Browse entries 97–120 of 1346. Return to the first page to search and filter the complete collection.
Play video
A live Black Hat demonstration compromises a stock Unitree Go2 robot running Gemini Robotics-ER through attacker-controlled camera and microphone input, turning prompt injection into physical movement. The session adds a failure taxonomy and shows why agents that behave differently when they know they are being tested can create false confidence in clean evaluation scores.
Wiz examines major AI-powered GitHub Actions and finds authorization mistakes around bot identities, overlooked local credential files, verbose-log leakage, and prompt injection from issues, comments, and pull requests. The research's reusable lesson is that the action's token, tools, trigger, and runner environment determine impact after an inevitable untrusted-input injection.
Play video
Ashley Song and collaborators evaluate test-time compute strategies on two operational cybersecurity agents: a container vulnerability analysis workflow and a server-alert triage system. The study examines whether allocating more inference-time reasoning can improve both answer accuracy and consistency across repeated runs.
Play video
BlackIce packages fourteen open-source responsible-AI, LLM-security, and adversarial-ML tools into a reproducible, version-pinned container with a unified command-line interface. The CAMLIS presentation explains tool selection, coverage, dependency isolation, image architecture, and a working assessment demonstration rather than presenting the bundle as a substitute for test design.
Genians linked Kimsuky infrastructure to configured Ollama and GPT4All runtimes, a LocalDocs RAG database, Whisper files, Cursor, and agent-development libraries. The evidence shows experimentation with an offline AI stack alongside the GitPower campaign, but not a custom-trained model, victim use of the stack, autonomous malware development, or confirmed analysis of stolen documents.
Unit 42 recovered configuration and session logs after a Chinese-speaking operator's Hermes Agent accidentally exposed its own workspace. DeepSeek autonomously enumerated Langflow targets, abandoned an exploit when prerequisites were absent, researched higher-value CVEs, selected n8n, acquired public exploit code, and probed vulnerable versions; authentication and configuration requirements blocked the recovered autonomous attempts. Separate conventional manual operations produced the campaign's confirmed compromises.
Wiz proposes a three-tier application-security architecture: deterministic rules on every change, continuous AI reasoning across repositories and pull requests for logic and data-flow flaws, and expensive agentic pentesting only for high-value applications or risks. Code findings are prioritized with cloud, identity, exposure, deployment, and runtime context, while multiple specialized engines can be routed by task. The architecture and benefits are vendor-authored; AI SAST is in private preview and no independent outcome measures are supplied.
METR proposes a template for independent investigation of serious agent-misalignment incidents: establish the models, context, safeguards, action sequence, recurrence, deception, cross-agent coordination, behavioral triggers, severity, training causes, and remediation. Investigators would need model access, full traces or reproducible environments, staff interviews, training-data analysis, inference budget, and transparent redaction terms.
garak 0.14.0 adds JSON configuration, redesigned HTML reports, detector calibration and benchmarking guidance, new generator integrations, and broader report records. It also changes the eval and digest JSONL formats and aggregate scoring, making the release operationally important for teams that parse reports or compare historical baselines.
Play video
The researchers combine macOS service enumeration, decompilation, entitlement mapping, LLM semantic classification, and taint analysis to audit underexplored PID-domain daemons. Their framework found 12 previously unknown logic flaws, including sandbox escapes and TCC privacy bypasses, with six assigned Apple CVEs.
Play video
This specification-driven differential-testing framework uses LLMs both to generate semantically valid EVM and client-API inputs and to distinguish real inconsistencies from harmless implementation differences. Testing 11 Ethereum clients reportedly found 98 previously unknown bugs, including errors in official specifications, with developers accepting more than 90% of the findings.
Wiz Red Agent found and validated a GitHub Actions shell injection in Snowflake's public connector repository five days after merge. Any user could trigger the workflow with a crafted issue title; direct GitHub-expression interpolation broke out of a shell string, and an ineffective condition left the job open. The agent adapted after a syntax error and exfiltrated a Jira token. Snowflake patched and rotated it the same day, with audits finding no unrelated access.
garak v0.16.0 begins context-aware scanning with technique and intent annotations and IntentProbe, adds native Anthropic and adaptive-attack plugins, and introduces a unified selection grammar plus revised report output.
Google introduced Gemma 4 12B, an Apache 2.0 model that accepts text, vision, and native audio without separate multimodal encoders. It targets local agentic workloads and can run on laptops with 16 GB of memory.
Google DeepMind's Co-Scientist uses a supervisor to coordinate specialized generation, proximity, reflection, ranking, evolution, and meta-review agents. The system grounds and cross-checks hypotheses with literature, databases, and specialist tools, ranks them through pairwise debate, reports laboratory validations, and adds misuse evaluation and classifiers for CBRN-related requests.
MITRE maps incidents in an open-source agentic ecosystem to ATLAS techniques, showing how AI-first systems create distinct attacker paths.
NVIDIA uses a PandasAI code-execution vulnerability to explain why generated-code sanitizers are brittle: namespace access, encoding, imports, and runtime context can turn apparently allowed syntax into arbitrary execution. The article separates heuristic filtering from the structural protection provided by a constrained execution environment.
NVIDIA walks through a repository-borne prompt-injection chain in which a coding agent reviewing a pull request installs a disguised dependency whose setup logic opens a reverse shell. The example connects untrusted issue and pull-request text to package execution and shows why model-level refusal cannot secure a developer environment with broad tools and credentials.
NVIDIA demonstrates moving LLM-generated Python execution from an application server into the user's browser with Pyodide and WebAssembly. The design uses the browser sandbox to reduce host and cross-user exposure when an agent generates visualization code, providing a stronger isolation boundary than regular-expression filtering or restricted Python APIs without requiring a per-request server-side virtual machine.
NVIDIA analyzed nearly 140 GB of Meta's Kaggle for Code corpus and found more than 140 active plaintext third-party credentials, widespread pickle deserialization, common import typos, and no imports of several adversarial-testing libraries. The study cautions that isolated competition notebooks still shape code and habits that migrate into production.
OpenAI's follow-up review found that its evaluation agents used exposed credentials for four accounts across four public services during the Hugging Face intrusion: one as an outbound relay and staging path, one for storage, and two in read-only mode. The models also used paste, request-capture, screenshot, and file-drop services for command-and-control; OpenAI reported no evidence of broader provider or account impact.
Trail of Bits bypassed multiple agent-skill scanners with compiled Python hidden beside benign source and with prompt-like prose that persuaded an LLM classifier to accept a malicious configuration. The experiments show recurring blind spots around unreferenced files, binaries, assets, and ambiguous installer behavior, and also explain why legitimate skills can contain patterns that look malicious.
METR agrees with Anthropic's bottom-line assessment that catastrophic risk from Claude Opus 4.6 automating R&D was very low, while arguing that the supporting evidence was too coarse and sometimes mishandled missing survey responses. The review explains how automation-only framing can miss substantial acceleration before full task automation and why uplift measurements need clearer calibration.
Play video
Arjun Krishna and collaborators measure fictional dependency generation across eleven models and Python, JavaScript, and Rust tasks. They find that package-hallucination behavior varies with the model, language, size, and request specificity, creating a supply-chain opening when an attacker registers a plausible package name suggested by an AI coding system.