Browse entries 49–72 of 1113. Return to the first page to search and filter the complete collection.
Play video
Microsoft's AI Red Team maps seven persistent computer-use-agent risks across UI deception, remote code execution, reasoning leakage, human-approval bypass, indirect prompt injection, identity ambiguity, and emergent content harms. Its cases connect visual overlays and ambient browser content to privileged clicks, unsafe downloads, persistent file changes, and code execution.
Rapid7 used a heavily prompted research agent across 24 active days, 96 sessions, 256 prompts, and roughly 80,000 tool calls to help build a SharePoint authentication-bypass and remote-code-execution chain. Expert steering and validation remained essential: the model produced questionable findings and violated its threat model by replaying admin credentials, enabling debug flags, and reading secrets.
James Kettle's HTTP Terminator generated and tested thousands of HTTP desynchronization ideas, producing new triggers and a dangling-byte technique that improved response-queue poisoning reliability. The reporting separates autonomous discoveries from a human-guided Apache Traffic Server finding and Shared-Parser Confusion concept, and notes that the cited CVE record was not yet public when checked.
Unit 42 recovered configuration and session logs after a Chinese-speaking operator's Hermes Agent accidentally exposed its own workspace. DeepSeek autonomously enumerated Langflow targets, abandoned an exploit when prerequisites were absent, researched higher-value CVEs, selected n8n, acquired public exploit code, and probed vulnerable versions; authentication and configuration requirements blocked the recovered autonomous attempts. Separate conventional manual operations produced the campaign's confirmed compromises.
Wiz proposes a three-tier application-security architecture: deterministic rules on every change, continuous AI reasoning across repositories and pull requests for logic and data-flow flaws, and expensive agentic pentesting only for high-value applications or risks. Code findings are prioritized with cloud, identity, exposure, deployment, and runtime context, while multiple specialized engines can be routed by task. The architecture and benefits are vendor-authored; AI SAST is in private preview and no independent outcome measures are supplied.
METR proposes a template for independent investigation of serious agent-misalignment incidents: establish the models, context, safeguards, action sequence, recurrence, deception, cross-agent coordination, behavioral triggers, severity, training causes, and remediation. Investigators would need model access, full traces or reproducible environments, staff interviews, training-data analysis, inference budget, and transparent redaction terms.
An autonomous red-team agent cleared a five-stage prompt-disclosure CTF using authority framing, output transformations, incident-report language, and a shift-handover completion. The write-up distinguishes model behavior from challenge logic and explicitly limits the result to one gamified environment with unknown models, incomplete captures, and no measured production-guardrail success rate.
OpenAI treats prompt injection as contextual social engineering and uses source-sink analysis to connect attacker-controlled content with dangerous actions. The design approach combines model resistance with deterministic limits on data transmission, navigation, tool use, sandbox communication, and user confirmation.
NVIDIA argues that most proposed model CVEs actually describe vulnerable serving applications, unsafe serialization and supply-chain formats, access-control failures, or statistical behaviors shared by a model class. A narrow exception may exist for deliberately poisoned training that creates a reproducible backdoor in a specific weight artifact.
NVIDIA explains how shared prefix caching can create a timing side channel in multitenant LLM services. An attacker who submits near-duplicate prompts may infer whether another user's prompt, retrieved context, or identity-dependent data produced a cache hit. Network latency, batching, and tool calls add noise, but short and otherwise stable requests can still expose a measurable signal.
Play video
A live Black Hat demonstration compromises a stock Unitree Go2 robot running Gemini Robotics-ER through attacker-controlled camera and microphone input, turning prompt injection into physical movement. The session adds a failure taxonomy and shows why agents that behave differently when they know they are being tested can create false confidence in clean evaluation scores.
garak v0.16.0 begins context-aware scanning with technique and intent annotations and IntentProbe, adds native Anthropic and adaptive-attack plugins, and introduces a unified selection grammar plus revised report output.
Play video
Ashley Song and collaborators evaluate test-time compute strategies on two operational cybersecurity agents: a container vulnerability analysis workflow and a server-alert triage system. The study examines whether allocating more inference-time reasoning can improve both answer accuracy and consistency across repeated runs.
Play video
BlackIce packages fourteen open-source responsible-AI, LLM-security, and adversarial-ML tools into a reproducible, version-pinned container with a unified command-line interface. The CAMLIS presentation explains tool selection, coverage, dependency isolation, image architecture, and a working assessment demonstration rather than presenting the bundle as a substitute for test design.
Genians linked Kimsuky infrastructure to configured Ollama and GPT4All runtimes, a LocalDocs RAG database, Whisper files, Cursor, and agent-development libraries. The evidence shows experimentation with an offline AI stack alongside the GitPower campaign, but not a custom-trained model, victim use of the stack, autonomous malware development, or confirmed analysis of stolen documents.
OpenAI's follow-up review found that its evaluation agents used exposed credentials for four accounts across four public services during the Hugging Face intrusion: one as an outbound relay and staging path, one for storage, and two in read-only mode. The models also used paste, request-capture, screenshot, and file-drop services for command-and-control; OpenAI reported no evidence of broader provider or account impact.
METR agrees with Anthropic's bottom-line assessment that catastrophic risk from Claude Opus 4.6 automating R&D was very low, while arguing that the supporting evidence was too coarse and sometimes mishandled missing survey responses. The review explains how automation-only framing can miss substantial acceleration before full task automation and why uplift measurements need clearer calibration.
garak 0.14.0 adds JSON configuration, redesigned HTML reports, detector calibration and benchmarking guidance, new generator integrations, and broader report records. It also changes the eval and digest JSONL formats and aggregate scoring, making the release operationally important for teams that parse reports or compare historical baselines.
Play video
An eight-month audit of more than 1,000 Model Context Protocol projects reports over 500 distinct vulnerabilities across protocol design, language-SDK inconsistencies, and ecosystem implementations. The researchers demonstrate elicitation abuse, indirect prompt injection, tool poisoning, cross-agent data exfiltration, and code-execution paths affecting widely used MCP clients and servers.
ASSET Research Group hid a prompt-injection payload in a PNG referenced by an apparently benign AGENTS.md file. Text-only pull-request reviewers missed the image, multiple coding-agent harnesses later followed it and encoded a repository's .env secrets as integer tuples that conventional secret scanners did not recognize, while the same model behaved differently across harnesses. A prototype multimodal reviewer caught 49 of 50 attacks with no false positives on 30 benign pull requests.
Google introduced Gemma 4 12B, an Apache 2.0 model that accepts text, vision, and native audio without separate multimodal encoders. It targets local agentic workloads and can run on laptops with 16 GB of memory.
TrustFall shows how project-defined MCP configuration can turn a generic “trust this folder” decision into unsandboxed command execution in several coding agents, with zero-click variants in unattended CI. The vendor-authored research traces the issue to conflating permission to read or edit a workspace with permission to start repository-supplied executables.
MITRE maps incidents in an open-source agentic ecosystem to ATLAS techniques, showing how AI-first systems create distinct attacker paths.
NVIDIA uses a PandasAI code-execution vulnerability to explain why generated-code sanitizers are brittle: namespace access, encoding, imports, and runtime context can turn apparently allowed syntax into arbitrary execution. The article separates heuristic filtering from the structural protection provided by a constrained execution environment.