Browse entries 217–240 of 1704. Return to the first page to search and filter the complete collection.
Parameter reports a fixed ChatGPT vulnerability in which an isolated Preview sent messages to a privileged MathLive listener. Unchecked HTML created a frame with the main site’s origin, and an allowed script source completed the chain. Controlled tests read private conversations across accounts. Parameter says both frontend versions rejected the messages by October 26; it reports no exploitation against real users.
TrendAI compares three attacker infrastructures targeting Japan: an autonomous CyberStrikeAI workflow, human-led AI assistance and suspected AI-generated tooling. Its evidence comes from exposed attacker files, not victim telemetry. Many listed targets lack evidence of deep compromise, and stylistic clues remain inferential. Exposed administration, reused credentials and AI services recur as entry points.
Play video
Why it ranks: directly applicable to AI security practice; demonstrates an actionable operational method.
John Feminella describes a registry that records agent owners, purposes, tools and endpoints, then supplies policy to managed runtimes. Risk-based review and shared evaluation infrastructure accompany those controls. Explicit rules handle routine decisions; ambiguous actions escalate. This is an architectural account, not an independently tested implementation or evidence that classifiers are reliable by default.
Play video
Why it ranks: directly applicable to AI security practice; strong implementation or testing value.
Daksh Gupta describes a review agent built from a sandbox, a PR webhook and a model harness. His practical evaluation method replays pull requests linked to past incidents, targets recurring bug classes and suppresses low-value comments. Codebase context and executable application flows supplement review. Vendor catch-rate and cost claims are not independently established.
V12’s x402 review found three critical trust-boundary failures: unbounded automatic payments, login signatures for a different website and Solana approvals accepted as transfers. Local tests supported the findings; the payment-bypass test did not submit a live transaction. V12 says the critical issues were fixed by August 20, 2026. No exploitation in the wild was established.
Microsoft’s ARTEX investigation describes abuse of already trusted ConnectWise applications, followed in some tenants by Microsoft Graph activity and credential or privilege changes. Such changes can preserve access after the original app is contained. Successful authentication alone does not prove data access or exfiltration; responders need to correlate sign-ins with subsequent actions.
Play video
Gautam Korlam connects rising agent-generated commit volume with merge queues, earlier checks, and durable approval records. Independently passing changes can fail in combination, while an approval can outlive the code it reviewed. The transferable controls are validation of the actual merged revision and retained evidence of who approved what. The presentation does not independently establish vendor throughput or compliance claims.
Play video
This workshop Q&A covers configuration in CI/CD, long-running tools, and resource separation for customer-facing agents. Current documentation treats agent definitions as versioned resources and metadata as tracking fields. Labelling a session with a customer ID is not an authorization boundary. A deployment needs deliberate credential and resource separation, and self-hosted execution also requires the operator to supply its own sandbox controls.
Play video
This Strands workshop adds tool-call limits and workflow checks to a small customer-service agent before deployment. Current SDK documentation distinguishes cancelling one tool call, cancelling a batch, and ending the agent loop. These are different controls: returning an error for a blocked tool can still leave the model running. Skills and prompts describe the intended workflow; hooks supply code-level intervention points.
Play video
Fuad Ali follows a shopping assistant that returns products outside a requested budget from trace investigation to a proposed repair and evaluation. Public Arize skills and the Rosetta Stone sample expose tracing and evaluation workflows. The transferable method is to connect a failing request to code, construct an explicit correctness check, and replay relevant cases before release. A generated diagnosis or judge score remains evidence to review, not an automatic approval.
Play video
Micah Silverman’s student-assistant exercise contrasts instructions to hide grades with limiting the data supplied to the model. The linked mitigation repository implements a formatter that omits grades and a frontend that displays messages with textContent rather than interpreting HTML. These are inspectable controls outside the prompt. They address specific exposure paths; the example does not establish complete application security or per-user authorization.
Play video
Suchet Bargoti demonstrates remotely coordinated drones and explains Skydio’s division of autonomy between aircraft and cloud services. Immediate control stays on the vehicle; cloud models support heavier reasoning, shared maps and tool-based task planning. Fleet observations feed later updates. The talk illustrates how an operator can shift attention between aircraft, while its stated reliability target is not a measured fleet-wide success rate.
Trail of Bits describes an AI-assisted discovery of a Lean string-handling mismatch that allowed native evaluation to support a false proof. The report explicitly distinguishes this from a kernel soundness failure and explains the extra trust introduced by native_decide.
Unit 42 describes an enterprise intrusion completed in under ten hours, with observed activity consistent with AI assistance and an attacker claiming agent use. The chain moved from a public web service through repository secrets and administrative credentials into CI/CD and cloud AI access. Branch protection blocked attempted Terraform backdoors. The investigation highlights overlapping persistence and abuse of the victim’s own AI services after compromise.
Play video
Palo Alto Networks researchers found the same command-parser, protected-path, and sandbox-boundary failures across major coding agents. Their survey produced more than 81 vendor reports and 18 assigned or reserved CVEs, including allowlist bypasses through compound shell syntax, path-equivalence errors, unsafe moves and symlinks, and gaps between file and terminal controls.
Across 90 days of AI-service honeypots, Wiz observed exploitation of LiteLLM MCP flaws, blind prompt injection that used out-of-band callbacks to confirm agent shell execution, and post-exploitation tailored to steal model-provider and proxy credentials from process memory. The activity targeted AI infrastructure as ordinary high-value cloud infrastructure.
Play video
The NDSS-backed research identifies six inference-time cache attacks across vLLM, SGLang, GPTCache, and related stacks. Weak prefix and image cache keys plus semantic near-match errors can make distinct inputs share cached state, enabling poisoned responses, information leakage, and moderation bypass; the authors provide experimental artifacts and vendor disclosures.
Adversa compares ten shipped or research-stage zero-click agent compromises, including EchoLeak, DuneSlide, TrustFall, ShadowLeak, GeminiJack, and Morris II. The recurring chain is untrusted retrieved content entering model context, an agent applying inherited privileges, and data or code escaping through images, cloud requests, browser navigation, email, or a developer shell.
An Anthropic and EPFL preprint tests self-propagating instructions in sandboxed agent chains whose MEMORY.md and SOUL.md files persist across sessions. Writes to the system-loaded soul file produced most propagation attempts and infected the next agent 55% of the time; all four action payloads survived some 20-hop trials. A one-paragraph warning reduced tested spread to near zero, and the researchers found no successful wild propagation in archived Moltbook data.
Varonis' CoSnitch research combines Copilot Personal's q parameter with an undocumented autorun parameter so one crafted link executes an attacker prompt inside a signed-in session. The prompt can read already authorized mail, calendars, Drive metadata, chat history, and memory, then exfiltrate data through Copilot's URL fetch. A separate web-summarization path could persist attacker instructions in memory. Microsoft patched CVE-2026-24301 on August 18.
Play video
Drawing on nine years of cross-industry ML deployments, Megan Robertson explains why a statistically accurate model can still fail to deliver in production. The session moves beyond offline performance to scoping, organizational failure modes, monitoring, maintainability, and the operational conditions required for a model to keep producing useful results.
A review of nine coding-agent incidents from 2025 and 2026 separates shell, path, and harness failures from constraint decay and excessive permissions, then maps them to concrete controls for identities, filesystems, approvals, verification, logging, and backups.
Before Ruflo 3.16.3, its default Docker Compose deployment bound the MCP bridge to all interfaces without authentication. A reachable attacker could invoke the terminal tool, read model-provider keys and conversations, spawn agents, and poison persistent AgentDB patterns. Noma Labs verified the chain; the patch adds loopback binding, bearer authentication for public exposure, an opt-in terminal tool, authenticated MongoDB, tighter CORS and container defaults, and regression tests.
Hunt.io recovered 585 files and Hermes logs from an exposed staging server used against Thailand's Ministry of Finance. The evidence shows an operator who already had target knowledge and access running Hermes in unattended “YOLO” mode for repetitive post-exploitation enumeration, while also staging Hadoop exploitation scripts and a custom Hades implant; it does not show the agent finding the initial entry point or novel vulnerabilities.