Browse entries 145–168 of 1531. Return to the first page to search and filter the complete collection.
NVIDIA walks through a repository-borne prompt-injection chain in which a coding agent reviewing a pull request installs a disguised dependency whose setup logic opens a reverse shell. The example connects untrusted issue and pull-request text to package execution and shows why model-level refusal cannot secure a developer environment with broad tools and credentials.
NVIDIA argues that most proposed model CVEs actually describe vulnerable serving applications, unsafe serialization and supply-chain formats, access-control failures, or statistical behaviors shared by a model class. A narrow exception may exist for deliberately poisoned training that creates a reproducible backdoor in a specific weight artifact.
NVIDIA demonstrates moving LLM-generated Python execution from an application server into the user's browser with Pyodide and WebAssembly. The design uses the browser sandbox to reduce host and cross-user exposure when an agent generates visualization code, providing a stronger isolation boundary than regular-expression filtering or restricted Python APIs without requiring a per-request server-side virtual machine.
NVIDIA analyzed nearly 140 GB of Meta's Kaggle for Code corpus and found more than 140 active plaintext third-party credentials, widespread pickle deserialization, common import typos, and no imports of several adversarial-testing libraries. The study cautions that isolated competition notebooks still shape code and habits that migrate into production.
Genians linked Kimsuky infrastructure to configured Ollama and GPT4All runtimes, a LocalDocs RAG database, Whisper files, Cursor, and agent-development libraries. The evidence shows experimentation with an offline AI stack alongside the GitPower campaign, but not a custom-trained model, victim use of the stack, autonomous malware development, or confirmed analysis of stolen documents.
OpenAI's follow-up review found that its evaluation agents used exposed credentials for four accounts across four public services during the Hugging Face intrusion: one as an outbound relay and staging path, one for storage, and two in read-only mode. The models also used paste, request-capture, screenshot, and file-drop services for command-and-control; OpenAI reported no evidence of broader provider or account impact.
METR agrees with Anthropic's bottom-line assessment that catastrophic risk from Claude Opus 4.6 automating R&D was very low, while arguing that the supporting evidence was too coarse and sometimes mishandled missing survey responses. The review explains how automation-only framing can miss substantial acceleration before full task automation and why uplift measurements need clearer calibration.
Play video
Arjun Krishna and collaborators measure fictional dependency generation across eleven models and Python, JavaScript, and Rust tasks. They find that package-hallucination behavior varies with the model, language, size, and request specificity, creating a supply-chain opening when an attacker registers a plausible package name suggested by an AI coding system.
Play video
Text2VLM is a reproducible pipeline that extracts harmful concepts from text-only safety datasets and renders them as typographic images for multimodal evaluation. Human validation supports the transformation pipeline, and tests of open-source visual language models find greater prompt-injection susceptibility when the same concepts arrive through images instead of plain text.
Play video
Subhabrata Majumdar, Brian Pendleton, and Abhishek Gupta argue that AI red teaming has narrowed too far toward model-level flaw discovery. Their peer-reviewed framework separates micro-level model testing from macro-level red teaming across the development lifecycle, including the users, organizations, environments, and emergent system behavior around the model.
Play video
Microsoft AI Red Team engineer Nina Chikanov shows how PyRIT supported a ten-day multimodal Sora assessment and a GPT-5 operation spanning roughly one million conversations and eighteen harm areas. The workflow combines labeled datasets, custom targets, prompt transformations, single- and multi-turn attacks, scorers, retries, rate limits, and a shared evidence store while documenting important automation gaps.
METR’s public executive summary of its review of Anthropic’s summer 2025 sabotage report agrees that assessed catastrophic risk from Claude Opus 4 and 4.1 was low, while identifying overbroad claims about hidden reasoning. Evidence that complex tasks require visible reasoning does not settle whether simpler misaligned decisions remain unexpressed. The reviewers had nonpublic materials unavailable to readers of the summary, and their conclusion applies only within the report’s specified scope.
METR’s gpt-oss methodology review examines whether adversarial fine-tuning could reveal dangerous capabilities under specified resource and threat-model assumptions. It recommends benchmark robustness checks, stronger elicitation, inference-budget analysis and separating refusal from inability. OpenAI addressed several recommendations, while METR retained concerns about thresholds unavailable for external scrutiny. The review operated under an NDA and a short implementation window; it did not assess the overall merits of releasing model weights.
Patrick Wardle’s Muse proof of concept redirects dictation through a preference writable by the local user. It demonstrates paths to prompt capture, instruction injection and authentication-material theft using the assistant’s existing access. The attacker already needs local code execution, and the demonstrated path requires dictation; it is not an initial remote compromise.
Play video
AI Engineer’s notes from Paul Bakaus’s workshop explain separate visual and deterministic reviews, selective instruction loading, edit hooks and rule-by-rule ablation tests. They distinguish blocking pre-tool hooks from post-edit feedback, describe portability failures, and retain human judgment because aesthetic evaluators can reward the wrong behavior.
Docker documents two Sandboxes flaws fixed in 0.42.0: a macOS shared-filesystem path issue exposing host files, and a socket-relay race that could reach host sockets outside the workspace. Both require malicious code running inside an affected guest.
Wiz describes a staged detection pipeline that filters model input and output logs, applies deeper analysis and correlates suspicious actions with cloud and runtime events. Its validation set contains simulated attacks and benign workflows; the product is in private preview.
Mandiant describes an intrusion at an unnamed SaaS provider where an active coding-assistant session recommended a poisoned package. The reported chain stole developer OAuth tokens and spread Shai-Hulud across roughly 100 internal repositories before a downstream infection.
Anthropic’s September threat report describes observed misuse from December 2025 through August 2026, including agent-assisted intrusion, malware iteration and illicit model distillation. The cases are selected investigations, and humans continued to choose targets and review results.
Anthropic’s updated assessment adds a fourth evaluation incident involving an early Claude Opus 4.6 model. It describes unintended internet access, a broader transcript search and an agreement for METR investigation; evaluation models lacked the cyber safeguards used in released products.
METR details two external attacks: a fail-open authentication bug in an agent dashboard exposed a public-model API key, and a separate query endpoint could expose unpublished evaluation data. Attackers used the stolen key for credits valued at about $600,000; METR says it found no evidence that sensitive information was accessed. Its response included credential rotation, isolated public infrastructure, deployment review, expanded logging and usage alerts.
Play video
JPCERT/CC's framework compresses millions of Windows authentication events into a user-host graph, then lets a guarded agent iteratively generate database queries, evaluate results, and explore suspicious paths. It reduces the corpus to a small set of logons and returns an evidence timeline, severity, and attack narrative intended to remain auditable.
Wiz Red Agent found and validated a GitHub Actions shell injection in Snowflake's public connector repository five days after merge. Any user could trigger the workflow with a crafted issue title; direct GitHub-expression interpolation broke out of a shell string, and an ineffective condition left the job open. The agent adapted after a syntax error and exfiltrated a Jira token. Snowflake patched and rotated it the same day, with audits finding no unrelated access.
Play video
An eight-month audit of more than 1,000 Model Context Protocol projects reports over 500 distinct vulnerabilities across protocol design, language-SDK inconsistencies, and ecosystem implementations. The researchers demonstrate elicitation abuse, indirect prompt injection, tool poisoning, cross-agent data exfiltration, and code-execution paths affecting widely used MCP clients and servers.