Operator System Card
The Operator system card documents red teaming and mitigation choices for a computer-using agent, with prompt injections listed as a central risk area.
Research archive, page 8
Browse entries 169–192 of 1704. Return to the first page to search and filter the complete collection.
Play video
FSTab: test recurring security flaws across AI-generated application features
The FSTab research maps visible application features to recurring static-analysis findings in code generated by a known model family. It builds model-specific tables from generated examples and tests transfer to held-out applications and domains. Reported attack success means overlap with scanner findings, not confirmed compromise; model identification, feature labeling and scanner errors limit the conclusions.
VPC Service Controls: verify inherited protection before moving projects
Google Cloud adds folder-based VPC Service Controls membership, letting projects inherit a perimeter. Explicit settings and hierarchy moves can change the effective protection. Documentation also identifies a critical exception: explicitly adding a VPC network project to a dry-run perimeter removes its inherited folder-based enforcement. Test actual access decisions; a dry-run label alone does not establish safety.
OSS Scanner: prepare an offline build and triage unverified vulnerability reports
Anthropic’s OSS Scanner accepts maintainer enrollment through a project configuration, a build container and an optional threat model. Dependencies are installed during the network-enabled build; the audit then runs offline. Maintainers can specify untrusted inputs, excluded components, severity criteria and the evidence expected in a report. The delivered findings are model-generated and have not undergone human review.
OpenAI’s GPT-6 guide treats agent performance as a workflow measurement problem
OpenAI’s October 2026 guide recommends evaluating GPT-6-family models on complete tasks, balancing successful outcomes against latency and cost. It describes stable prompt prefixes for caching, explicit tool and authority boundaries, and context compaction that preserves important evidence during long work. Model selection and reasoning effort become variables to test against the application’s own acceptance criteria.
Strengthen your CI/CD pipeline with new Secure Source Manager capabilities
Google Cloud adds granular CODEOWNERS approval rules and Developer Connect integration to Secure Source Manager. The implementation supports per-path and per-branch approvers, independent review sections and private CI/CD connectivity.
The sorry state of skill distribution
Trail of Bits bypassed multiple agent-skill scanners with compiled Python hidden beside benign source and with prompt-like prose that persuaded an LLM classifier to accept a malicious configuration. The experiments show recurring blind spots around unreferenced files, binaries, assets, and ambiguous installer behavior, and also explain why legitimate skills can contain patterns that look malicious.
Memory Is a Feature. It Is Also an Attack Surface
OWASP analysis of memory and context poisoning as an agent attack surface. Relevant to persistent state, trust boundaries, and regression tests for agent memory.
Updating Classifier Evasion for Vision Language Models
NVIDIA demonstrates gradient-based attacks against a PaliGemma2 vision-language classifier, including imperceptible perturbations and localized patches that change a stop-sign decision or force an arbitrary output token. It also explains why physical attacks require transformations that model changes in scale, angle, lighting, and capture conditions.
How Code Execution Drives Key Risks in Agentic AI Systems
NVIDIA uses a PandasAI code-execution vulnerability to explain why generated-code sanitizers are brittle: namespace access, encoding, imports, and runtime context can turn apparently allowed syntax into arbitrary execution. The article separates heuristic filtering from the structural protection provided by a constrained execution environment.
From Assistant to Adversary: Exploiting Agentic AI Developer Tools
NVIDIA walks through a repository-borne prompt-injection chain in which a coding agent reviewing a pull request installs a disguised dependency whose setup logic opens a reverse shell. The example connects untrusted issue and pull-request text to package execution and shows why model-level refusal cannot secure a developer environment with broad tools and credentials.
Malicious agent packages: verify model destinations and audit evidence
Elastic found fake Web3 accelerator packages that delivered malware, redirected a repackaged coding agent to attacker-controlled model services, and added an MCP server. Its instrumented test showed locally read file content entering later model requests. Separate audit tools returned invented findings. The legitimate-looking agent still worked; provider labels and plausible reports did not establish where data went or whether a scan ran.
garak 0.17.1: distinguish repeated-attempt success from unscored tests
garak 0.17.1 adds hit@k, estimating whether at least one of k sampled tries succeeds, averaged across eligible prompts. Prompts with fewer than k scoreable outputs are excluded and their coverage must be tracked. It also fixes FileDetector so an unexamined file is not counted as a pass. These changes affect how results are interpreted; a score change after upgrading need not mean the target model changed.
Chrome exploit research: challenge assumptions about immutable state
XBOW describes a Chrome exploit chain built with substantial human direction and model assistance. Across V8, WebP processing, and Crashpad, the analysis exposes assumptions about state remaining unchanged across trust boundaries. Humans selected targets, challenged outputs, and integrated the chain. The reported six days followed earlier research and is not a measure of fully autonomous discovery or total effort.
AI agents in an OT lab: examine segmentation and preauthenticated access
Booz Allen’s lab study describes agents exploring unfamiliar operational technology and finding paths through imperfect segmentation and existing sessions. Some device controls blocked attempted actions. Operators approved exploitation and physical actions, so the results do not demonstrate unattended takeover of arbitrary industrial systems. The practical lesson is to inspect access paths across engineering workstations, networks, and controllers.
Play video
Agent autonomy reviews: measure missed issues and assign decision owners
Michele Grant uses an illustrative integration workflow to connect agent authority with named owners, a decision log, and staged review. The proposed scorecard pairs business baselines with error severity and independent sampling. Financial calculations stay in deterministic code. Once reviewers focus on exceptions, missed issues need their own measurement; fewer overrides can also reflect weaker scrutiny. The scenario is an operating framework, not a measured deployment result.
Play video
Agent deployment reviews: preserve decision evidence and bound authority
Paden Gayle uses an illustrative bank document assistant to explain deployment reviews. The proposed evidence pack records intended use, data lineage, failure modes, segment-level evaluation, and controls with named owners. Saving the actual input, configuration, output, and reviewer action enables reconstruction; rerunning a model may produce a different decision. The framework does not itself establish compliance.
Docker Sandboxes fixes host-file and socket boundary escapes
Docker documents two Sandboxes flaws fixed in 0.42.0: a macOS shared-filesystem path issue exposing host files, and a socket-relay race that could reach host sockets outside the workspace. Both require malicious code running inside an affected guest.
Wiz describes correlating agent traces with runtime security events
Wiz describes a staged detection pipeline that filters model input and output logs, applies deeper analysis and correlates suspicious actions with cloud and runtime events. Its validation set contains simulated attacks and benign workflows; the product is in private preview.
Mandiant traces a poisoned dependency through an active coding-assistant session
Mandiant describes an intrusion at an unnamed SaaS provider where an active coding-assistant session recommended a poisoned package. The reported chain stole developer OAuth tokens and spread Shai-Hulud across roughly 100 internal repositories before a downstream infection.
Anthropic’s September threat report: AI-assisted operations and their limits
Anthropic’s September threat report describes observed misuse from December 2025 through August 2026, including agent-assisted intrusion, malware iteration and illicit model distillation. The cases are selected investigations, and humans continued to choose targets and review results.
Anthropic expands review of unintended internet access during evaluations
Anthropic’s updated assessment adds a fourth evaluation incident involving an early Claude Opus 4.6 model. It describes unintended internet access, a broader transcript search and an agreement for METR investigation; evaluation models lacked the cyber safeguards used in released products.
Update on Security at METR
METR details two external attacks: a fail-open authentication bug in an agent dashboard exposed a public-model API key, and a separate query endpoint could expose unpublished evaluation data. Attackers used the stolen key for credits valued at about $600,000; METR says it found no evidence that sensitive information was accessed. Its response included credential rotation, isolated public infrastructure, deployment review, expanded logging and usage alerts.
Play video
Black Hat Asia 2026 | Graph-Aware LLM for Windows Logon with a Closed-Loop Guarded Detection Agent
JPCERT/CC's framework compresses millions of Windows authentication events into a user-host graph, then lets a guarded agent iteratively generate database queries, evaluate results, and explore suspicious paths. It reduces the corpus to a small set of logons and returns an evidence timeline, severity, and attack narrative intended to remain auditable.