Browse entries 241–264 of 1704. Return to the first page to search and filter the complete collection.
Adversa AI describes DeepJack, a Cursor deeplink weakness in which a crafted cursor:// link can register an attacker-controlled MCP server and hide the command that will execute behind an incomplete installation prompt.
Unit 42 analyzes TuxBot v3 Evolution, a roughly 70%-functional IoT botnet framework with code compiled for 17 architectures. Researchers found raw model reasoning, hallucinated cryptography, and other evidence of unreviewed LLM-generated code in the source.
Play video
Fuzzinglabs researchers explain how threat modeling, file-format fuzzing, and plugin analysis exposed an authentication bypass and memory-corruption issues in Ollama plus command injection in NVIDIA Triton Inference Server's model-configuration pipeline. The Pwn2Own case study also examines RedisAI, ChromaDB, and container-runtime attack surfaces.
OpenAI describes a likely PRC-origin cluster that used ChatGPT to generate political comments and cartoons, edit work reports, and plan social-media monitoring. The report distinguishes observed prompts and account links from attribution judgments and rates the operation Category One: activity on one platform with little authentic engagement and no evidence of breakout.
OpenAI's incident report says the TanStack “Mini Shai-Hulud” npm compromise affected two employee devices and exposed limited repository credentials and signing material, prompting broad session, credential, and application-certificate rotation. It reports no evidence of customer-data access, code modification, or key misuse, and identifies incomplete endpoint-policy rollout as a contributor.
Adversa's IICL study evaluates a few-shot jailbreak that interleaves benign and harmful demonstrations and uses short output-field labels to shift model behavior. Across more than 3,500 probes, ten models, and seven ablations, results vary materially with example order and field names; the work is vendor-authored and its model-specific attack rates should be independently reproduced.
OpenAI’s CoT-Control pairs benchmark problems with instructions that constrain reasoning text, then measures whether models obey those constraints while solving the task. The study finds low controllability across the tested reasoning models and examines effects of model size, reasoning length and training. These formatting and keyword constraints are proxies for the ability to hide reasoning, not direct tests of naturally motivated sabotage.
Wiz describes two cases in which credentials associated with a compromised vendor were quietly checked before larger Bedrock workloads appeared. One key initially rejected global inference profiles, but abuse resumed after the actor found permitted regional profiles. The observations support monitoring the sequence from key validation to quota probing and heavy use; reseller overlap does not establish who performed the original compromise.
SOCRadar’s October 6 investigation links an exposed operator working directory to a campaign using conventional intrusion tools alongside AI orchestration. The report describes separate opportunistic and targeted activity and supplies defensive hunting guidance for unauthorized accounts, web shells, and Redis-host access changes. Its campaign and attribution claims are the researchers’ assessment; the evidence does not make every intrusion autonomous or AI-originated.
SafeDep found the sckit implant in MemTensor’s npm plugin versions 0.1.21, 0.1.23 and 0.1.25, and MemoryOS 2.0.34 on PyPI. Execution occurs when the plugin runs or the Python library loads, so disabling install scripts is insufficient. Repository evidence points to CI publishing-token theft; initial attacker access remains unconfirmed.
Cisco Talos analyzed a Windows implant designed to select credential theft, injection or persistence actions using votes from up to four LLM providers. The public build contains placeholder API keys and a dummy webhook; Talos did not observe complete end-to-end operation. The report provides code-level findings, behavioral indicators and detection rules.
METR evaluated Opus 5.5 on five AI R&D tasks with 10 business days of API access, finding incremental gains over Fable 5.1 and persistent weaknesses on long tasks. The assessment does not evaluate alignment. A separate internal-acceleration estimate was preliminary, lacked a specified time period, and was supplied without its underlying evidence to this team.
OpenAI’s IH-Challenge pairs simple conflicting instructions at different trust levels with programmatic checks of the higher-priority constraint. Training an internal GPT-5 Mini variant improved several held-out hierarchy and prompt-injection evaluations. The task design seeks to separate instruction priority from general task difficulty and prevent trivial refusal strategies.
Play video
Harish Gaggar describes an enterprise agent platform combining a registry, workload identities, an MCP gateway, tracing, and approval steps for sensitive writes. The architecture links agent provisioning with tool access and data handling. These are useful enforcement points to inspect, but the presentation does not prove that its private controls prevent misuse or that a gateway alone confines an agent.
Hacktron reports chaining an image-processing flaw with an OpenAI SSO weakness to access employee ChatGPT and Codex accounts. Researchers used Claude with human direction and demonstrated repository access with a harmless pull request; they say they did not read internal code.
OX Research reports that DeepSeek Harness’s local control API could let a sandboxed agent disable its own confinement. The issue affected 0.1.1-rc.2 and earlier; researchers report remediation and a successful retest in 0.1.2-alpha.1.
CISA, NSA and FBI allege industrial-scale extraction of US model capabilities through distributed accounts, proxies and aggregators. Their advisory recommends correlating prompts, usage and account behavior across providers; it distinguishes these alleged campaigns from legitimate model distillation.
CloudSEK and Gambit Security report that an Aurora ransomware affiliate used Cursor for sustained Russian-language attack planning and hands-on exploitation after obtaining credentials or an existing route into victim networks. Recovered infrastructure linked the agent sessions to Active Directory discovery and escalation plans, while the broader intrusion still relied on familiar social engineering, credential theft, lateral movement, defense evasion, exfiltration, and ransomware deployment.
A joint U.S. government advisory describes threat actors using AI-assisted Python scripts and public automation libraries to find and interact with exposed Siemens S7 and other PLCs. The activity relies on known vulnerabilities and weak segmentation for reconnaissance, credential access, denial of service, and capability development rather than a novel model-specific exploit.
Paperclip vulnerabilities let malicious agent imports reach host command execution through an authorization gap in network deployments and DNS rebinding against local-trusted deployments; additional routes missed expected access checks. The reviewed code in v2026.416.0 contains the import and hostname-validation fixes, although public advisory metadata was not fully aligned and no in-the-wild exploitation was reported.
Pillar Security showed that a public GitHub issue could prompt-inject an ADK triage agent into invoking a privileged code-fixing workflow. Proofs of concept achieved CI-runner code execution and exposed bot and cloud credentials; Google removed three workflows, with no public evidence of in-the-wild exploitation.
Three trust_remote_code bypasses in Hugging Face Diffusers let a crafted model repository execute Python during pipeline loading, including cross-repository, local-snapshot, and time-of-check/time-of-use paths. The affected cases are tracked as CVE-2026-44513, CVE-2026-44827, and CVE-2026-45804; Diffusers 0.38.0 contains the fixes.
OpenAI previews GPT-5.6 Sol, a next-generation model with stronger capabilities in coding, science, and cybersecurity, paired with its most advanced safety stack.
Anthropic evaluation of model performance on exploit-development benchmarks. Relevant to cyber capability measurement, safety thresholds, and model release risk.