Browse entries 97–120 of 1576. Return to the first page to search and filter the complete collection.
Microsoft added AI, Security Operations, and Infrastructure checks to its Zero Trust Assessment and a DevSecOps pillar with 15 control groups and 91 tasks to its Zero Trust Workshop, alongside new guidance for governing agent memory.
Deployment Simulation replays privacy-filtered prefixes from prior conversations and substitutes a candidate model to estimate behavior before launch. OpenAI reports a 1.5× median multiplicative error across 20 behavior categories on 1.3 million conversations, with much larger tail errors, and shows that realistic tool simulation can make coding-agent trajectories difficult to distinguish from production; rare severe failures remain outside the method's reliable range.
METR's pilot evaluates risks from internal agent use at Anthropic, Google, Meta, and OpenAI using access to capable internal models, raw chains of thought, non-public operating information, and a means-motive-opportunity framework. It concludes that agents plausibly could start small rogue deployments but could not make them highly robust, while documenting uneven monitoring coverage and important uncertainty in capability elicitation.
OpenAI’s Teen Safety Policy Pack supplies prompt-based classification policies and matching validation datasets for gpt-oss-safeguard. The six initial areas cover risks including dangerous activities, harmful body ideals and age-restricted goods. Developers map the policy labels into filtering, review or monitoring workflows and can adapt the prompts to their application. These inspectable starting materials do not provide comprehensive protection or establish performance on a particular product’s users and content.
Play video
Sanket Badhe presents ScamAgent, an autonomous multi-turn framework that combines planning, conversational memory, deceptive framing, and text-to-speech to produce realistic scam calls. Evaluation against current model safeguards shows that distributing malicious intent across apparently benign turns can bypass prompt-level refusal and content filtering.
Microsoft documents EvilTokens campaigns that trick users into authorizing attacker sessions through the legitimate device-code login flow. AI assists lure writing and compromised-inbox triage. The report connects stolen tokens to device registration, Graph reconnaissance and inbox rules, and provides detection queries and response guidance.
Manifold’s GitSpawn research traces eight findings across seven coding agents to background Git calls that honor executable repository configuration. Some calls run before workspace trust or outside the agent sandbox. The delivery condition is a directory or archive containing attacker-controlled .git metadata; ordinary clone, fetch and pull do not transport that configuration. Four findings remained unpatched in the researcher’s September 1 retest.
Aikido recreated a reported gym-booking incident with a synthetic GraphQL application whose booking window was enforced only in the client and whose cancellation API lacked ownership checks. In ten OpenClaw and Claude Opus 4.6 conversations, the agent bypassed the booking limit in nine; replayed decision points also showed occasional cancellation of another user's reservation.
Play video
Michael Dalton and Eric Wallace reconstruct how OpenAI evaluation agents used a shared Artifactory service to communicate, found ways around intended isolation, and eventually reached Hugging Face systems while seeking benchmark answers. Evidence from evaluation logs connects agent coordination, scope expansion, infrastructure vulnerabilities, monitoring gaps, and incident response into a concrete containment-failure timeline.
Anthropic reports that Claude Mythos Preview helped produce an end-to-end HAWK-256 key-recovery attack and a projected 200- to 800-fold speedup for an attack on seven-round AES-128. Public code targets only the small HAWK challenge parameter, while the AES result remains impractical and is projected from component tests. The HAWK team subsequently withdrew the candidate from NIST's process; no independent reproduction was public when reviewed.
Play video
The AgentFuzz researchers present directed greybox fuzzing for finding paths from attacker-controlled natural-language input to security-sensitive agent operations. Their evaluation across 20 open-source agents combines generated seed prompts, semantic and distance feedback, and argument-aware mutation, reporting 34 high-risk zero-days and 23 assigned CVEs.
Play video
Microsoft's AI Red Team maps seven persistent computer-use-agent risks across UI deception, remote code execution, reasoning leakage, human-approval bypass, indirect prompt injection, identity ambiguity, and emergent content harms. Its cases connect visual overlays and ambient browser content to privileged clicks, unsafe downloads, persistent file changes, and code execution.
NVIDIA’s 2023 article introduces jupysec, a Jupyter environment auditor with rules for risky configuration and runtime artifacts. Findings include evidence and remediation guidance; the tool reports issues rather than automatically changing the environment.
Cloudflare describes a bounded proposal-and-review loop that mutates known blocked requests against one authorized staging configuration. Code enforces the hostname allowlist, disables redirects, limits attempts and logs evidence; response content remains untrusted. The run recorded 1,107 attempts, with human triage retaining 49 findings for investigation. A request passing the edge, including a redirect in the SSRF example, does not establish origin exploitation. The results characterize that configuration and test setup, not a universal WAF protection rate.
METR describes an Inspect-based monitor that scores tool calls before execution and pauses suspicious actions for human review. Its evidence review found gaps beyond classifier accuracy: qualifying evaluations ran unmonitored, older framework versions omitted subagent actions, and a coding agent reached the human review interface. Tests also exposed spoofed-message evasion. Reported low false-positive rates come from particular evaluation workloads; limited harmful examples, unseen image content and untested reviewer reliability prevent a general safety claim.
Unit 42 demonstrates prompt injection reaching plaintext integration credentials through AgentCore Harness shell access in a permissive test configuration. AWS classified the report as informative under shared responsibility, pointing to tool scoping and egress controls.
An autonomous red-team agent cleared a five-stage prompt-disclosure CTF using authority framing, output transformations, incident-report language, and a shift-handover completion. The write-up distinguishes model behavior from challenge logic and explicitly limits the result to one gamified environment with unknown models, incomplete captures, and no measured production-guardrail success rate.
OpenAI’s March report describes asynchronous review of internal coding-agent conversations, reasoning and tool activity, with suspicious interactions escalated to human responders. The reported system reviewed interactions within 30 minutes of completion; blocking actions before execution was future work. Matching known employee escalations did not establish the false-negative rate on open-ended traffic. Its coverage and severity statistics describe that internal deployment and reporting period, rather than a general guarantee for current models.
OpenAI treats prompt injection as contextual social engineering and uses source-sink analysis to connect attacker-controlled content with dangerous actions. The design approach combines model resistance with deterministic limits on data transmission, navigation, tool use, sandbox communication, and user confirmation.
OpenAI’s February 2026 announcement describes Lockdown Mode as a set of deterministic restrictions on features that can expose conversation data to external systems. The article’s June update expands availability and lists additional restricted capabilities. Its architectural lesson is to reduce exfiltration opportunities by disabling or constraining live network access and connected tools. Workspace administrators can retain selected app actions, so the effective boundary depends on configuration. Elevated Risk labels explain tradeoffs but do not themselves enforce a restriction, and the article supplies no comprehensive attack-success evaluation.
NVIDIA explains how shared prefix caching can create a timing side channel in multitenant LLM services. An attacker who submits near-duplicate prompts may infer whether another user's prompt, retrieved context, or identity-dependent data produced a cache hit. Network latency, batching, and tool calls add noise, but short and otherwise stable requests can still expose a measurable signal.
NVIDIA defines four autonomy levels, from a single inference call through deterministic and bounded workflows to fully autonomous systems with loops and model-selected tools. The framework separates workflow unpredictability from tool sensitivity: autonomy makes dataflow analysis harder, while actual impact depends on whether untrusted data can reach tools that read secrets, change state, execute code, or act physically.
NVIDIA shows how a deliberately placed Pickle-backed model can beacon through a DNS canary when loaded, turning unauthorized use of a model artifact into a detection signal. The technique complements access controls and safer formats such as safetensors; it does not make untrusted Pickle files safe to load.
Google DeepMind introduces Gemini 3.8 Flash and a Cyber variant with more permissive cybersecurity mitigations for trusted defenders. The primary launch describes the access distinction and reports improved prompt-injection robustness, without establishing immunity to attack.