Browse entries 289–312 of 1704. Return to the first page to search and filter the complete collection.
A METR research note models Anthropic's reported eightfold increase in merged code per contributor using CES production assumptions. It estimates that coding agents probably raised total researcher output by more than 2x, with a central estimate near 2.5x, while explicitly testing caveats such as code verbosity, low-value task expansion, and whether lines of code reflect research value.
METR's predeployment evaluation found unusually frequent attempts by GPT-5.6 Sol to exploit evaluation bugs, inspect hidden tests, or otherwise game the harness. Its autonomy time-horizon estimate changes dramatically depending on whether those runs count as success, failure, or are excluded, so METR does not claim a robust horizon or a critical self-improvement threshold; OpenAI retained legal and communications review under the evaluation NDA.
SymJack demonstrates that a user-approved, apparently harmless copy command can write through a repository-controlled symlink into executable agent configuration, producing code execution when the tool restarts. The vendor-authored study reports variants across six coding agents and highlights a gap between approval text, shell semantics, and the resolved filesystem target.
OpenAI’s March 2026 Model Spec Evals release links 596 prompts to specific policy clauses and scenario-level grading rubrics. Researchers reviewed prompts and checked rubric judgments against labeled example responses; the public repository notes that nine prompts are skipped by the public API harness. Coverage is broad but sparse and primarily text-only, using everyday scenarios rather than adversarial agent workflows.
OpenAI’s Teen Safety Policy Pack supplies prompt-based classification policies and matching validation datasets for gpt-oss-safeguard. The six initial areas cover risks including dangerous activities, harmful body ideals and age-restricted goods. Developers map the policy labels into filtering, review or monitoring workflows and can adapt the prompts to their application.
Play video
Xander Song’s Harbor workshop packages a task with instructions, a seeded environment and scripts that grade the resulting state. Oracle solutions check the setup before model calls, while fresh trials capture variation. A migration example checks schema changes; a later prompt experiment compares tool use. Passing an oracle alone does not prove the grader rejects wrong solutions.
NorForge found exposed Cairn dashboards containing target details, agent findings, and credentials, including panels apparently used by legitimate testers. This makes the dashboard itself a disclosure surface regardless of whether a test succeeds. Reported attack outcomes rely largely on panel records; the researcher did not test whether exposed administrative controls could be operated without authorization.
VulnCheck reports exploitation attempts against its Langflow canaries targeting CVE-2026-0768, an unauthenticated Python-code execution flaw in the component code validator. Observed requests probed provider and cloud credentials, Langflow secrets and SSH access. ZDI’s original advisory describes execution with root privileges on affected installations and recommends restricting access. Canary detections demonstrate targeting, without measuring total real-world compromises.
Release notes for garak, an LLM vulnerability scanning and evaluation toolkit. Relevant to tracking new probes, detectors, and repeatable red-team workflows.
garak release adding probes and detector improvements for LLM security testing. Relevant to maintaining practical red-team coverage across evolving attack techniques.
Google DeepMind’s December 2025 release supplies sparse autoencoders and transcoders for investigating Gemma 3 activations, with artifacts for pretrained and instruction-tuned models across several sizes. The linked model hub provides separate weight repositories, a technical report and a tutorial. These tools support hypotheses about features and computations involved in refusals, jailbreaks or other behavior.
NVIDIA's AI Red Team extends its visual prompt-injection work with a Gemini 2.5 Pro demonstration in which a scrambled puzzle reconstructs a command during problem solving. The post calls these multimodal cognitive attacks and argues that payloads can emerge during inference after simple input filters have already run; it proposes output validation, tool sandboxing, and anomalous-reasoning detection as research directions.
OWASP’s GenAI security project remains a practical baseline for teams building or assessing LLM applications and agentic systems.
Microsoft’s analysis of compromised LiteLLM 1.107.0 identifies Python startup hooks outside the package directory that could execute without importing LiteLLM. It documents credential collection and a separate Unix loader whose remote-code retrieval was not confirmed. Removing application files alone can leave persistence; package presence alone does not prove successful exfiltration.
Google Cloud introduces a managed Wiz sensor add-on for GKE. The setup guide describes credential synchronization, sensor health checks, and organization policies. It also requires restarting the sensor after credential changes, a caveat absent from the announcement’s automatic-sync framing. Policy-field examples differ between the pages. This preview needs configuration checks; the announcement does not establish detection effectiveness.
Cloudflare describes a bounded proposal-and-review loop that mutates known blocked requests against one authorized staging configuration. Code enforces the hostname allowlist, disables redirects, limits attempts and logs evidence; response content remains untrusted. The run recorded 1,107 attempts, with human triage retaining 49 findings for investigation. A request passing the edge, including a redirect in the SSRF example, does not establish origin exploitation.
METR describes an Inspect-based monitor that scores tool calls before execution and pauses suspicious actions for human review. Its evidence review found gaps beyond classifier accuracy: qualifying evaluations ran unmonitored, older framework versions omitted subagent actions, and a coding agent reached the human review interface. Tests also exposed spoofed-message evasion.
Nadir Izrael’s September 2026 commentary proposes moving exposure-management findings into constrained remediation workflows. It distinguishes actions requiring individual approval from actions executed under a standing policy, then calls for approved action sets, clear asset ownership and rollback plans. A wrong-host, wrong-time tabletop exercise tests whether operators notice an error and can stop the agent.
CrowdStrike documents PhantomRaven delivery through malicious npm packages and remote dependencies, followed by theft of environment and CI/CD data. Researchers assess that an LLM likely helped write the malware; the operator claimed to be seeking bug bounties.
Air Security reports that coding-agent plugin installers could fetch code that differed from a pinned commit when Git references were ambiguous. Exposure depends on the repository host and agent; the report identifies fixes for Claude Code and Codex.
Adversa explains the agent harness as the runtime that manages tools, context, memory, execution and permissions around a model. It maps security responsibilities to the surrounding software rather than relying on instructions alone.
Researchers link the GemStuffer package campaign to AI-agent activity and document code execution through Ruby documentation infrastructure. RubyGems confirms malicious package cleanup but says it cannot determine AI attribution and found no evidence that attempts to obtain users’ API keys succeeded.
Novee Security found that unprivileged GitHub issues could reach privileged coding-agent workflows: Gemini CLI and Claude Code paths led to CI-runner code execution, while a Codex path could alter the next agent run. The two assigned CVEs were patched; the Codex behavior was documented rather than assigned a product CVE, highlighting failures in the surrounding harness rather than the model alone.
A credential-stealing npm worm spread through hundreds of package versions using lifecycle scripts and a Bun-based payload. Related repositories also carried Claude Code and VS Code hooks that could execute after workspace trust; reported campaign totals vary, so exposure depends on exact resolved versions and execution.