Browse entries 145–168 of 1346. Return to the first page to search and filter the complete collection.
Across 90 days of AI-service honeypots, Wiz observed exploitation of LiteLLM MCP flaws, blind prompt injection that used out-of-band callbacks to confirm agent shell execution, and post-exploitation tailored to steal model-provider and proxy credentials from process memory. The activity targeted AI infrastructure as ordinary high-value cloud infrastructure.
Play video
The NDSS-backed research identifies six inference-time cache attacks across vLLM, SGLang, GPTCache, and related stacks. Weak prefix and image cache keys plus semantic near-match errors can make distinct inputs share cached state, enabling poisoned responses, information leakage, and moderation bypass; the authors provide experimental artifacts and vendor disclosures.
Adversa compares ten shipped or research-stage zero-click agent compromises, including EchoLeak, DuneSlide, TrustFall, ShadowLeak, GeminiJack, and Morris II. The recurring chain is untrusted retrieved content entering model context, an agent applying inherited privileges, and data or code escaping through images, cloud requests, browser navigation, email, or a developer shell.
An Anthropic and EPFL preprint tests self-propagating instructions in sandboxed agent chains whose MEMORY.md and SOUL.md files persist across sessions. Writes to the system-loaded soul file produced most propagation attempts and infected the next agent 55% of the time; all four action payloads survived some 20-hop trials. A one-paragraph warning reduced tested spread to near zero, and the researchers found no successful wild propagation in archived Moltbook data.
Varonis' CoSnitch research combines Copilot Personal's q parameter with an undocumented autorun parameter so one crafted link executes an attacker prompt inside a signed-in session. The prompt can read already authorized mail, calendars, Drive metadata, chat history, and memory, then exfiltrate data through Copilot's URL fetch. A separate web-summarization path could persist attacker instructions in memory. Microsoft patched CVE-2026-24301 on August 18.
Play video
Drawing on nine years of cross-industry ML deployments, Megan Robertson explains why a statistically accurate model can still fail to deliver in production. The session moves beyond offline performance to scoping, organizational failure modes, monitoring, maintainability, and the operational conditions required for a model to keep producing useful results.
Adversa tested eight open-source AI skill scanners with paired unobfuscated and obfuscated malicious skills, finding that every scanner passed an attack through either a true bypass, a blind spot, or an injectable model judge. The study covers encoding, Unicode, command reconstruction, truncation, allowlists, bundled files, paraphrase, and remote stages; its 4,000-skill benign set also found no scanner beat an always-block baseline on F1. Most tools ran offline without optional model triage, and some were reconstructed from retained artifacts.
Play video
Ari Herbert-Voss reviews three years of progress in autonomous offensive-security systems, evaluates where they can already complete meaningful attack tasks, and separates those capabilities from work that still needs human expertise. The talk frames scalable, parallel attack simulation as a challenge to point-in-time testing rather than as a product announcement.
METR organizes agent-capability measures around performance as a function of expenditure, comparing fixed-budget scores, cost to reach a score, returns to test-time scaling, human-equivalent time and expenditure horizons, and human-relative cost. It explains when familiar benchmark scores break down—particularly when performance keeps improving with more inference or human benchmarks saturate—and notes that full cost, reliability, coverage, and elicitation choices affect the result.
Adversa AI reports that its autonomous red-teaming agent completed most of GitHub’s ProdBot secure-code challenge in 57 seconds, using context seeding to orient the agent before it explored and solved the CTF tasks.
OpenAI describes a likely PRC-origin cluster that used ChatGPT to generate political comments and cartoons, edit work reports, and plan social-media monitoring. The report distinguishes observed prompts and account links from attribution judgments and rates the operation Category One: activity on one platform with little authentic engagement and no evidence of breakout.
Google introduced Gemini Omni Flash, a multimodal model that combines text, image, audio, and video references to generate and iteratively edit video through natural-language conversation. Generated videos include a SynthID watermark.
NVIDIA demonstrates a model supply-chain attack in which a privileged adversary edits a tokenizer JSON file so visible words map to different token IDs. The change can make the model interpret "deny" as "allow" or corrupt decoded output while leaving the model weights untouched.
Salesforce’s Paula Goldman argues on the OECD.AI blog that the Hiroshima AI Process Reporting Framework can give organizations a common language for public AI-risk disclosures across jurisdictions and the expanding agentic-AI value chain.
Wiz describes controls for agent-assisted software delivery: inventory models, frameworks, IDE extensions, infrastructure-as-code, and third-party CI actions; map code to deployed resources; run pre-commit checks for secrets and unsafe AI patterns; and expose excessive pipeline permissions and prompt-injection paths.
OWASP roundup of reported GenAI incidents and exploit patterns from Q1 2026. Relevant as a threat-intelligence reference for risk tracking and test-case design.
Play video
RIG-RAG converts changing cloud configuration data into a typed, security-enriched graph for natural-language investigation and scheduled oversight. The authors report a production AWS deployment supporting 300,000 users, with interactive queries for analysts and curated recurring questions that detect infrastructure drift and expose relationships such as public reachability and identity access.
CloudSEK and Gambit Security report that an Aurora ransomware affiliate used Cursor for sustained Russian-language attack planning and hands-on exploitation after obtaining credentials or an existing route into victim networks. Recovered infrastructure linked the agent sessions to Active Directory discovery and escalation plans, while the broader intrusion still relied on familiar social engineering, credential theft, lateral movement, defense evasion, exfiltration, and ransomware deployment.
A joint U.S. government advisory describes threat actors using AI-assisted Python scripts and public automation libraries to find and interact with exposed Siemens S7 and other PLCs. The activity relies on known vulnerabilities and weak segmentation for reconnaissance, credential access, denial of service, and capability development rather than a novel model-specific exploit.
Paperclip vulnerabilities let malicious agent imports reach host command execution through an authorization gap in network deployments and DNS rebinding against local-trusted deployments; additional routes missed expected access checks. The reviewed code in v2026.416.0 contains the import and hostname-validation fixes, although public advisory metadata was not fully aligned and no in-the-wild exploitation was reported.
A review of nine coding-agent incidents from 2025 and 2026 separates shell, path, and harness failures from constraint decay and excessive permissions, then maps them to concrete controls for identities, filesystems, approvals, verification, logging, and backups.
Before Ruflo 3.16.3, its default Docker Compose deployment bound the MCP bridge to all interfaces without authentication. A reachable attacker could invoke the terminal tool, read model-provider keys and conversations, spawn agents, and poison persistent AgentDB patterns. Noma Labs verified the chain; the patch adds loopback binding, bearer authentication for public exposure, an opt-in terminal tool, authenticated MongoDB, tighter CORS and container defaults, and regression tests.
Hunt.io recovered 585 files and Hermes logs from an exposed staging server used against Thailand's Ministry of Finance. The evidence shows an operator who already had target knowledge and access running Hermes in unattended “YOLO” mode for repetitive post-exploitation enumeration, while also staging Hadoop exploitation scripts and a custom Hades implant; it does not show the agent finding the initial entry point or novel vulnerabilities.
Adversa AI describes DeepJack, a Cursor deeplink weakness in which a crafted cursor:// link can register an attacker-controlled MCP server and hide the command that will execute behind an incomplete installation prompt.