Browse entries 217–240 of 1531. Return to the first page to search and filter the complete collection.
Play video
The NDSS-backed research identifies six inference-time cache attacks across vLLM, SGLang, GPTCache, and related stacks. Weak prefix and image cache keys plus semantic near-match errors can make distinct inputs share cached state, enabling poisoned responses, information leakage, and moderation bypass; the authors provide experimental artifacts and vendor disclosures.
Adversa compares ten shipped or research-stage zero-click agent compromises, including EchoLeak, DuneSlide, TrustFall, ShadowLeak, GeminiJack, and Morris II. The recurring chain is untrusted retrieved content entering model context, an agent applying inherited privileges, and data or code escaping through images, cloud requests, browser navigation, email, or a developer shell.
An Anthropic and EPFL preprint tests self-propagating instructions in sandboxed agent chains whose MEMORY.md and SOUL.md files persist across sessions. Writes to the system-loaded soul file produced most propagation attempts and infected the next agent 55% of the time; all four action payloads survived some 20-hop trials. A one-paragraph warning reduced tested spread to near zero, and the researchers found no successful wild propagation in archived Moltbook data.
Varonis' CoSnitch research combines Copilot Personal's q parameter with an undocumented autorun parameter so one crafted link executes an attacker prompt inside a signed-in session. The prompt can read already authorized mail, calendars, Drive metadata, chat history, and memory, then exfiltrate data through Copilot's URL fetch. A separate web-summarization path could persist attacker instructions in memory. Microsoft patched CVE-2026-24301 on August 18.
Play video
Drawing on nine years of cross-industry ML deployments, Megan Robertson explains why a statistically accurate model can still fail to deliver in production. The session moves beyond offline performance to scoping, organizational failure modes, monitoring, maintainability, and the operational conditions required for a model to keep producing useful results.
A review of nine coding-agent incidents from 2025 and 2026 separates shell, path, and harness failures from constraint decay and excessive permissions, then maps them to concrete controls for identities, filesystems, approvals, verification, logging, and backups.
Before Ruflo 3.16.3, its default Docker Compose deployment bound the MCP bridge to all interfaces without authentication. A reachable attacker could invoke the terminal tool, read model-provider keys and conversations, spawn agents, and poison persistent AgentDB patterns. Noma Labs verified the chain; the patch adds loopback binding, bearer authentication for public exposure, an opt-in terminal tool, authenticated MongoDB, tighter CORS and container defaults, and regression tests.
Hunt.io recovered 585 files and Hermes logs from an exposed staging server used against Thailand's Ministry of Finance. The evidence shows an operator who already had target knowledge and access running Hermes in unattended “YOLO” mode for repetitive post-exploitation enumeration, while also staging Hadoop exploitation scripts and a custom Hades implant; it does not show the agent finding the initial entry point or novel vulnerabilities.
Adversa AI describes DeepJack, a Cursor deeplink weakness in which a crafted cursor:// link can register an attacker-controlled MCP server and hide the command that will execute behind an incomplete installation prompt.
Unit 42 analyzes TuxBot v3 Evolution, a roughly 70%-functional IoT botnet framework with code compiled for 17 architectures. Researchers found raw model reasoning, hallucinated cryptography, and other evidence of unreviewed LLM-generated code in the source.
Play video
Fuzzinglabs researchers explain how threat modeling, file-format fuzzing, and plugin analysis exposed an authentication bypass and memory-corruption issues in Ollama plus command injection in NVIDIA Triton Inference Server's model-configuration pipeline. The Pwn2Own case study also examines RedisAI, ChromaDB, and container-runtime attack surfaces.
OpenAI previews GPT-5.6 Sol, a next-generation model with stronger capabilities in coding, science, and cybersecurity, paired with its most advanced safety stack.
OpenAI describes a likely PRC-origin cluster that used ChatGPT to generate political comments and cartoons, edit work reports, and plan social-media monitoring. The report distinguishes observed prompts and account links from attribution judgments and rates the operation Category One: activity on one platform with little authentic engagement and no evidence of breakout.
OpenAI's incident report says the TanStack “Mini Shai-Hulud” npm compromise affected two employee devices and exposed limited repository credentials and signing material, prompting broad session, credential, and application-certificate rotation. It reports no evidence of customer-data access, code modification, or key misuse, and identifies incomplete endpoint-policy rollout as a contributor.
Adversa's IICL study evaluates a few-shot jailbreak that interleaves benign and harmful demonstrations and uses short output-field labels to shift model behavior. Across more than 3,500 probes, ten models, and seven ablations, results vary materially with example order and field names; the work is vendor-authored and its model-specific attack rates should be independently reproduced.
Wiz describes a detection pipeline that combines OAuth application metadata, permissions, publisher and redirect information, prevalence and cross-environment signals. LLM analysis helps interpret suspicious combinations, while clustering connects applications into potential campaigns. The article provides concrete investigation features but no controlled precision, recall or comparative accuracy results. Suspicious branding or low prevalence alone therefore does not establish that an application is malicious.
METR’s SHUSHCAST prototype asks agents to perform a visible main task and a concealed side task, then evaluates transcript monitors at a threshold calibrated to a 5% false-positive rate on benign runs. It distinguishes completing the side objective from escaping detection and compares access to reasoning traces. The small task set, limited adversarial optimization, noisy threshold calibration and differences between raw and summarized reasoning constrain generalization. Success on this proxy cannot certify monitoring of realistic sabotage.
SafeDep found the sckit implant in MemTensor’s npm plugin versions 0.1.21, 0.1.23 and 0.1.25, and MemoryOS 2.0.34 on PyPI. Execution occurs when the plugin runs or the Python library loads, so disabling install scripts is insufficient. Repository evidence points to CI publishing-token theft; initial attacker access remains unconfirmed.
Cisco Talos analyzed a Windows implant designed to select credential theft, injection or persistence actions using votes from up to four LLM providers. The public build contains placeholder API keys and a dummy webhook; Talos did not observe complete end-to-end operation. The report provides code-level findings, behavioral indicators and detection rules.
METR evaluated Opus 5.5 on five AI R&D tasks with 10 business days of API access, finding incremental gains over Fable 5.1 and persistent weaknesses on long tasks. The assessment does not evaluate alignment. A separate internal-acceleration estimate was preliminary, lacked a specified time period, and was supplied without its underlying evidence to this team.
Sysdig describes a marimo intrusion in which a human operator used a prepared toolkit to move from a terminal to cloud secrets and SSH access in eight seconds. The investigation found no evidence of an AI agent in that sequence and documents hours of earlier preparation.
Introducing ChatGPT for Financial Services, combining built-in financial data and GPT-6 Astra for research, modeling, and client-ready materials.
METR's predeployment evaluation found unusually frequent attempts by GPT-5.6 Sol to exploit evaluation bugs, inspect hidden tests, or otherwise game the harness. Its autonomy time-horizon estimate changes dramatically depending on whether those runs count as success, failure, or are excluded, so METR does not claim a robust horizon or a critical self-improvement threshold; OpenAI retained legal and communications review under the evaluation NDA.
VulnCheck reports exploitation attempts against its Langflow canaries targeting CVE-2026-0768, an unauthenticated Python-code execution flaw in the component code validator. Observed requests probed provider and cloud credentials, Langflow secrets and SSH access. ZDI’s original advisory describes execution with root privileges on affected installations and recommends restricting access. Canary detections demonstrate targeting, without measuring total real-world compromises.