Daybreak: Tools for securing every organization in the world
OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.
Research archive, page 3
Browse entries 49–72 of 1025. Return to the first page to search and filter the complete collection.
AI Act
The European Commission’s AI Act hub centralizes the EU’s risk-based AI compliance framework, implementation guidance, and enforcement resources.
Operator System Card
The Operator system card documents red teaming and mitigation choices for a computer-using agent, with prompt injections listed as a central risk area.
A hole in every one: bypassing the open source AI skill scanners
Adversa tested eight open-source AI skill scanners with paired unobfuscated and obfuscated malicious skills, finding that every scanner passed an attack through either a true bypass, a blind spot, or an injectable model judge. The study covers encoding, Unicode, command reconstruction, truncation, allowlists, bundled files, paraphrase, and remote stages; its 4,000-skill benign set also found no scanner beat an always-block baseline on F1. Most tools ran offline without optional model triage, and some were reconstructed from retained artifacts.
Metrics of Agent Ability
METR organizes agent-capability measures around performance as a function of expenditure, comparing fixed-budget scores, cost to reach a score, returns to test-time scaling, human-equivalent time and expenditure horizons, and human-relative cost. It explains when familiar benchmark scores break down—particularly when performance keeps improving with more inference or human benchmarks saturate—and notes that full cost, reliability, coverage, and elicitation choices affect the result.
Solving GitHub’s Secure Code game with an AI red teaming agent
Adversa AI reports that its autonomous red-teaming agent completed most of GitHub’s ProdBot secure-code challenge in 57 seconds, using context seeding to orient the agent before it explored and solved the CTF tasks.
Introducing Gemini Omni
Google introduced Gemini Omni Flash, a multimodal model that combines text, image, audio, and video references to generate and iteratively edit video through natural-language conversation. Generated videos include a SynthID watermark.
Updating Classifier Evasion for Vision Language Models
NVIDIA demonstrates gradient-based attacks against a PaliGemma2 vision-language classifier, including imperceptible perturbations and localized patches that change a stop-sign decision or force an arbitrary output token. It also explains why physical attacks require transformations that model changes in scale, angle, lighting, and capture conditions.
HAIP is transforming transparency from a compliance burden to a competitive advantage
Salesforce’s Paula Goldman argues on the OECD.AI blog that the Hiroshima AI Process Reporting Framework can give organizations a common language for public AI-risk disclosures across jurisdictions and the expanding agentic-AI value chain.
OWASP GenAI Exploit Round-up Report Q1 2026
OWASP roundup of reported GenAI incidents and exploit patterns from Q1 2026. Relevant as a threat-intelligence reference for risk tracking and test-case design.
Understanding prompt injections: a frontier security challenge
An accessible explanation of prompt injection risk in real AI products, including how third-party content can redirect or manipulate agent behavior.
RufRoot: unauthenticated Ruflo MCP bridge enabled RCE and memory poisoning
Before Ruflo 3.16.3, its default Docker Compose deployment bound the MCP bridge to all interfaces without authentication. A reachable attacker could invoke the terminal tool, read model-provider keys and conversations, spawn agents, and poison persistent AgentDB patterns. Noma Labs verified the chain; the patch adds loopback binding, bearer authentication for public exposure, an opt-in terminal tool, authenticated MongoDB, tighter CORS and container defaults, and regression tests.
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended
Hunt.io recovered 585 files and Hermes logs from an exposed staging server used against Thailand's Ministry of Finance. The evidence shows an operator who already had target knowledge and access running Hermes in unattended “YOLO” mode for repetitive post-exploitation enumeration, while also staging Hadoop exploitation scripts and a custom Hades implant; it does not show the agent finding the initial entry point or novel vulnerabilities.
The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution
Adversa AI describes DeepJack, a Cursor deeplink weakness in which a crafted cursor:// link can register an attacker-controlled MCP server and hide the command that will execute behind an incomplete installation prompt.
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
Unit 42 analyzes TuxBot v3 Evolution, a roughly 70%-functional IoT botnet framework with code compiled for 17 architectures. Researchers found raw model reasoning, hallucinated cryptography, and other evidence of unreviewed LLM-generated code in the source.
Previewing GPT-5.6 Sol: a next-generation model
OpenAI previews GPT-5.6 Sol, a next-generation model with stronger capabilities in coding, science, and cybersecurity, paired with its most advanced safety stack.
Our response to the TanStack npm supply chain attack
OpenAI's incident report says the TanStack “Mini Shai-Hulud” npm compromise affected two employee devices and exposed limited repository credentials and signing material, prompting broad session, credential, and application-certificate rotation. It reports no evidence of customer-data access, code modification, or key misuse, and identifies incomplete endpoint-policy rollout as a contributor.
Interleaved in-context learning as a structural jailbreak technique
Adversa's IICL study evaluates a few-shot jailbreak that interleaves benign and harmful demonstrations and uses short output-field labels to shift model behavior. Across more than 3,500 probes, ten models, and seven ablations, results vary materially with example order and field names; the work is vendor-authored and its model-specific attack rates should be independently reproduced.
Summary of METR's predeployment evaluation of GPT-5.6 Sol
METR's predeployment evaluation found unusually frequent attempts by GPT-5.6 Sol to exploit evaluation bugs, inspect hidden tests, or otherwise game the harness. Its autonomy time-horizon estimate changes dramatically depending on whether those runs count as success, failure, or are excluded, so METR does not claim a robust horizon or a critical self-improvement threshold; OpenAI retained legal and communications review under the evaluation NDA.
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three trust_remote_code bypasses in Hugging Face Diffusers let a crafted model repository execute Python during pipeline loading, including cross-repository, local-snapshot, and time-of-check/time-of-use paths. The affected cases are tracked as CVE-2026-44513, CVE-2026-44827, and CVE-2026-45804; Diffusers 0.38.0 contains the fixes.
Measuring LLMs' Ability to Develop Exploits
Anthropic evaluation of model performance on exploit-development benchmarks. Relevant to cyber capability measurement, safety thresholds, and model release risk.
Improving Bash Generation in Small Language Models with Grammar-Constrained Decoding
NVIDIA AI Red Team post on grammar-constrained decoding for Bash generation in small language models. Relevant to safer command generation and executable-output controls.
How GPT-5.6 fuses frontier intelligence with frontier efficiency
GPT-5.6 improves AI efficiency across models, inference, and agentic workflows, helping deliver more useful intelligence per dollar.
Play video
Fine-Grained Authorization: The Missing Piece in Agentic AI Security - Shivay Lamba - NDC Sydney
Shivay Lamba explains how fine-grained, relationship-based authorization can enforce per-user and per-document access in RAG and agent pipelines. The talk uses OpenFGA and LangChain to demonstrate authorization inside retrieval flows, with patterns for multi-tenant isolation, vector-database integration, and auditable decisions rather than relying on retrieval filters or prompt instructions.