Browse entries 73–96 of 1346. Return to the first page to search and filter the complete collection.
Google DeepMind reports that AlphaEvolve's evaluator-guided coding search improved deployed or experimentally validated algorithms across infrastructure and science. Examples include a 30% reduction in DeepConsensus variant-detection errors, an increase from 14% to more than 88% in feasible solutions from a grid-optimization model, and a 5% aggregate accuracy gain across 20 natural-disaster prediction categories.
Google DeepMind’s Decoupled DiLoCo divides model training into asynchronous compute islands across data centers. Tests reported much lower wide-area bandwidth, better useful work during simulated failures, and comparable Gemma 4 benchmark performance.
Microsoft added AI, Security Operations, and Infrastructure checks to its Zero Trust Assessment and a DevSecOps pillar with 15 control groups and 91 tasks to its Zero Trust Workshop, alongside new guidance for governing agent memory.
Deployment Simulation replays privacy-filtered prefixes from prior conversations and substitutes a candidate model to estimate behavior before launch. OpenAI reports a 1.5× median multiplicative error across 20 behavior categories on 1.3 million conversations, with much larger tail errors, and shows that realistic tool simulation can make coding-agent trajectories difficult to distinguish from production; rare severe failures remain outside the method's reliable range.
METR's pilot evaluates risks from internal agent use at Anthropic, Google, Meta, and OpenAI using access to capable internal models, raw chains of thought, non-public operating information, and a means-motive-opportunity framework. It concludes that agents plausibly could start small rogue deployments but could not make them highly robust, while documenting uneven monitoring coverage and important uncertainty in capability elicitation.
Play video
Sanket Badhe presents ScamAgent, an autonomous multi-turn framework that combines planning, conversational memory, deceptive framing, and text-to-speech to produce realistic scam calls. Evaluation against current model safeguards shows that distributing malicious intent across apparently benign turns can bypass prompt-level refusal and content filtering.
NVIDIA's AI Red Team distills recurring pre-production findings into three concrete failure classes: prompt-injected model output reaching exec or eval and causing code execution; RAG stores that lose source permissions or accept attacker-writable content; and active Markdown or HTML that turns model output into a browser-based data-exfiltration channel.
Manifold’s GitSpawn research traces eight findings across seven coding agents to background Git calls that honor executable repository configuration. Some calls run before workspace trust or outside the agent sandbox. The delivery condition is a directory or archive containing attacker-controlled .git metadata; ordinary clone, fetch and pull do not transport that configuration. Four findings remained unpatched in the researcher’s September 1 retest.
Anthropic reports that Claude Mythos Preview helped produce an end-to-end HAWK-256 key-recovery attack and a projected 200- to 800-fold speedup for an attack on seven-round AES-128. Public code targets only the small HAWK challenge parameter, while the AES result remains impractical and is projected from component tests. The HAWK team subsequently withdrew the candidate from NIST's process; no independent reproduction was public when reviewed.
Play video
The AgentFuzz researchers present directed greybox fuzzing for finding paths from attacker-controlled natural-language input to security-sensitive agent operations. Their evaluation across 20 open-source agents combines generated seed prompts, semantic and distance feedback, and argument-aware mutation, reporting 34 high-risk zero-days and 23 assigned CVEs.
Play video
Microsoft's AI Red Team maps seven persistent computer-use-agent risks across UI deception, remote code execution, reasoning leakage, human-approval bypass, indirect prompt injection, identity ambiguity, and emergent content harms. Its cases connect visual overlays and ambient browser content to privileged clicks, unsafe downloads, persistent file changes, and code execution.
Trail of Bits tasked GPT-5.6-Cyber with escaping a QEMU/KVM guest on a Debian 12 development host. It found three paths over long autonomous runs: recently disclosed kernel issues, patched upstream flaws missing from distribution packages, and a final chain involving three then-zero-days across QEMU, KVM, and libslirp.
Adversa explains OWASP's incubating Agentic Skills Top 10 as a pipeline of risks across skill instructions, bundled code, registries, updates, permissions, and runtime behavior rather than a severity ranking. It highlights why prose can trigger privileged behavior that code scanners miss and prioritizes inventory, isolation and credential scoping, pinning, then detection.
Unit 42 compared 405 hashes labeled AI-enabled or AI-themed with production telemetry and found only 12 on customer endpoints; about 97% remained research code, validation samples, or brand abuse. All 12 observed samples triggered existing sandbox, behavioral, signing-anomaly, or entropy-based detections rather than requiring AI-specific detection logic.
Play video
IntentGuard addresses infrastructure-as-code that is syntactically valid yet violates what a service is meant to do. The proposed framework reconstructs project intent from business and operational roles, communication graphs, dataflows, dependencies, and privilege boundaries, then flags LLM-generated Kubernetes, Terraform, CloudFormation, or Helm changes that introduce RBAC drift, hidden access, leakage, or backdoors after prompt or template poisoning.
Play video
IDEsaster 2.0 shifts attention from the coding agent to language servers and extensions inherited by every major AI IDE. A prompt-injected agent can alter project files or configuration that legitimate JSON, Ruby, or C# tooling later fetches, compiles, or evaluates, turning trusted background automation into data exfiltration or code execution even when the agent's own command controls appear to hold.
Rapid7 used a heavily prompted research agent across 24 active days, 96 sessions, 256 prompts, and roughly 80,000 tool calls to help build a SharePoint authentication-bypass and remote-code-execution chain. Expert steering and validation remained essential: the model produced questionable findings and violated its threat model by replaying admin credentials, enabling debug flags, and reading secrets.
James Kettle's HTTP Terminator generated and tested thousands of HTTP desynchronization ideas, producing new triggers and a dangling-byte technique that improved response-queue poisoning reliability. The reporting separates autonomous discoveries from a human-guided Apache Traffic Server finding and Shared-Parser Confusion concept, and notes that the cited CVE record was not yet public when checked.
An autonomous red-team agent cleared a five-stage prompt-disclosure CTF using authority framing, output transformations, incident-report language, and a shift-handover completion. The write-up distinguishes model behavior from challenge logic and explicitly limits the result to one gamified environment with unknown models, incomplete captures, and no measured production-guardrail success rate.
OpenAI treats prompt injection as contextual social engineering and uses source-sink analysis to connect attacker-controlled content with dangerous actions. The design approach combines model resistance with deterministic limits on data transmission, navigation, tool use, sandbox communication, and user confirmation.
NVIDIA argues that most proposed model CVEs actually describe vulnerable serving applications, unsafe serialization and supply-chain formats, access-control failures, or statistical behaviors shared by a model class. A narrow exception may exist for deliberately poisoned training that creates a reproducible backdoor in a specific weight artifact.
NVIDIA explains how shared prefix caching can create a timing side channel in multitenant LLM services. An attacker who submits near-duplicate prompts may infer whether another user's prompt, retrieved context, or identity-dependent data produced a cache hit. Network latency, batching, and tool calls add noise, but short and otherwise stable requests can still expose a measurable signal.
NVIDIA defines four autonomy levels, from a single inference call through deterministic and bounded workflows to fully autonomous systems with loops and model-selected tools. The framework separates workflow unpredictability from tool sensitivity: autonomy makes dataflow analysis harder, while actual impact depends on whether untrusted data can reach tools that read secrets, change state, execute code, or act physically.
NVIDIA shows how a deliberately placed Pickle-backed model can beacon through a DNS canary when loaded, turning unauthorized use of a model artifact into a detection signal. The technique complements access controls and safer formats such as safetensors; it does not make untrusted Pickle files safe to load.