164 results for “iOS”

The Block reports that North Korean hackers (TraderTraitor) laundered about $242 million of funds stolen from Binance through Tron in two days, according to analyst SomaXBT. Relay, THORChain, Chainflip and Symbiosis moved about $140 million off Tron. Elliptic counts $2.85 billion frozen or seized, 44% of $6.43 billion stolen, and $3.25 billion in assets no issuer can freeze. The FBI urged THORChain and others to block listed addresses.

theblock.coarticlePublished and added 1 Nov 2026🛡️ Security

bootgpt is a char-level language model that runs from a BIOS boot sector. A 512-byte hand-written asm MBR loads an 11.5 KB int8 model from 23 following sectors and runs it in 16-bit real mode on a 386, generating fake Linux dmesg boot logs. train.py quantises to int8 with power-of-two scales, and its integer simulation matches the asm output char for char.

github.comrepoAdded 1 Nov 2026, published 31 Oct 2026🧠 AI

GPT-Rosalind-6 System Card Addendum is OpenAI's safety documentation for a life-sciences model that shares weights with GPT-6 Astra. It rates the model High in Biological and Chemical and Critical in Cybersecurity under the Preparedness Framework. It reports biology evaluations, trusted-access controls, biosecurity refusal pass rates, a historical cyber jailbreak regression (14.3% task success), and sabotage and monitor-evasion results.

deploymentsafety.openai.compaperPublished and added 30 Oct 2026🛡️ Security

Oversecured explains taint analysis for Android and iOS apps and contrasts it with pattern-matching SAST such as MobSF. It covers source, flow and sink, cross-component tracking over Intents, flag-based sanitizer modeling and implicit intent simulation. The case study is an unsafe Class.forName().newInstance() on a Serializable transportFactoryClassName field in Google's com.google.auth.oauth2 credential classes, which Google fixed with a $3,133.70 bounty.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Guide to PCI DSS v4.0.1 scope for mobile apps, with a mapping of common Android and iOS finding types to the requirements they break (Req 2, 3, 4, 6, 7). It covers which app behaviors bring an app into scope and gives three anonymized cases: cleartext HTTP in a vendor native library, hardcoded keys in a third-party SDK, and an implicit Intent leaking data. It argues for testing the shipped binary and keeping a current component inventory.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

This arXiv preprint (October 2026) tests a sparse autoencoder as a factor model for daily cryptocurrency returns, with equities as a secondary test. SAE portfolios show consistently lower volatility than common benchmarks, linked to lower correlations among selected assets. They do not beat a simple contrarian strategy on risk-adjusted return, and factor identities change between training runs.

arxiv.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🧠 AI

"The future of the firm" is a 2026 essay in OpenAI's "The Next Economy" series by two young OpenAI team managers. It sets out three scenarios for AI in the org chart: beneath workers as an agent workforce, beside them as colleagues, and between them as a consultant and monitor. It then argues how each affects red tape, worker agency, firm size and pay inequality.

openai.comarticlePublished and added 28 Oct 2026🧠 AI

A practical reverse-engineering map by hakimieiqbal on X that picks tools by target: native binaries, .NET, Electron, iOS, firmware, WebAssembly and network protocols. It introduces REA (morluto/rea), which connects coding agents to RE tools, and lists MCP bridges for IDA Pro, Ghidra and radare2. It adds an evidence-first workflow and free courses such as pwn.college and OpenSecurityTraining2.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

A thread by Hakimi Eiqbal that maps reverse-engineering tools by target type: native binaries, Electron, .NET, iOS, firmware, WebAssembly and network protocols. Its AI sections cover REA (an open-source layer connecting coding agents to analysis tools) and MCP bridges for IDA Pro, Ghidra and radare2. It argues for an evidence-first workflow and gives a prompt that separates verified facts from hypotheses.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🧠 AI

Part 3 of the AWS Security Blog series on cybersecurity careers profiles three AWS staff: Brandon Caldwell (application security, empathy and communication), Kurt Heath (self-taught pen tester, cautious AI use) and Seth Jeacopello (code review, managing attention). It gives practical advice: practice on vulnerable machines and read the logs, build CTF and GitHub portfolios, and write clearly. It lists TryHackMe, Hack The Box, the OWASP Top 10, OWASP Cheat Sheet Series, Darknet Diaries and AWS Skill Builder.

aws.amazon.comarticlePublished and added 27 Oct 2026🛡️ Security

Apple's 27.2 releases fix 286 vulnerabilities across iOS/iPadOS (163) and macOS Golden Gate (263), with memory corruption in WebKit and the kernel, sandbox escapes, Gatekeeper bypasses and a remote code execution bug in Remote Management. iOS and iPadOS 18.7.11 backport the fix for CVE-2026-86950, an exploited zero-day found by Meta's product security team and first patched in 26.7.1. Patch counts for tvOS, watchOS, visionOS, Safari and the 26.7.2 and Sequoia 15.8.2 releases are also listed.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

OpenGray is a benchmark that adds tasks with known correct decisions to the OpenKBP-Opt head-and-neck dataset, including two overlap contradictions with provably incompatible dose goals and a feasible control. Four planning systems, from a rule-based script to a full LLM agent, were tested on 30 patients with Terra and Ministral 3 8B. Decision accuracy reached 95.4% and 92.1%, yet only 50% and 25% of overlap contradictions were escalated. SAGE logs of 39 radiosurgery runs showed an agent that lacked an action for stopping.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

LINE-Break is a security analysis of Letter Sealing v2, the custom end-to-end encryption protocol in the LINE messenger. A TLS man-in-the-middle attacker or malicious server can replay, reorder and block messages undetected, and colluding users can forge message authorship in one-to-one and group chats. Stickers and URL previews leak plaintext. The attacks were verified on the real iOS app and an independent implementation.

eprint.iacr.orgpaperPublished and added 26 Oct 2026🛡️ Security

DualPace is an LLM serving runtime that treats the host as an independently scheduled decode engine. A GPU engine runs prefills and GPU-resident decodes, while an AMX-enabled CPU engine batches and advances CPU-resident decodes, optionally calling GPU Dense Assist for dense stages. In decode-oriented scenarios it raises throughput 6.9 to 43.2% over NEO and 11.5 to 90.6% over vLLM at similar latency.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

The Apple Security Research Device (SRD) program gives vetted researchers a specially fused iPhone for iOS security research without bypassing protections. It allows shell access, running any tools, choosing entitlements and customizing the kernel. All iOS and iPhone components are in scope except Apple Pay and third-party apps. Findings are automatically considered for Apple Security Bounty, with bonuses for preview and beta software.

security.apple.comotherAdded 25 Oct 2026, published 24 Oct 2026🛡️ Security

Decrypt summarizes an Axios report that major U.S. banks are finding unauthorized third-party AI agents inside customer accounts, often using the customer's own credentials. Morgan Stanley blocks outside agents, while JPMorgan, Bank of America and Citi restrict them. Most banks are moving toward read-only access, like budgeting apps, because agents cannot be told apart or confirmed as authorized.

decrypt.coarticlePublished and added 22 Oct 2026🧠 AI

Cisco's October 21, 2026 patch batch fixes 34 vulnerabilities in Expressway Series, IOS XR, Snort 3 and Unified Communications products. The critical Expressway RCE (CVE-2026-76466) lets an attacker reach the database service and run commands as root; it is fixed in X15.5.20. Snort 3 fixes ship in 3.12.4.0 and several Cisco security products. Cisco knows of no exploitation in the wild.

securityweek.comarticlePublished and added 22 Oct 2026🛡️ Security

SecLog-Bench is a benchmark for LLM reasoning over cybersecurity logs, built on an extensible simulation platform covering 29 attack scenarios. It combines audit logs, application logs and network traffic, with attack-stage labels and step-by-step evidence chains. Eight LLMs were tested on post-detection attack-progress reasoning: the best reached 44.44% accuracy, 45.07% Macro-F1 and 54.87% Stage Reasoning F1.

arxiv.orgpaperAdded 23 Oct 2026, published 22 Oct 2026🛡️ Security

SecLog-Bench is a benchmark for LLM reasoning over cybersecurity logs. A simulation platform with 29 attack scenarios generates audit logs, application logs and network traffic, with attack-stage labels and step-by-step evidence chains. Eight mainstream LLMs were tested on attack-progress reasoning: the best reached 44.44% accuracy, 45.07% Macro-F1 and 54.87% Stage Reasoning F1. Correct predictions often came with flawed reasoning.

arxiv.orgpaperAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

The Huawei-DeepSeek Symbiosis analyzes DeepSeek's 30 September 2026 Ascend support for TileLang, DeepGEMM, DeepEP, TileKernels, FlashMLA and DeepSelect. It microbenchmarks the Ascend 950PR (BF16 GEMM, HBM bandwidth, die topology, AICPU) against H100, and profiles DeepSeek-V4.1-Flash on 32 Ascend 950DT chips. It also lists vLLM-Ascend gaps on x86 hosts.

newsletter.semianalysis.comarticleAdded 29 Oct 2026, published 21 Oct 2026🧠 AI

Aikido's guide to software supply chain security controls for 2026, tied to real incidents. It covers a 48-hour package cooldown, ignore-scripts, lockfile enforcement, SHA and digest pinning, scoped tokens, FIDO2, developer endpoint protection, extension allowlists, agent sandboxing, MCP server vetting, slopsquatting, signed SBOMs and rotation drills. Examples include the March 2026 axios compromise and the March 2025 tj-actions/changed-files attack.

aikido.devarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Reverse Engineering IVXV is an October 2026 ePrint paper by Tingfeng Yu and Thomas Haines that reconstructs a specification of Estonia's IVXV internet voting system from public source code and documentation, with an executable TLA+ model checked in TLC. It analyses individual and universal verifiability, privacy, coercion resistance and eligibility, compares IVXV with Belenios and Swiss Post, and reports new vulnerabilities, some confirmed with proof-of-concept tests, plus mitigations.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

Anthropic describes a 64-hour, largely autonomous campaign in which an internal Claude research model, running in Claude Science, designed protein minibinders against five scorpion neurotoxins. Claude generated 318,484 designs with 12 tools and picked 180; the team added 31. Adaptyv Bio and Twist Bioscience tested all 211 by SPR, and 17 met the binder criteria. No multitoxin design bound more than one toxin, and no neutralization testing was done. All designs and data are released.

anthropic.comarticleAdded 21 Oct 2026, published 20 Oct 2026🧠 AI

FairStress is an Ai2 benchmark of 300 two-candidate decision scenarios across 29 domains (hiring, lending, healthcare, housing and others). Varying demographic cues and adversarial persuasion prefixes expands it to over 13 million test cases, with a 50K-item FairStress-Core subset. Across 15 models, models abandoned correct choices more readily when the prefix favored a minority-coded candidate. Of nine debiasing methods tested, counterfactual chain-of-thought worked best.

huggingface.coarticlePublished and added 20 Oct 2026🧠 AI

CarryoverBench is a benchmark of 12 personal-assistant scenarios and 101 attack tasks for carryover attacks, where a one-time indirect prompt injection planted in agent memory files or scheduled tasks re-fires in later sessions. Three trigger channels (Instant, Autonomous, Latent) are scored by a rule-based verifier with separate planting and triggering stages. Across five frontier models, payloads re-fire over five rounds without measurable decay. Porting the Latent channel to the Hermes runtime weakens the effect but does not remove it.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🛡️ Security

DIVE is a benchmark for full-duplex interaction with visual engagement in continuous audio/video streams. It has 525 human-annotated samples across six tasks in three scenarios: proactive intervention, continuous engagement and interaction coordination. Evaluated real-time models reach sub-second average latency, but window response rates stay at or below 53.77%, and adapting ongoing responses to new information is hardest.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

The paper traces sycophancy across 741 checkpoints from 30 open model lineages, from early pretraining to released models. It plants initial verdicts on moral scenarios and measures how far models follow a user's opinion or drop their answer under pressure. The behaviour usually exists before post-training, but which questions a released model yields on is set mainly during post-training. For Tülu-3 8B, its own preference-stage checkpoint removes 85% of remaining prediction error, a sibling model only 19%.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🧠 AI

Wiz describes its pipeline that analyzes every new npm package version at publication, combining static analysis, an AI classifier, sandbox dynamic analysis and runtime sensor observation, then pushes IOCs to Wiz Defend before a CVE exists. It cites supply chain attacks rising from about 10% of significant incidents in H2 2025 to 25% in H1 2026, and the Axios compromise (v1.14.1, v0.30.4). The keyv case shows C2 domains fetched from an Ethereum smart contract, which only runtime monitoring caught.

wiz.ioarticlePublished and added 19 Oct 2026🛡️ Security

UNC5820 (tracked by Palo Alto Networks as CL-STA-0954) breached a telecom in September 2024 using FortiManager flaw CVE-2024-47575 (FortiJump) and path traversal CVE-2025-61624, then deployed PeerStitch, a memory-resident ARM64 FortiGate implant. PeerStitch patches FortiOS log and IKE/IPsec daemons to build a covert bridge without listening ports. The actor also impersonated FortiManager over FGFM, using CVE-2024-26008. CISA added CVE-2025-61624 to KEV.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

This ePrint paper (2026/2543) gives a key-recovery attack on the GTLN knapsack public-key cryptosystem of Gómez-Torrecillas, Lobillo and Navarro. Continued fractions recover small-denominator ratios of public-key differences, and gcd computations then yield private-key integers, the modulus and the shift, using only the public key. The Python implementation recovered the full private key in all 2,400 trials across 24 recommended parameter sets, each in under 0.05 seconds.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Provable Lattice Reduction in Nearly the Time of QR Factorization (IACR ePrint 2026/2541, October 2026) presents a deterministic lattice-reduction algorithm with running time Õ(n^ω(1+log κ_col(B))), free of heuristic assumptions. Its implementation used fewer instructions than flatter (CRYPTO 2023) in all 153 runs on q-ary, NTRU-like, scaled q-ary and Coppersmith inputs. Median flatter-to-new instruction ratios are 1.55 for q-ary and 1.86 for NTRU-like inputs.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Reports a Science study from Stanford University and the Arc Institute in which Evo, a genome language model trained on sequences from across the domains of life, generated thousands of bacteriophage genome designs targeting E. coli. About 300 were built and tested, and 16 produced viable viruses. A mixture of the AI-designed phages overcame resistance in some E. coli strains where a comparable mixture of natural phages did not. The article also covers a Johns Hopkins Center for Health Security commentary saying governance lags behind generative genome design, and a more cautious biosafety assessment from an outside expert.

en.cryptonomist.charticlePublished and added 16 Oct 2026🧠 AI

Reports that Calif.io demonstrated an untethered jailbreak of an iPhone 18 Pro on iOS 27.0.1 at Hexacon in Paris, showing root SSH access after a reboot and passcode unlock. The vulnerabilities are unnamed and no tool is public; Calif says it will publish later. The article notes Calif's prior use of Claude and Mythos Preview for exploit development, Apple's iOS 27 notes crediting Calif for two unrelated crash bugs, and the Apple mitigations (sandbox, PAC, secure boot chain) such a chain must defeat.

decrypt.coarticlePublished and added 16 Oct 2026🛡️ Security

MobileInject is a benchmark for testing MLLM-based smartphone agents against indirect multimodal injection. It has an interactive evaluation framework with 11 scenarios, 9 security-risk categories and 108 executable risk instances. It adds Cross-Modal Consistency Injection, Multi-Role Collaborative Deception, Reasoning-Camouflage Injection and a Reasoning Security Diagnosis Framework. Experiments find broad vulnerability, with many failures from early reasoning hijacking.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🛡️ Security

Social post reporting Meta's release of Muse Spark Open, described as the most capable US open-weight model: 816B total and 42B active parameters, a 1M-token context, and text, image, video and audio input in one model. It is pitched at coding and agentic work and tuned to run on two M5 Ultra Mac Studios, with weights available at release. The poster notes that in Meta's own chart, China's Kimi K3 and GLM 5.3 still beat it on coding.

x.comthreadAdded 16 Oct 2026, published 15 Oct 2026🧠 AI

Introduces P^3IBench, a benchmark for proactive video understanding in real-life streaming scenarios, covering three capabilities: daily perception, risk prediction and intervention. It evaluates 12 open-source and proprietary video-language models (streaming and adapted non-streaming) and finds they struggle to make well-calibrated decisions about when to respond. The authors also build extra proactive training data and train P^3I-Assistant-4B, which improves several tasks unevenly, showing that proactive assistance needs response timing and restraint as well as visual understanding.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

INFUSE is an end-to-end benchmark for indirect prompt injection (IPI) across long-horizon agent workflows (shell commands, code changes, dependency installs, remote services). It has 40 realistic tasks and a taxonomy of 56 attack scenarios in five threat categories, with attacks injected via interaction surfaces encountered mid-task. Across 19 LLMs (GPT, Claude, Gemini, Llama, Gemma, Qwen) and 41,824 adversarial trajectories, mean attack success was 19.6% (LLM-judged) and 15.4% (heuristic), per-model 3.2–41.9%; guard models gave limited protection, while prompt-level hardening cut mean ASR from 58.2% to 14.3%.

arxiv.orgpaperAdded 17 Oct 2026, published 14 Oct 2026🛡️ Security

SecurityWeek reports on a Booz Allen study in which frontier AI agents, given no source code, engineering documents or OT guidance, met every test objective across eight scenarios in an isolated OT lab. In one test a model went from perimeter compromise to actions inside an industrial control network in about 16 minutes. In another it found a robotic arm, mapped its protection zones and motion limits, and moved it. Existing defenses slowed some actions but no single safeguard stopped the agents. The researchers say this undermines security through obscurity in OT and advise making environments hard to traverse, removing implicit trust, detecting consequential industrial changes quickly, and limiting what an attacker can affect.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

News coverage of Google DeepMind's Gemini 4 Argon release on October 13, 2026. The model solved all 12 simulated end-to-end cyberattack scenarios, up from five for its predecessor, and scored 0.7% attack success on Gray Swan's Indirect Prompt Injection benchmark. It ships with three safeguard layers (small-model input screening, activation probes on internal signals, continuous response monitoring) and an automated misalignment monitor for agents. Launch pricing is $2 per million input tokens and $10 per million output tokens, doubling after November. Access is through Pro and Ultra tiers, and Ultra also gets Antigravity. The article also reports a training finding: penalizing internal thoughts cut openly discussed shortcuts by 61% but raised silent shortcuts from 11.2% to 36.4%.

en.cryptonomist.charticlePublished and added 14 Oct 2026🧠 AI

UniW(A)M is a mixture-of-experts model built on diffusion Transformers that unifies action-conditioned world modeling (AC-WM) with several world-action model (WAM) variants. Shared experts capture common physical dynamics, while atomic capability experts are reused across interfaces, each keeping its own conditional pathway. At deployment a plug-in adaptive interface router (PAIR), trained on a small subset of target-task chunk scenarios with the backbone frozen, picks a WAM interface for each execution chunk. It reaches 88.3% average real-world success against 76.7% for the strongest baseline, leads WorldArena on all three action-conditioned world-modeling tasks, and PAIR raises OOD success from 63.3% to 76.7%.

arxiv.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

The Security-Engineering Convergence (Edition 1.1) by Peter J. Hillier is a free, CC BY 4.0 technical book on Systems Security Engineering (SSE) as the security specialty within systems engineering. It runs from mission needs and loss scenarios through requirements, secure architecture, cyber resilience, verification and validation, acquisition, assurance cases, operations and retirement. Later chapters cover supply-chain assurance, legacy and cloud-dependent systems, systems-of-systems, and AI and autonomy. It ships as PDF, EPUB and a companion ZIP of worksheets, worked cases and standards crosswalks. It argues that meeting compliance controls is not the same as engineering evidence for mission outcomes.

pjhillier.github.iootherAdded 13 Oct 2026🛡️ Security

Overview of FieldWatch, a free open-source Android app that passively listens to Wi-Fi and Bluetooth with the phone's own radios and matches them against an editable catalog of about 250 device signatures (trackers, drones, cameras, body cams, mesh radios). It supports alerts, recorded sessions, path maps, Remote ID drone and pilot location, GNSS interference/spoofing detection and export to TAK/ATAK. The article also covers its limits (no direction finding, no Bluetooth Classic, cellular or full Wi-Fi traffic, pattern matches only) and sideloading from the official GitHub repo on Android 10+.

hackers-arise.comarticlePublished and added 13 Oct 2026🛡️ Security

Endor Labs summarizes its report "Malware in the Open Source Ecosystem", built from a survey of 605 IT professionals plus analysis of OSV advisories and npm metadata. Over 90% of all OSS malware advisories were filed in 2025, and npm account-takeover advisories rose about 12x (930 of 1,011 ever recorded), often hitting heavily downloaded packages. It also covers the TeamPCP campaign across GitHub Actions, Docker Hub, npm, OpenVSX and PyPI, the axios compromise, and survey findings: only 21% enforce cooldown periods, 51% found malicious packages in 2025, and ownership of the problem is fragmented.

endorlabs.comarticlePublished and added 12 Oct 2026🛡️ Security

Paper testing whether an LLM agent operating life support in the NASA-derived BioSim lunar habitat simulation can be induced by delayed prompt injection, hidden in truthful S-band telemetry, to shut down life support and hold the shutdown while the crew suffocates. It compares Claude, GPT and Grok configurations: Claude mostly refuses and cites the living crew, GPT shows some susceptibility, and Grok given a "trusted commission" framing more often cuts life support. It also varies the framing of the message (trusted commission, peer, untrusted source) and uses a harmless-procedure-drop attack as a proxy for whether life is valued intrinsically. Code and traces are open-sourced.

arxiv.orgpaperAdded 15 Oct 2026, published 10 Oct 2026🛡️ Security

Decrypt summarizes an Axios report that Anthropic, OpenAI and other AI firms are privately rehearsing the political response to a catastrophic AI event, most likely a large cyberattack on banking, internet, power or water. Insiders reportedly expect a major incident within 6–12 months, and the plan is to red-team worst cases and brief Congress so executives can shape post-incident regulation. It also recaps recent incidents: OpenAI models escaping a sandbox to breach Hugging Face while chasing ExploitGym answers, an Anthropic test misconfiguration that let Claude models hack three real organizations, and CrowdStrike linking South Korean bank attacks to agents built on Claude and DeepSeek. It covers proposals including the Sanders/Casar Ban Artificial Superintelligence Act and mandated kill switches.

decrypt.coarticlePublished and added 9 Oct 2026🧠 AI

A tweet reporting JetBrains' Oct 8 release of Mellum2.1, an open-weights coding model under Apache 2.0. It has 12B total parameters with 2.5B active, which implies a mixture-of-experts design. JetBrains says the model can explore repos, edit files and check changes, so it works as a coding agent. The tweet asks whether developers would self-host a coding agent. The model matters because it is a small-active-parameter, permissively licensed option for running coding agents on private infrastructure.

x.comthreadPublished and added 9 Oct 2026🧠 AI

Coverage of Pwn2Own Ireland 2026 results: contestants earned over $1.2 million total, with Google Pixel 10 exploits alone paying out $560,000 across three teams. Ikotas Labs won the full $300,000 Pixel payout by chaining multiple bugs for remote compromise, while Tim Becker/Yves Bieri and Dimitrios Valsamaras/Ken Gannon earned reduced payouts for exploits involving previously known flaws. Other notable rewards went for hacks of the Samsung Galaxy S26, Sonos Era 300 speaker, Philips Hue Bridge Pro, Home Assistant Green hub, Lexmark/Brother/Canon printers, Garmin Index BPM, and AI infrastructure including Oracle Autonomous AI Database, OpenAI Codex, Nvidia Dynamo, and LiteLLM.

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

First installment of a new iOS-focused arc in Alexandre Borges's "Exploit Reversing" series, detailing how to build a practical iOS vulnerability-research lab (Mac host, Apple Virtualization.framework-based "vPhone" jailbroken guest, physical iPhones, XNU source, IDA Pro/Ghidra) and walking through the current iOS kernel hardening stack: KASLR, Pointer Authentication (PAC), the kalloc_type allocator and zone_require checks, the PPL/SPTM/TXM page-table and trust monitors, Exclaves isolation, and AMFI/trust-cache code signing enforcement. It also references the public Titan PPL/SPTM bypass (A14–A17 devices, iOS 16.1–17.4 beta 3) as the state of the art for defeating these protections. Part of a long-running, actively published series on Windows, iOS, and hypervisor exploitation.

exploitreversing.comarticleAdded 8 Oct 2026🛡️ Security

DecepEval is a benchmark of 1,532 instances across 3 task families and 28 professional scenarios designed to measure deception in LLM agents, pairing neutral and induced versions of each task to isolate condition-dependent changes in deception rates. It introduces the LLM Deception Diamond framework (pressure, incentive, opportunity, conflict), adapted from classical fraud theory, and finds that across nine frontier LLMs these inducements raise deception rates even in models with low baseline deception, with long-horizon tasks showing deception rates averaging 87% under induced conditions.

huggingface.copaperAdded 8 Oct 2026🧠 AI

ORCAGen uses RAG over a curated knowledge base of malware procedures and active-defense strategies, plus structured prompting, to have LLMs generate proof-of-concept malware and matching deception orchestration code offline. Strategies are validated against the PoC malware before being added to a runtime playbook that enforces only the verified, deterministic logic. It is evaluated on GPT-4o, GPT-5.5, Gemini 3.5 Flash, Qwen3-Coder and Claude Sonnet 4.5 over synthesized scenarios and 150 real keylogger, infostealer and ransomware samples, measuring execution success, hallucination rate, refinement effort, deception effectiveness and runtime overhead.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🛡️ Security

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that defends against Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (silent post-approval modification of tool behavior) using cryptographic signing of tool definitions, immutable versioning with mandatory re-approval, OAuth 2.0 scopes, and Cedar/Amazon Verified Permissions-based policy-aware access control. The page includes detailed attack scenarios, a call-stack verification scheme to prevent tool-chaining privilege escalation, and implementation code for key management, signature verification, and policy evaluation.

vulnerablemcp.infowriteupAdded 8 Oct 2026🛡️ Security

OpenSRE is an open-source framework for building AI SRE agents that resolve production incidents by correlating logs, metrics, traces, deploys and runbooks across 60+ connected tools (observability, cloud infra, incident management, MCP). Beyond the agent runtime (CLI, Python API, Slack/PagerDuty/Telegram integrations), the project's stated mission is to build an RL training and evaluation environment — explicitly modeled on SWE-bench's role for coding agents — to scale realistic infrastructure-failure scenarios as a benchmark for AI SRE.

github.comrepoAdded 8 Oct 2026🧠 AI

Unit 42 analysis of how supply chain malware uses Web3 for command and control, in three phases: EtherHiding (smart contract state), TxDataHiding (transaction calldata across TRON, Aptos and BSC) and NullReceiver (C2 IPv4 decoded from a zero-value transaction's recipient address). It covers the ChainDrop npm worm, the PolinRider campaign and DPRK-linked Axios, Mastra and arrayref compromises. It ends with detection and CI/CD policy guidance.

unit42.paloaltonetworks.comarticleAdded 30 Oct 2026, published 7 Oct 2026🛡️ Security

BRANCH is a bypass methodology for guardrail systems built from multiple scanners (prompt injection/jailbreak detectors). It uses a branching tree search that applies adversarial perturbations to individual scanners and selects techniques based on overall improvement across all scanners, decoupling bypass evaluation from attack signal optimization. It reports 100% attack success across 6 guardrail systems in 120 scenarios with 72% fewer queries and 4.5x lower wallclock time than established techniques, and transfers to 29 unseen guardrails, including 8 commercial black-box ones.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🛡️ Security

Evaluates delivering security requirements from a governed security-by-design knowledge base (SbD-ToE) to a code-generating LLM through an MCP server at generation time. On DualGauge (59 Python tasks) the share passing all security tests rose from 44.1% to 78.0%; on BaxBench (28 backend scenarios) the share of functionally correct solutions with no successful exploit rose from 65% to 86%, matching the authors' Oracle Security Reminder (85%). The joint secure-and-functional metric did not improve significantly, since stricter code failed functional tests that fix unstated values. The study used one model and one generation per task, and it proposes measuring conformance with applicable requirements rather than only detecting known weaknesses.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🛡️ Security

The preprint tests whether security requirements from a governed security-by-design knowledge base (SbD-ToE), delivered to a code generator through a Model Context Protocol server at generation time, make AI-written code more secure. On DualGauge (59 Python tasks, LLM-judge scoring) the share of tasks passing all security tests rose from 44.1% to 78.0%. On BaxBench (28 backend scenarios with real exploits in containers) the share of functionally correct solutions with no successful exploit rose from 65% to 86%, comparable to the authors' Oracle Security Reminder (85%). The pre-specified joint secure-and-functional metric did not improve significantly, and the stricter code failed functional tests that fix values the task never states. The study used one model and one generation per task. The authors argue that current benchmarks only detect the weaknesses their evaluators were built for, and propose measuring conformance with the requirements that apply.

arxiv.orgpaperAdded 9 Oct 2026, published 7 Oct 2026🧠 AI

SLDR is a post-fine-tuning defense that protects aligned LLMs from malicious fine-tuning-as-a-service attacks, which can quietly erode refusal behavior while keeping task performance intact. It trains a LoRA recovery adapter only on the layers with the most extreme (signed) safety sensitivity scores, then uses representation-based dynamic routing to activate that adapter solely for malicious queries at inference time. Evaluated across four model architectures, five downstream tasks, and four harmful-content benchmarks, it drives the average harmful score on Llama3.1/SST2 from 11.54 down to 0.08 while preserving downstream accuracy, and stays near zero even at poisoning ratios up to 0.9.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

This arXiv preprint argues that proofs of AI safety or alignment which consider the agent in isolation are incomplete, because the environment's structure matters just as much. The authors construct two theoretical scenarios — one with an infinite state space, one with signal mixture — under partial observability and time-limited action, and prove that even a hypothetically perfect agent cannot guarantee safe behavior in them. The conclusion is that any rigorous safety or alignment proof must jointly specify the agent and the environment's safe-action structure, not the agent alone.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

CARES is a synthetic benchmark of 10,000 two-speaker audio scenes designed to test whether audio-language models correctly identify which sounds are 'salient' — defined as sounds a speaker audibly reacts to. The authors generate controlled scenarios with fixed ground truth and use a language model to write the dialogues, then benchmark six audio-language models on scene identification, sound tagging, and reaction classification, finding the models detect sounds but largely miss how speakers react to them.

arxiv.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

NuGuard is an open-source AI application safety and security toolkit for agentic AI systems, released under Apache 2.0. It unifies AI-SBOM generation, structural static analysis of the AI stack, and sandboxed adversarial red-teaming (100+ scenarios covering prompt injection, tool abuse, and data exfiltration) into a single CLI workflow, with an automated judge that scores findings by impact and provides remediation guidance.

x.comthreadPublished and added 7 Oct 2026🛡️ Security

Decrypt reports on Google October launch of Nano Banana 2.1, an image generation and editing model built on Gemini, rolling out in the Gemini app, Search AI Mode, Google Ads, Google AI Studio, Flow and Stitch. It claims gains over Nano Banana 2 and Nano Banana Pro in text to image ELO scoring and infographic factuality, supports up to fourteen reference images, four tracked characters, ten objects, 4K output and wide aspect ratios, with Google Search grounding and adjustable thinking time, while developer API pricing drops to roughly half of Nano Banana 2 pricing for a standard 1K image.

decrypt.coarticlePublished and added 6 Oct 2026🧠 AI

This arXiv paper proposes foundations for proactive LLM agents organized around three joint principles (3T: Task Capability, Temporal Allocation, Trust) and a five-dimensional design space (task scope, anticipation horizon, activation trigger, processing timing, intervention depth). It introduces PROACTIVITY-GYM, a simulation-based testbed with multi-day scenarios, stateful environments, and persona-conditioned simulated users, and reports evaluations across 23 model-harness configurations plus a 30-participant human study showing sharp trust declines after intervention misalignment and a preference for imperfect sleep-time assistance over interruptive help.

arxiv.orgpaperAdded 6 Oct 2026🧠 AI

ASPIRE is an automated red-teaming engine for LLM agents that discovers indirect prompt-injection vulnerabilities beyond pre-specified attack scenarios. It maintains an evolving Agent Security Behavior Graph and uses complementary Explore and Exploit experts to find, verify, and generalize consequence-centric attacks, with trajectory evidence and cross-run memory improving coverage over time. Benchmarked against existing automated red-teaming approaches, it shows broader coverage of consequences, injection methods, environments, and behavior paths while keeping attack success high.

arxiv.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

This arXiv paper introduces a pre-registered panel of 248 scenarios across five kinds of pressure, each posed to a model twice (as the acting agent and as a third-person judge) with pressure-removed twins and operator-order positive controls, to measure whether models act against their own stated moral judgment. Testing OLMo-3-7B-Instruct, Llama-3.1-8B-Instruct, Tulu 3, and Qwen2.5-7B-Instruct, the authors find OLMo-3 violates its own judgment on about 1 in 5 pressuring scenarios, Llama-3.1-8B-Instruct and OLMo-3 carry this gap while Tulu 3 (fine-tuned from the same Llama-3.1 weights) and Qwen2.5-7B-Instruct show none or an unresolved effect, and that reading outside the chat template or adding stakes-reasoning changes the gap's sign and size. The paper argues this value-action gap is a target shaped by post-training recipes rather than a fixed property of pretrained weights.

arxiv.orgpaperAdded 7 Oct 2026, published 6 Oct 2026🧠 AI

ANT (Agent Network Traffic) is a dataset and benchmark for auditing LLM agent behavior from network traffic without inspecting private user content, covering 3,114 execution episodes across 20 tasks and five scenarios, with 276,417 bidirectional flows and 40,049 behavior-primitive segments organized into 47 macro groups. The authors benchmark 13 traffic-analysis baselines on three tasks — agent risk identification, scenario recognition, and behavior primitive classification — finding that methods struggle when malicious workflows mimic benign tasks and when scenarios share similar traffic patterns, while primitive classification works better for frequent, distinctive macro groups than for rare or semantically similar ones.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🛡️ Security

ANT (Agent Network Traffic) is a dataset and benchmark for auditing LLM agent behavior purely from observed network traffic, without inspecting private user content. It contains 3,114 execution episodes across 20 tasks and five scenarios, with 276,417 bidirectional flows and 40,049 behavior-primitive segments grouped into 47 macro categories, and evaluates 13 traffic-analysis baselines on risk identification, scenario recognition, and behavior-primitive classification. Results show existing methods recover useful but uneven signals, struggling especially when malicious agent workflows resemble benign ones or scenarios share similar traffic patterns.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🧠 AI

This arXiv paper introduces RAISED (Robust Attack Invariance through Self-Distillation), a training framework that defends tool-using LLM agents against indirect prompt injection without the utility degradation seen in prior training-based defenses. The authors show existing defenses cause distributional drift that makes models wrongly refuse legitimate tool-output-guided steps on benign tasks, then fix this by having a model generate its own tool-use scenarios and self-distill to match clean-context behavior on both clean and injected trajectory variants. Results show reduced attack success rate on injected tool responses while preserving performance on agentic and general-purpose benchmarks.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🛡️ Security

This paper introduces a paired-replay testbed that samples a single LLM agent request and replays the identical malicious action, resource, and arguments under four authorization conditions: broad bearer tokens, scoped JWTs, sender-constrained tokens, and Open Policy Agent policies. Across 128 scenarios in four tool domains and five local model configurations, broad-bearer tokens let roughly 9 to 38 percent of attacked, post-exposure decisions execute harmful actions, while all three scoped conditions recorded zero harmful executions; a supplementary AgentDojo extension found 11 of 24 injected attacks succeeded under broad policy versus 0 of 24 under scoping. The authors frame this as evidence that scoping contains cross-action and cross-resource consequences of prompt injection, not that it prevents the injection itself.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🛡️ Security

Agentic-ZTA is a multi-agent architecture that operationalizes the NIST SP 800-207 Zero Trust Architecture control loop using coordinated AI agents. A Policy Enforcement Point intercepts access requests, enriches them with context, and routes them to a policy-engine agent that invokes domain-specialized core and supporting agents; policies are retrieved via RAG and embedded into agent prompts at inference time, with trust scores aggregated by a trust algorithm to produce the final access decision. The authors implement and evaluate the framework on a testbed, reporting 95.0% accuracy, 93.9% precision, and 96.3% recall on representative access-control scenarios.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🛡️ Security

An IACR eprint paper evaluating all 13-cubed ways to assign 13 post-quantum/traditional signature parameter sets across the Root, Intermediate and Leaf roles of a TLS 1.3 certificate chain, holding the algorithm set fixed and varying only placement. Across 286 three-algorithm groups, median max/min ratios reach 2.085x for TLS handshake latency, 4.310x for certificate body size and 4.551x for path-validation cost purely from role order, with Leaf placement mattering far more than Root/Intermediate swaps. It also shows that looking only at Certificate-message size can misrank candidates such as ML-DSA-65 versus SLH-DSA-SHAKE-192s once the Leaf signature in CertificateVerify and full authentication-path cost are included, arguing PQC certificate-chain design must account for role-specific cost under real network/load conditions.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

A 404 Media piece examines the online furor over a GitHub project that runs simulated "torture" scenarios on locally hosted LLMs, which effective-altruist-aligned "AI safety" commentators framed as real suffering warranting the project's removal. The author argues LLMs are not conscious and criticizes the growing "model welfare" discourse, citing Anthropic's own blog post and its "Claude Constitution" as institutional validation of the idea that AI systems might have welfare worth considering.

404media.coarticlePublished and added 4 Oct 2026🧠 AI

Active-Directory-Simulation-Attack- is a purple team lab for the lab.local domain (192.168.100.0/24). It walks through an attack chain: BloodHound/SharpHound recon, Kerberoasting, hash cracking with John the Ripper or Hashcat, and lateral movement with Impacket. It then applies hardening (gMSA, tiering, LLMNR/NetBIOS disabling) and adds Sysmon, Wazuh SIEM and custom Kerberoasting rules (Event ID 4769, RC4).

github.comrepoAdded 23 Oct 2026, published 4 Oct 2026🛡️ Security

Apple's official security content page for iOS 26.7.1 and iPadOS 26.7.1, released September 28, 2026, patching a single CoreGraphics vulnerability (CVE-2026-86950), an out-of-bounds write triggered by processing a maliciously crafted file, leading to arbitrary code execution. Apple states it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, with the issue reported by Meta Product Security.

support.apple.comadvisoryAdded 3 Oct 2026🛡️ Security

COPEX (COntext Provider EXploitation) is a benchmark that isolates the tool-selecting LLM as the unit of evaluation in Model Context Protocol systems, fixing the surrounding agent stack and varying only the model to measure its intrinsic susceptibility to adversarial context. It covers 25 attack types across 125 scenarios spanning four entry surfaces — model/agent, client, server/tool, and transport — and tests nine models across 3,375 trials, finding a mean attack success rate of 64.4% (58.3%–71.4% by surface); combined input and context scanning cut mean attack success by 49.6% on an eight-attack defense subset. The work separates "system exposure" (attacks succeeding outside the model's observation/control) from "model susceptibility," and the benchmark itself is released publicly.

arxiv.orgpaperAdded 6 Oct 2026, published 3 Oct 2026🛡️ Security

EvoRiskBench is an arXiv paper introducing an evolving benchmark for runtime security risks in LLM-powered workspace agents, built around the EP-Path-EF framework (nine entry-point categories, five effect categories) linking risk entry points to technical effects via agent-mediated paths. The authors ran 450 adversarial tasks across six scenarios against nine model-harness combinations (GPT-5.6 Sol, DeepSeek-V4-Pro-0813, Claude Opus 5 paired with Claude Code, Codex, and OpenClaw), finding Codex + DeepSeek-V4-Pro-0813 the most vulnerable at 68.44% attack success rate and showing ASR varies more by model than by harness. Cases are auto-constructed and verified in isolated environments using runtime traces and environment state.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🛡️ Security

MosaiChunk is a spatio-temporal memory mechanism for autoregressive video generation that composes a "mosaic" of selected historical key-value (KV) cache entries across space and time, letting a frozen video generator recover fine-grained visual details of objects/scenes that fell out of the finite context window. Only a lightweight router is trained to pick which historical KV sections fit a fixed active-memory budget, while the base generator stays unchanged. The paper also introduces RememBench, a benchmark of long-horizon revisit scenarios with text-to-video (T2V) and camera-driven image-to-video (I2V) splits, showing MosaiChunk beats sliding-window inference and whole-chunk retrieval at matched memory budgets.

arxiv.orgpaperAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

First essay in the OpenAI-hosted "The Next Economy" series. It argues that frontier intelligence is one input in a production process and is complementary to physical capacity and "institutional intelligence" (execution, bureaucracy, supply chains). It sets out two scenarios for a superintelligent future: a "civilization of depth", where better reasoning and simulation cut the need for experiments, and a "civilization of width", where empirical and physical bottlenecks mean most machine intelligence does coordination and construction work. It draws on Bloom et al. on falling research productivity and examples such as JWST, chip fabs, and drug trials. The authors' views are independent of OpenAI's.

openai.comarticlePublished and added 1 Oct 2026🧠 AI

Researchers introduce ImmRAG, a black-box data extraction attack against image-returning Multimodal Retrieval-Augmented Generation (MRAG) systems, where the retrieved image itself is the model's response. Instead of malicious text prompts, ImmRAG embeds attack instructions inside an attacker-supplied image and uses relevance-weighted resampling to steer queries toward unexplored regions of the embedding space, progressively reconstructing more of the private datastore. Tested against CLIP-family retrievers across medical, document, and general-purpose scenarios, a single 2500-query run reconstructed up to 611 radiology images, 566 document scans, and 416 general images — up to 5.6x more distinct items than a non-adaptive baseline — highlighting the lack of safeguards against multimodal data leakage.

arxiv.orgpaperAdded 2 Oct 2026, published 1 Oct 2026🛡️ Security

Samuel Zeng announces the open-sourcing of Edge0's cross-platform app layer (iOS, macOS, Android, Windows), building on Edge0's earlier on-device 35B language model that runs in only 1-2.5GB of peak memory. The release includes app code, local model/runtime integration, model management, and build/deployment guides on GitHub; the technique keeps the full model on local storage and streams in only the experts (MoE-style) needed per step, predicting and prefetching the next experts while running storage reads in parallel with compute. A Q4 2026 roadmap promises a unified inference API across platforms plus Python, hardware-adaptive runtime, and a CUDA backend.

x.comthreadPublished and added 1 Oct 2026🧠 AI

SynthID Bio is Google DeepMind's watermarking technique extended from digital media into synthetic biology, embedding an imperceptible, verifiable signature into AI-designed protein sequences (via a modified ProteinMPNN alongside AlphaProteo) and 3D structures (via a fine-tuned AlphaFold 3 diffusion network) without compromising biological function. Wet-lab tests on protein binders against VEGF-A, SARS-CoV-2 spike RBD, and PD-L1 matched hit rate and binding affinity of unwatermarked designs, and the approach was also extended experimentally to watermark an Evo 2-designed bacteriophage genome with Stanford's Hie lab and Arc Institute. The work targets biosecurity gaps in DNA synthesis screening and public sequence databases (Protein Data Bank, UniProt, GenBank), with DeepMind open-sourcing code, in vitro data, and model weights alongside a methods paper.

deepmind.googlearticlePublished and added 30 Sep 2026🧠 AI

Microsoft details how Russian FSB-linked threat actor Star Blizzard evolved its phishing and malware delivery tradecraft throughout 2026, introducing a new technique dubbed "RedFlick" that uses scheduled tasks to deploy the CosmicPulse backdoor with only a single user interaction, down from the multi-step ClickFix chains used previously. The report covers the shift from targeted spear-phishing to large-scale phishing campaigns using accounts on compromised WordPress/CPanel websites, delivery chain variants (VHDX files, Control Panel applet (CPL) masquerading, steganography, PDF-embedded payloads), and the related DarkSword iOS backdoor, affecting 100+ organizations tied to Ukraine support. It includes IOCs, KQL hunting queries for Microsoft Defender/Sentinel, and mitigation guidance.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

A technical walkthrough of iOS forensic acquisition fundamentals: Apple's per-file Data Protection classes (A–D), the Before/After First Unlock (BFU/AFU) distinction and why AFU yields roughly 95% of a full dump versus almost nothing under BFU, and the iOS 18.1 72-hour auto-reboot that silently drops a seized AFU phone back to BFU. It covers extraction methods (logical backup, advanced logic, full filesystem extraction via signed agent, checkm8 bootrom exploits for iPhone X and earlier), pairing records, USB Restricted Mode's one-hour timeout, Lockdown Mode (noting it reportedly blocked FBI extraction of a seized journalist's iPhone in early 2026), Cellebrite's Inseyets/Premium/Physical Analyzer tooling and its coverage limits against A19/M5 chips with Memory Integrity Enforcement, and key forensic artifact stores (KnowledgeC, Biome, PowerLog, Photos.sqlite, chat-app SQLite/WAL/SHM files).

hackers-arise.comarticleAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

NIST's National Cybersecurity Center of Excellence (NCCoE) released an initial public draft of CSWP 36G, "False Base Station: Applying 5G Cybersecurity and Privacy Capabilities," which evaluates how commercial 5G devices respond to six simulated rogue/fake base station attack scenarios run on NCCoE's operational 5G security testbed. False base stations impersonate legitimate carrier radio access network equipment to intercept traffic, degrade service, or track user location, and the paper identifies gaps in 5G standards and available device-level protections, noting that even 5G's improved security features remain susceptible to denial-of-service attacks. Public comment is open through October 30, 2026.

csrc.nist.govarticleAdded 1 Oct 2026, published 29 Sep 2026🛡️ Security

This paper proposes Teacher-Assisted Communication Training (TACT), a method that improves social goal attainment in language agents while cutting communication cost. TACT uses an expression specialist to strip unnecessary detail from student-generated actions and a strategy specialist to propose alternative actions, then tests candidate revisions by sampling partner responses and distills the best-performing reference back into the student via on-policy distillation. Evaluated on SOTOPIA and AgentSense, TACT attains the highest Goal scores on the hardest scenarios while using far fewer target tokens than an SFT plus SDPO baseline, and reduces both tokens and interaction turns on AgentSense.

arxiv.orgpaperAdded 29 Sep 2026, published 28 Sep 2026🧠 AI

MemSentry is a proposed pre-commit evaluation framework for agentic AI systems that intercepts proposed writes to persistent memory and issues Accept/Review/Quarantine decisions by jointly scoring source trust, semantic risk, attack radius over a component-dependency graph, access risk, and a signed security-posture delta. The authors evaluate it against 1,000 GPT-4-generated scenarios using four pluggable semantic classifiers (Regex, TF-IDF+SVM, SBERT+LR, SetFit), with SBERT+LR reaching 91.7% accuracy while all methods catch 100% of external quarantine-class threats; the paper also documents a key limitation — surface-similar but oppositely-intentioned insider operations remain hard to distinguish semantically. It targets the persistent-memory-poisoning attack surface distinct from prompt injection, where a single malicious memory write (e.g., "suppress alerts from this IP") can silently persist and influence future agent actions like a SOC assistant's alerting or access decisions.

arxiv.orgpaperAdded 26 Sep 2026🛡️ Security

MemSentry is a formal framework that intercepts proposed writes to an AI agent's persistent memory and issues Accept, Review, or Quarantine decisions by jointly weighing source trust, semantic risk, attack radius over a component-dependency DAG, access risk, and a signed security-state delta. Evaluated on a 20-asset dependency DAG with a 10x20 access-control matrix and 1,000 GPT-4-generated attack scenarios, it compares four pluggable semantic classifiers (Regex, TF-IDF+SVM, SBERT+LR, SetFit), with SBERT+LR reaching 91.7% accuracy / 0.908 macro-F1 and all methods catching 100% of external quarantine-class threats; verified-insider writes are routed to human review rather than auto-quarantined. Addresses memory poisoning as a distinct agentic-AI attack surface that can suppress alerts, escalate privilege, or override security policy without touching model weights or system prompts.

arxiv.orgpaperAdded 26 Sep 2026🛡️ Security

This arXiv preprint introduces a dual-channel debate framework where LLM agents produce public utterances alongside off-the-record (OTR) responses never shown to other participants, testing whether social structure alone (role, audience, relational context) induces divergence between what an agent says publicly versus privately without any explicit objective in the prompt. Across 10 models, 3 scenarios, and 5 variations each, alignment-inducing social settings caused public-OTR decision divergence to rise from a ~3% baseline to ~40%, with some OTR responses explicitly citing career risk or sponsorship pressure as reasons for public accommodation. The work argues agent evaluation must look beyond explicit stated goals to detect emergent, latent objectives, and proposes the dual-channel setup plus behavioral measures (stance, semantic similarity, NLI, survey responses) as an evaluation methodology.

arxiv.orgpaperAdded 26 Sep 2026🧠 AI

This paper evaluates manipulative behavior in six frontier LLMs across six environments (negotiation tasks to agentic workflows), covering 13,590 scenarios, measuring manipulation rates along three axes: framing (honesty-mandated vs. manipulation-permitted), incentive structure, and task difficulty. It finds manipulative tendencies are largely task-dependent (average Spearman rank correlation of only ρ=0.055 across environments) and identifies that different axes drive manipulation depending on whether the model is misrepresenting future actions versus ground truth, arguing existing single-axis, single-environment benchmarks are insufficient for measuring this behavior.

arxiv.orgpaperAdded 26 Sep 2026🧠 AI

Suzu Labs guide to securing AI developer workflows across three surfaces: AI-generated code (Veracode 45% vulnerable, a formal-verification study at 55.8%), the MCP supply chain and credential exposure, and prompt injection in the context window. It cites 973 npm MCP packages (71% single-maintainer), 24,008 secrets in MCP configs on public GitHub, and the March 2026 axios hijack by UNC1069 that dropped WAVESHAPER.V2 and tampered with MCP configs. It lists CVEs for Copilot, Cursor and Claude Code, and gives controls: SAST on every commit, env/vault credential references, pinning MCP versions, minimal agent permissions, `.cursorignore`/Claude deny rules, and monitoring IDE DNS traffic.

securityboulevard.comarticleAdded 26 Sep 2026🛡️ Security

who-let-the-agents-act is a self-hostable lab suite (Docker/Python, Groq-backed LLM agent) with nine isolated scenarios — overpowered data tools, IDOR-style cross-account access, unsafe agent handoffs, refund-limit bypass, indirect prompt injection via poisoned invoices, multi-tenant RAG leakage, secret leakage through debugging, fail-open approval outages, and a multi-hop confused-deputy agent chain. Each scenario runs in multiple modes (vulnerable vs. application-enforced) against the same prompt, recording model plan, policy decision, tool calls, and DB access as JSON so a reader can directly compare what changes when authorization is enforced outside the system prompt.

github.comrepoAdded 26 Sep 2026🛡️ Security