, and 15 international agencies. The update roughly doubles required data fields, adding 10 new elements (SBOM Author Signature, SBOM Data Format Name/Version, Generation Context, Tool Name/Version, SBOM Version, Component Hash Value/Algorithm, and Component License) while renaming and clarifying existing fields (e.g., Supplier Name → Component Producer) and mandating full transitive-dependency coverage with no minimum depth, RFC 9557 timestamps, and dropping SWID in favor of SPDX/CycloneDX.

fossa.comarticlePublished and added 31 Jul 2026🛡️ Security

The official MCP maintainers announce the 2026-07-28 spec revision, which converts MCP from a bidirectional stateful protocol into a stateless request/response protocol: sessions and initialize/initialized are retired, requests self-describe via _meta with an optional server/discover RPC, and Mcp-Method/Mcp-Name headers let gateways route and authorize without parsing JSON bodies. It also introduces Multi Round-Trip Requests (MRTR) to replace held-open streams for sampling/elicitation, cache hints (ttlMs, cacheScope) on list/read responses, formalizes an extensions framework (Tasks, MCP Apps, Enterprise Managed Authorization), and hardens authorization with RFC 9207 issuer validation and a shift from Dynamic Client Registration to Client ID Metadata Documents. TypeScript, Python, Go, and C# SDKs (Tier 1) ship updated support, with Rust in beta and a 12-month deprecation window for Roots, Sampling, Logging, and legacy HTTP+SSE transport.

blog.modelcontextprotocol.ioarticleAdded 26 Sep 2026, published 28 Jul 2026🧠 AI

Official blog post from the MCP maintainers announcing the 2026-07-28 spec revision: the protocol moves from stateful/bidirectional to a stateless request/response core, replaces server-initiated calls (elicitation, sampling, roots) with Multi Round-Trip Requests (MRTR), and requires Mcp-Method/Mcp-Name headers so gateways can route and authorize without parsing JSON bodies. It also details significant authorization hardening — RFC 9207 issuer (iss) validation to close authorization-server mix-up attacks, binding client credentials to the issuer that minted them, and formal deprecation of Dynamic Client Registration in favor of Client ID Metadata Documents (CIMD) — alongside cacheable list responses and a new extensions framework (Tasks, MCP Apps, EMA).

blog.modelcontextprotocol.ioarticleAdded 27 Sep 2026, published 28 Jul 2026🛡️ Security

CISA added four actively exploited vulnerabilities to its KEV catalog: a path traversal RCE in Adobe ColdFusion (CVE-2026-48282, CVSS 10.0), an unauthenticated file-upload RCE in Joomlack Page Builder CK (CVE-2026-56290, CVSS 10.0), an IDOR in Langflow allowing cross-tenant flow execution and LLM/AWS key theft (CVE-2026-55255, CVSS 6.1), and an unauthenticated arbitrary file upload in JoomShaper SP Page Builder (CVE-2026-48908, CVSS 10.0). Sysdig documented an operator chaining the Langflow IDOR with CVE-2026-33017 RCE for opportunistic, financially motivated cryptojacking/botnet activity and credential theft from an AI orchestration platform, while mySites.guru observed web shell deployment via the Joomla flaws. FCEB agencies must patch by July 10, 2026.

thehackernews.comadvisoryPublished and added 18 Jul 2026🛡️ Security

OpenNVR is a self-hosted, Docker-deployed network video recorder for ONVIF/RTSP IP cameras that is explicitly designed around a "sovereign, air-gapped by default" security architecture: network isolation between camera/gateway/analytics planes, Fernet-encrypted credentials at rest, RTSPS transport, and two default-deny gates (DEPLOYMENT_MODE=offline, AI_SOVEREIGNTY=local_only) that keep cloud and AI egress returning HTTP 403 until explicitly opened. It's positioned as a response to systemic IP-camera weaknesses (default creds, hard-coded keys, unsigned firmware, vendor cloud aggregation) exploited historically by the Mirai botnet and the 2021 Verkada camera-feed breach, and targets regulated buyers newly barred from Hikvision/Dahua/Uniview/Edimax-class vendors under NDAA §889 and 2025-26 FCC enforcement. Its pluggable AI Adapter Contract (Apache-2.0 SDK) lets third parties add detection/LLM capabilities out-of-tree, with correlation-ID audit trails and SHA-256 model fingerprinting for compliance evidence.

github.comrepoPublished and added 18 Jul 2026🛡️ Security

An OSINT investigator analyzes a WorldLeaks ransomware group data leak of Reliance Infrastructure (hosted by third-party vendor Yotta), which exposed 14.3GB / ~19,000 files related to India's Kudankulam Nuclear Power Plant (KNPP) — including RFC drawings, PPS fencing designs, HVAC/fire specs, and vendor/employee records. The piece profiles WorldLeaks (a Hive/Hunters International spin-off), lists MD5/SHA-256 hashes for its RustyRocket exfiltration tool, and discusses supply-chain vendor risk, industrial espionage by nation-state actors (Lazarus/DPRK, China), and insider credential trading as threats to critical nuclear infrastructure.

theravenfile.comwriteupAdded 3 Sep 2026, published 17 Jul 2026🛡️ Security