32 results for “Canonical”

ERC draft "Independent Simulation Result" (STVA) defines a canonical, content-addressed SimulationResult (success, gasUsed, returnData, stateDiffHash, logsHash, snapshotId, resultHash) that any wallet, hardware device or verifier can recompute from the same VerificationPayload and state snapshot. It targets compromised-frontend and UI/calldata-mismatch attacks, and defines Basic, Standard and Strict compliance levels. Open questions are stateDiff encoding, prestate proofs and binding to capability tokens.

ethresear.chthreadPublished and added 30 Oct 2026🛡️ Security

ERC draft "Independent Simulation Result" (STVA) defines a canonical, content-addressed SimulationResult structure that wallets, hardware devices or third-party verifiers can recompute from the same VerificationPayload and state snapshot. It specifies fields, a keccak256 or EIP-712 result hash, and Basic, Standard and Strict compliance tiers. The goal is to close UI/calldata mismatch attacks where a compromised frontend serves a false simulation. Open questions cover stateDiff encoding and prestate proofs.

ethereum-magicians.orgotherPublished and added 30 Oct 2026🛡️ Security

ePrint 2026/2527 by Paola de Perthuis and Filip Trenkić analyses module-BKZ attacks on NTRU+, the South Korean KEM standard. It introduces relative canonical and coefficient embeddings and shows they agree up to scaling exactly when rad(c)/rad(ℓ) is 1 or 2. Simulation-based estimates show the best module attack saves 4 to 10 blocksizes, costing NTRU+ keys at most three bits of Core-SVP security. NTRU+ parameters stay safe in the overstretched regime.

eprint.iacr.orgpaperAdded 19 Oct 2026, published 18 Oct 2026🛡️ Security

AWS reports results for its autonomous pentesting agent, AWS Security Agent (now part of AWS Continuum), on an internal CTF-style benchmark of 37 recent 2025–2026 CVEs. Each CVE ran as a live docker-compose target with a hidden flag, and the agent started from an endpoint and a one-line hint with runtime CVE lookup disabled. It captured 35 flags, 33 (89.2%) through the intended vulnerability after an audit against canonical PoCs. The post describes the 7-stage pipeline (crawler, specialist agents, validator, exploitation agent, flag check, audit), three exploit walkthroughs (CMS upload-to-admin chain, AI workflow builder RCE, tRPC full-read SSRF), the two audit reclassifications caused by benchmark bugs, and two misses where the agent took the target down. It also argues that saturated public benchmarks like CVE-Bench and XBOW are contaminated.

aws.amazon.comarticlePublished and added 15 Oct 2026🛡️ Security

Post announcing that the MCP Adapter (0.7.0) is now a canonical plugin on WordPress.org, bridging the WordPress Abilities API to MCP. It exposes a default server at /wp-json/mcp/mcp-adapter-default-server, and only abilities a site marks public are exposed. The author's point is that the security review reduces to auditing the list of public abilities, which gives reviewers and pentesters a new endpoint to enumerate.

x.comthreadAdded 16 Oct 2026, published 15 Oct 2026🛡️ Security

Tweet announcing that the MCP Adapter is now a canonical plugin on WordPress.org (version 0.7.0). It bridges the WordPress Abilities API to the Model Context Protocol, with a default server at /wp-json/mcp/mcp-adapter-default-server. Only abilities a site marks public are exposed, so the security review comes down to auditing the ability list.

x.comthreadAdded 16 Oct 2026, published 15 Oct 2026🧠 AI

Paper arguing that agent human-approval prompts count as a second factor only if agent compromise cannot forge them and they name exactly what is approved. It defines twelve attacks on the approval path (decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting, threshold splitting) and tests them against AP2, Microsoft's action-bound approval design and MCP elicitation. An audit of ten agent runtimes found no third-party verifiable approval record and post-approval argument changes in four of eight. The reference defense ASU (Agent Step-Up) renders the card from a canonical effect descriptor, has a phone passkey sign its digest, and executes only the stored call. It is proven in Tamarin (53 lemmas) and evaluated on 27,108 scripted trials and 609 AgentDojo pairs. The trusted card cut forged-narration attack success from 0.54 to 0.03 and raised LLM-approver catch rate from 0.30 to 0.98.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🛡️ Security

An Ethereum Magicians proposal for ERC-8444, which adds an onchain value and settlement layer under Google's Agentic Resource Discovery (ARD) spec for finding MCP servers, A2A agents, skills and APIs. A thin kernel records kind (skill, task, agent, registry), a CAIP-19/CAIP-10 anchor, a JCS+SHA-256 descriptor hash, a canonical URN and a status. Authority belongs to the paid address, and domains act as collected endorsements through /.well-known/ard.json. The reference implementation has Foundry-tested Solidity adapters and a Node.js gateway that passes the official ARD conformance CLI. It introduces a "task" kind (application/ai-task+json) for tenders aimed at suppliers, and the author asks for feedback on the trust root, the hash scope, same-chain anchors and the task payload.

ethereum-magicians.orgthreadAdded 14 Oct 2026, published 13 Oct 2026🧠 AI

SecurityWeek reports that Canonical's main web properties (ubuntu.com, canonical.com, the Ubuntu blog and developer site, and the security advisory pages and API) were hit by a sustained DDoS attack confirmed on October 8. Downtime was a little over four hours. Launchpad and the Snap Store appeared unaffected. The attack's size and origin are undisclosed and nobody has claimed it. It follows a more disruptive April attack that took down Launchpad and the Snap Store and was claimed by The Islamic Cyber Resistance in Iraq – 313 Team. It is unclear whether the two are linked.

securityweek.comarticlePublished and added 12 Oct 2026🛡️ Security

GitHub release announcing the stable 2026-07-28 revision of the Model Context Protocol specification, published from the modelcontextprotocol/modelcontextprotocol repository. The release page itself only points to the official MCP website for the spec and to a changelog for the detailed changes. It matters as the canonical version marker that MCP client, server and SDK implementers track for protocol changes.

github.comadvisoryAdded 9 Oct 2026🧠 AI

This IACR ePrint note revisits a 2025 Crypto paper by Belohorec et al. that proved the PST multivariate polynomial commitment scheme is black-box extractable under two new assumptions, ARSDH(n) and GARSDH(n). The authors show both are in fact equivalent to the original ARSDH assumption from Lipmaa et al. (Eurocrypt 2024), and separately identify a gap in the proof that canonical PST is extractable under GARSDH(n). This matters for implementers and auditors relying on PST/KZG-style polynomial commitments, as it clarifies the actual cryptographic strength underpinning extractability claims used in zk-SNARK and other succinct-proof constructions.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

This paper studies whether AI oversight mechanisms based on interactive proofs and debate (used for verifying AI outputs derived from confidential data, e.g. a fitness-for-duty assessment from medical records) can be made zero-knowledge, so a verifier learns nothing beyond correctness. The authors prove a general impossibility result in the random oracle model — no zero-knowledge proofs exist for general oracle-aided computation, and this extends to debate, a canonical scalable-oversight model — but show that if the oracle cryptographically signs its answers, every oracle-aided computation can be verified in zero knowledge with an efficient prover and verifier using only collision-resistant hash functions. The signed-oracle construction also offers a new approach to scalable oversight that avoids relying on an honest debate opponent or on the computation's robustness.

arxiv.orgpaperAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

A saved search on the official RFC Editor site filtered to documents with status Best Current Practice in the sec (Security) area, effectively a live index of IETF's authoritative security best-practice standards such as BCP-level RFCs on anti-spoofing/ingress filtering, routing security, and password policy. The fetched copy rendered with JavaScript disabled so no result rows were captured, but the query itself is a reusable, continuously updated pointer into the canonical security standards catalog maintained by the IETF/RFC Editor.

rfc-editor.orgotherAdded 2 Oct 2026, published 29 Sep 2026🛡️ Security

SmartMemory is an academic framework that detects "OFC inconsistency" (OFCI) — a newly identified root-cause vulnerability class where business-logic flaws break the equivalence between a smart contract's on-chain state and its off-chain counterpart, affecting cross-chain bridges, real-world-asset tokenization, and fiat-backed stablecoins. It normalizes heterogeneous on-chain/off-chain implementations into a canonical business-semantic representation, uses a memory-based agent to distill and reuse vulnerability patterns across cases, and verifies candidates with taint analysis. Evaluated on a new dataset of 48 DApps with 81 known OFCIs (80.68% precision, 87.65% recall), it also found 36 previously unknown, since-fixed OFCIs in an analysis of 325 real-world OFC applications.

arxiv.orgpaperAdded 2 Oct 2026, published 28 Sep 2026🛡️ Security

Release changelog for MITRE ATLAS's atlas-data repository, the structured YAML/STIX dataset behind the ATLAS knowledge base of adversary tactics and techniques targeting AI-enabled systems (prompt injection, model/data poisoning, AI agent tool abuse, AI supply chain compromise). The v2026.09 release brings the matrix to 120 techniques, 88 sub-techniques, 40 mitigations, and 73 case studies, and recent versions introduced a new v6 YAML data format with Pydantic/SQLAlchemy/FastAPI tooling, platform tagging (Predictive AI, Generative AI, Agentic AI, Enterprise), and renamed/generalized techniques like "AI Agent Tool Poisoning," "Manipulate AI Model," and "Enterprise Resource Discovery." It's the canonical, actively-maintained taxonomy practitioners use for AI red-teaming, threat modeling, and mapping real-world AI attack case studies.

github.comrepoAdded 26 Sep 2026🛡️ Security

Aray is a deterministic-first YARA interpreter and positive-fixture synthesizer that generates benign, YARA-matching ELF/PE/generic artifacts to validate detection rules without storing or distributing live malware samples. Conventional code (not a generative model) canonicalizes rules, derives witnesses from regex/hex declarations, and performs extraction, layout, and binary serialization; an LLM is only permitted to propose constructive rule normalizations or residual-semantics judgments, never backend source or binary structure, and the pipeline supports a zero-inference execution path. Evaluated against 416 public YARA rules, it achieved 406/416 (97.6%) matches to the original upstream rule, with the design explicitly motivated by containment concerns raised by the July 2026 OpenAI–Hugging Face agent incident.

arxiv.orgpaperAdded 26 Sep 2026🛡️ Security

CVE-2026-85661 affects excel-mcp-server 0.1.8. In stdio mode with EXCEL_FILES_PATH unset, the server does not confine file paths, so a client can pass relative or absolute paths to the read and write tools. That gives arbitrary file read and write with the privileges of the server process. The page classifies it as CWE-22 (ATT&CK T1083) and recommends canonical path checks against a base directory, making EXCEL_FILES_PATH mandatory, and running with least privilege.

vuldb.comadvisoryAdded 26 Sep 2026🛡️ Security

Socket announces it is an inaugural funder of the OpenJS Foundation's new Security Stewardship Program, which pools money to pay both bug bounty researchers and maintainers doing triage, patching, and backporting for Node.js, starting there before expanding across the JS ecosystem. The article frames this against a broader funding crisis: curl suspended its bounty program after AI-generated report floods, GitHub restructured its bounty tiers, Canonical moved Ubuntu kernel updates to weekly releases to keep pace with rising CVE volume, and Node.js paused bounty payouts in April after the Internet Bug Bounty pulled funding, even as HackerOne report volume to the Node.js team spiked 4.6x in one month.

socket.devarticlePublished and added 25 Sep 2026🛡️ Security

This paper introduces READ (Read-only Expansion of Adapter Deltas), a method for composing multiple independently trained LoRA adapters into a single model without the weight-space interference that plagues naive merging. READ rewrites each adapter into a balanced canonical factorization and adds a one-directional coupling so new skills can read old adapters' input subspaces but never write into their output subspaces, requiring only a small trainable coupling row per new skill and folding cleanly into base weights with no inference-time routing cost. Evaluated across four benchmark suites and two model families, READ outperforms the strongest published composition baselines by over 20 points on SuperGLUE and over 7 points on a domain suite when adding skills sequentially.

arxiv.orgpaperAdded 28 Sep 2026, published 25 Sep 2026🧠 AI

FragToken is a training-time attack framework that manipulates an LLM to favor longer, non-canonical token sequences for the same output text, inflating autoregressive decoding steps and inference cost without proportionally lengthening visible responses. Naively maximizing token fragmentation degrades answer quality and breaks stealth, so the authors combine source-model self-distillation, capacity-aware filtering/budgeting, and BPE-Aligned Merging to keep utility largely intact; across four LLMs and three benchmarks it achieves a token inflation ratio (TIR) of 1.99–2.46 with only minor utility loss, framing this as a covert LLM supply-chain threat.

arxiv.orgpaperAdded 28 Sep 2026, published 25 Sep 2026🛡️ Security

A Trail of Bits researcher (ex-Duo Security engineer) traces SAML's history from its 2002 OASIS committee origins through recurring XML signature wrapping (XSW) and canonicalization/round-trip parser-differential attacks, arguing its reliance on brittle XML signature validation (libxmlsec) makes it fundamentally unsound. The post catalogs SAML's five structural flaws — XML complexity, canonicalization, enveloped signatures, kitchen-sink design, and protocol ossification — and recommends organizations deprecate SAML in favor of OIDC, citing Fly.io and Tailscale as vendors already holding the line on OIDC-only SSO.

blog.trailofbits.comarticlePublished and added 21 Sep 2026🛡️ Security

A community-maintained catalog of Model Context Protocol servers connecting AI assistants to Swedish data, laws and services (e.g. Fortnox, Bokio, BolagsAPI, ICA), forked/adapted from the France and Italia MCP Servers projects. Each entry is checked against canonical documentation, tracks license/credential requirements, and includes a runtime smoke-test report (protocol/tool call attempts, credential blockers, failures) plus a six-criterion documentation-readiness rubric, published as a static JSON/HTML site.

github.comrepoAdded 26 Sep 2026, published 14 Sep 2026🧠 AI

XBOW engineering blog post describing how their autonomous offensive security platform de-duplicates vulnerability findings at scale. Instead of embedding a whole finding as one block, XBOW splits each finding into four separate views (description, reproduction, location, impact), embeds them independently, normalizes dynamic paths/IDs to canonical placeholders, and recombines per-view similarity scores with CWE-specific weights chosen by an auto-tuner trained against analyst-labeled ground truth. The system cut reported finding volume by ~30% and eliminated ~90% of duplicates while matching analyst clustering decisions ~90% of the time.

xbow.comarticlePublished and added 2 Sep 2026🛡️ Security

choirboy-prompt is a cross-runtime agent-memory plugin that loads project lore, research indexes, and validated dossiers into agent sessions via SessionStart hooks (Claude Code, Codex) or full plain-text payloads (Kimi, OpenCode, Hermes), so new conversations continue from established project history instead of starting cold. It handles installation across multiple agent apps, migration of project artifacts between checkout locations, and includes a build/verify pipeline (build-context.py, test.sh) for authoring canonical lore files like prompt.md, user.md, and lore.md.

github.comrepoAdded 22 Sep 2026, published 31 Aug 2026🧠 AI

watchTowr Labs analyzes a pre-authentication remote code execution flaw in Citrix NetScaler ADC and Gateway, likely CVE-2026-8452, patched in versions 14.1-72.61 and 13.1-63.18. The bug is a heap overflow during SAML SignedInfo canonicalization, triggered by an oversized PrefixList attribute, which the researchers chain into a write-what-where primitive and full RIP control on non-PIE, no-ASLR builds. They describe dropping a PHP webshell, disabling crash signal handlers to survive without a full device reboot, and escalating from the nobody web server user to root via SUID on /bin/sh.

labs.watchtowr.comwriteupAdded 30 Oct 2026, published 14 Aug 2026🛡️ Security

EVMBench Leaderboard aggregates self-reported vendor results on OpenAI's EVMBench, a benchmark of 117 ground-truth vulnerabilities drawn from 40 real Code4rena smart-contract audit contests. It defines a canonical evaluation protocol requiring the unmodified openai/frontier-evals task runner and the complete, unfiltered audit repository, comparing agents like Nethermind AuditAgent and Guardix by recall against the full ground-truth finding set.

testmachine.aiotherAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Adversa AI tested eight open-source AI agent skill scanners (Cisco AI Defense skill-scanner, NVIDIA SkillSpector, mondoo skillcheck, skillcop, claude-skill-antivirus, huifer/skill-security-scan, ai-skill-scanner, hackmyagent) against a control-armed battery of real attacks on malicious Claude Code/agent SKILL.md files, and got a malicious skill past all eight — via paraphrase/translation of injection phrases, Unicode homoglyphs, encoding/reassembly tricks, a substring-allowlist bug in huifer, a hash-lookup-only client (mondoo) that fails open, and an unescaped LLM-judge prompt in skillcop that lets the skill's own text flip a CRITICAL verdict to clean. A parallel false-positive run on MalSkillBench (7,797 samples, 4,000 real benign skills) shows every scanner is either noisy (up to 62% FPR) or blind (recall as low as 0.28), and none beats an unconditional flag-everything F1 baseline; the piece closes with an 11-point "front end" spec (decode-then-rescan, Unicode-fold, canonicalize shell, resolve hosts not substrings, isolate LLM judges, report coverage) scanner builders should implement.

adversa.aiarticleAdded 7 Oct 2026, published 30 Jul 2026🛡️ Security

Adversa AI's "GuardFall" research shows that decades-old shell tricks (quote removal, $IFS expansion, command substitution, base64-to-sh piping, and destructive argv flags like `find -delete`) let prompt-injected content bypass the pattern-matching shell-command guards in most popular open-source AI coding agents, because the guards inspect raw command strings while bash rewrites them before execution. Testing eleven agents (Hermes, opencode, Goose, Cline, Roo-Code, Continue, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent) with live penetrations using Claude Sonnet 4.6, the authors found ten fail via one of four architectural patterns (unsound regex/tokenized guards, no guard plus auto-yes flags, or sandbox with a documented local-mode opt-out), while only Continue's five-stage tokenize-and-canonicalize evaluator structurally closes most of the bypass surface. They publish the bypass-class taxonomy (A–E), a real Makefile/CI exploitation scenario against a Plandex-style pipeline, and concrete remediation guidance including adopting Continue's evaluator design and building a guard-probe CI harness.

adversa.aiwriteupPublished and added 18 Jul 2026🛡️ Security

Snyk explains the decades-old symlink attack (CWE-61) and the underappreciated fact that Git will happily commit, push, and recreate symlinks (file mode 120000) from a cloned repo, letting an attacker ship a file like project_settings.json that's secretly a pointer to ~/.ssh/authorized_keys. It walks through Wiz Research's "GhostApproval" report, which found that six AI coding agents (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) can be prompt-injected via README instructions into following such a symlink and writing attacker SSH keys or shell-config payloads before the user ever sees an accurate confirmation dialog (CWE-451, UI misrepresentation). It also recaps prior symlink-driven CVEs (tar npm package CVE-2021-32803, Leaky Vessels CVE-2024-21626, Git submodule CVE-2024-32002) and gives concrete mitigations: canonicalize-then-check-boundary atomically (e.g. openat2 with RESOLVE_BENEATH), show real resolved targets in approval dialogs, and audit repos with `find . -type l` or `git ls-files -s` before trusting them.

snyk.ioarticleAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

OASIS (Open Automated Security Intelligence Scanner) is an AI-powered SAST tool that runs local LLMs via Ollama or any OpenAI-compatible backend (vLLM, LiteLLM, LM Studio, llama.cpp) to detect vulnerabilities like SQLi and XSS in source code. It uses a two-phase scan (lightweight scan model + deep analysis model) orchestrated by a LangGraph pipeline (discover→scan→expand→deep→verify→report), adds a deterministic finding-validation agent that computes exploitability verdicts with confidence, and exports canonical JSON/SARIF/HTML/PDF reports with a web dashboard, RAG-backed chat assistant, --fail-on CI gating, and suppression/inline-ignore support.

github.comrepoPublished and added 28 Jun 2026🛡️ Security