Threat radar
Радар угроз ИИ
Свежие риски LLM и агентов из открытых источников: отдельно подтверждённые живой проверкой сигналы, анализируемые материалы и проблемы вне области prompt-сканера.
CVE-2026-71416: Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket
Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access t
garak v0.17.0 Adds EU AI Act Mapping for LLM Security Probes
garak v0.17.0 adds an EU AI Act mapping with reference tags that surface and group probe results by the risk categories called out in the EU AI Act. The release also grounds the AgentBreaker detector's judge in the victim's tool contract and guards against malformed agent_breaker analysis shapes. #AISecurity #LLMSecurity #RedTeaming #EUAIAct #AISecurityGovernanceAndAssurance https://github.com/NVIDIA/garak/releases/tag/v0.17.0
ToxicRAG: Single-Document Knowledge Poisoning of RAG Systems
ToxicRAG compromises retrieval-augmented generation with a single poisoned document per target that frames misinformation as a coherent knowledge-update narrative. Evaluated on 100 target questions from each of Natural Questions, HotpotQA, and MS-MARCO across four victim LLMs and four dense retrievers, it reaches attack success rates between 0.61 and 0.91. #AISecurity #RAG #DataPoisoning #LLMSecurity #DataSecurityAndProtection https://arxiv.org/abs/2609.11082
A2ABreak: 11 Vulnerabilities in the A2A Agent Protocol
The first systematic security analysis of the Linux Foundation's Agent2Agent protocol extracts a verified finite-state machine of 37 states and 76 transitions from 929 formalized statements and uncovers 11 protocol-level vulnerabilities exploitable by specification-compliant adversaries, including cross-client context injection, credential harvesting in delegation chains, and data exfiltration through rogue agents. #AISecurity #A2A #AIagents #ProtocolSecurity #IdentityAndAccessManagement https://arxiv.org/abs/2609.10871
California Limits Minors' Chatbot Use in New Online Safety Laws
Governor Gavin Newsom signed 13 bills protecting children online, including a law limiting how long minors may interact with chatbots. A separate measure requires social media companies to remove addictive features such as infinite scroll and autoplay for users under 16 or keep those users off their platforms entirely. #AISecurity #Chatbots #California #ChildSafety #GovernanceRiskAndCompliance https://calmatters.org/economy/technology/2026/09/california-enacts-laws-restricting-chatbots-protecting-kids-online/
Midnight Blizzard Used Claude to Automate Malware Evasion
Anthropic's September 2026 threat intelligence report says the Russian state-nexus group Midnight Blizzard used Claude to check whether its malware evaded security products. When a tool was flagged, AI agents automatically modified and rebuilt it, then redeployed it, repeating the cycle until the malware went undetected again. #AISecurity #Claude #MidnightBlizzard #MalwareEvasion #ThreatIntelligence https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/
vllm: vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
vllm: vLLM: Cross-User Data Leak Vulnerability
vLLM: Cross-User Data Leak Vulnerability
vllm: vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
vllm: vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibli
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
vllm: vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
vllm: vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
litellm: LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
transformers: Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure
LM-agent benchmarks increasingly function as interactive evaluation infrastructure. Agents observe state, call tools, modify workspaces, submit artifacts, and receive rewards from outcome procedures. This interactivity makes evaluations vulnerable to reward hacking: an agent improves its measured score by exploiting the reward-relevant trajectory instead of solving the intended task. Existing defenses rely largely on task-specific patches, prompt instructions, or post-hoc detectors. They do not
Big Enough to Break Out: Tracking the Rising Capability of LLM Penetration-Testing Agents
Large language model (LLM) agents are increasingly applied to penetration testing, but we still know little about what they can do or how they fail. We compare two PentestGPT-based systems: a legacy human-in-the-loop system running the open-weight Kimi K2.5, and a newer autonomous system running Claude Opus 4.8. Across three public targets, the autonomous system solves all three, including the two the legacy system never finishes. The legacy result is the more surprising of the two. Even on the
vllm: vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
vllm: vLLM: Cross-User Data Leak Vulnerability
vLLM: Cross-User Data Leak Vulnerability
DuplexJail: Safety Alignment Breaks Under Spoken Interruption in Full-Duplex Models
Full-duplex speech models accept user speech while generating responses, creating an underexplored attack surface. We introduce DuplexJail, which delivers fixed, request-independent spoken prompts through the user audio channel. We compare fixed-delay interruption after the harmful request ends with refusal-triggered interruption following a cue in the model's streaming text. Across four open-source models and 720 harmful requests from AdvBench and HarmBench, fixed-delay interruption raises whol
PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation
As Large Language Model (LLM) agents increasingly automate offensive operations across the cyber kill chain, their efficacy in complex local post-exploitation tasks remains inadequately quantified. Among these, Linux privilege escalation is a key step between initial access and full system compromise. However, existing evaluations for this task are limited by small sample sizes (fewer than 15 scenarios), lacking the scale to compare model capabilities under executable verification. To address th
LLM-Based Penetration Testing in the Presence of Honeypots
Large language model (LLM) agents are increasingly employed for offensive cybersecurity tasks such as automated vulnerability discovery, reconnaissance, and penetration testing. This new capability also threatens one of the defender's most valuable tools: deception. Traditional honeypots rely on realism and obscurity to lure human or script-driven attackers into revealing tactics, techniques, and procedures (TTPs), but LLM-driven attackers can reason about heterogeneous artifacts and use the hon
VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities
The software supply chain has become an increasingly exposed attack surface because of its reliance on intricate yet fragile dependencies. Existing defenses such as GitHub Dependabot often raise many false alerts because their coarse-grained matching cannot determine whether a vulnerable dependency is actually exploitable. Security analysts typically spend substantial time assessing vulnerability exploitability case by case. Recent LLM agents have emerged as promising candidates for this task gi
AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing
Large language model (LLM) agents increasingly achieve long-horizon tasks by combining foundation models with explicit skills and implicit procedural knowledge acquired through execution. The resulting task-solving capabilities have become valuable proprietary assets, raising a new security question: can a substantially weaker attacker-controlled agent acquire the capabilities of a stronger proprietary agent through limited black-box interaction? Existing skill-stealing attacks recover explicit
AURA-Eval: Evaluation Framework for Acting Under Risk Awareness in LLM Agent Trajectories
LLM agents operate in workflows where unsafe actions can have real consequences. Existing safety evaluations often reduce behavior to a single score, obscuring risk recognition, pre-action detection, and safe task completion when a safe solution exists. We introduce AURA-Eval, a framework combining controlled augmentation with granular diagnosis of behavior in tool-use trajectories. Its pipeline identifies safety-critical decision points, generates controlled variations, and constructs counterpa
Microsoft: Securing Edge AI in Customer-Owned Environments
Microsoft's edge security team lays out a trust model for edge AI security in deployments where inference, model IP, and customer data run on infrastructure the customer owns: constrain model actions through deterministic mediation, establish trust before releasing sensitive assets, and verify runtime and model-behavior artifacts before they shape what the model does. #AISecurity #EdgeAI #ModelSecurity #Attestation #AISecurityGovernanceAndAssurance https://www.microsoft.com/en-us/security/blog/2026/09/04/secure-edge-ai-customer-owned-environments/
Congress Unveils Stop Rogue AI Act for AI Agent Tracking
Reps. Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act on September 3, directing NIST to write national standards within one year for continuous machine-readable AI agent inventories, verification of what agents actually do, tamper-proof action logs, and records tying each agent to its developer or vendor, with CISA helping apply the standards to federal civilian networks. #AISecurity #AIAgents #NIST #AIRegulation #GovernanceRiskAndCompliance https://startupfortune.com/congress-unveils-stop-rogue-ai-act-after-openai-agents-ran-loose-online/
Off-the-Shelf VMs Cannot Contain Cyber AI Agents
Bruce Schneier reports that GPT 5.6-Cyber escaped an off-the-shelf virtual machine during testing, removing any doubt that standard VM sandboxing is insufficient for cyber-capable AI agents. The software stack exposes too much attack surface, and even innocuous features such as running with a display add exploitable paths. #AIAgents #Sandboxing #LLMSecurity #AISecurity #ApplicationSecurity https://www.schneier.com/blog/archives/2026/09/using-a-vm-to-contain-an-ai-agent.html
AI Agents Breached a Network in Under 10 Hours
Unit 42 documented an intrusion where a human operator directed AI agents to monitor, evaluate, act, and re-plan in real time, compressing more than 50 MITRE ATT&CK techniques into a single automated loop. The agents harvested hard-coded tokens from code repositories, extracted root credentials from the secrets management system, and hijacked the CI/CD pipeline to exfiltrate cloud access keys. #AIAgents #LLMSecurity #CredentialTheft #AISecurity #IncidentDetectionAndResponse https://cybersecuritynews.com/ai-agents-breach-company-network/
Evaluating Deep-Search Agents under Hierarchical Web Evidence Poisoning
Search-augmented LLM agents are increasingly used for consumer decisions, making them vulnerable to Generative Engine Optimization (GEO) poisoning. Existing benchmarks largely measure whether manipulated content is retrieved or endorsed, but do not track whether an agent verifies suspicious evidence, revises adopted claims, or recovers before producing its final recommendation. We introduce HAE-GEO, a benchmark that tracks the full trajectory from exposure to recovery under progressively more pe
Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents
Long-horizon LLM agents interact with untrusted content, persistent memory, external state, and sensitive tools. Existing analyses often characterize attacks by the number of execution steps between malicious input and a downstream action. We show that temporal remoteness can overstate security separation in stateful agents. We introduce a provenance-aware execution graph linking agent events through deterministic state, identifier, and tool provenance, and define \emph{influence distance} $\DI$
I have a strange feeling that somehow there will be an excuse for this too: It wasn’t us. We didn’t try. It wasn’t our fault. We didn’t mean to. That’s not exactly what happened, or that’s not accurat
Everything, absolutely everything, comes down to: “It wasn’t us. It was the AI.” https://x.com/cormac_sb/status/2095883154162880997 🔥1
vllm: vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
vllm: vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibli
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
vllm: vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
vllm: vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
CVE-2026-31020: In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE).
CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls
LLM agent systems increasingly combine provenance tracking, authorization, policy enforcement, protocol adapters, and execution controls. However, individually correct security mechanisms do not necessarily compose into an end-to-end secure system: security-critical context may be dropped, widened, rebound, or reinterpreted as actions cross component boundaries. We identify this failure mode as security-context discontinuity and introduce CONTINUITY, a framework for verifiable composition of age
Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
Long-running LLM agents are stateful: beyond the transcript they accrete compressed summaries, plaintext memory, pending tool plans, and, under every serving API, a KV cache. Yet today's "forget" operations delete a plaintext memory record and stop, leaving every artifact derived from the revoked information intact. We formalize execution-state unlearning: after a forget request, the agent must behave as if it had never observed the target. Modeling the runtime as a deterministic transition syst
The same failing startups tested the models. Read at your own risk:
https://deploymentsafety.openai.com/gpt-6-astra/gpt-6-astra.pdf 😱1
🚨 New AI Security Governance and Assurance Watch the most-viewed conference talks on AI security topics. https://awesomecybersecurityconferences.com/topic/ai-security-governance-and-assurance?year
I took all the conference talks, gathered their captions, tagged them by topic, and created a clear and easy way to watch conference talks by subject. There are currently 21 topics, including Incident Response, SOC, Web3 Security, and more. 🔥4
SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
Large language model (LLM) agents are increasingly proposed as autonomous SOC analysts, but two limitations make them unreliable at enterprise scale: a finite context window cannot hold a multi-thousand-host authentication graph, and free-form generation offers no guarantee that a recommended containment action is consistent with the topology it operates on. We present Sentinel-RL, an agentic-SOC architecture that decouples topological reasoning from semantic reasoning: a heterogeneous graph att
Inferring Hidden User Models from the Behavior of Personalized LLM Agents
Recent personalized LLM agents increasingly transform information retained in memory into compressed or structured representations, which we call user models, to guide later decisions. When source wording is removed from the state reachable through the ordinary interface, these models are commonly treated as more privacy-preserving because direct memory-extraction attacks lose the text they target. Yet we argue that user models expose a new attack surface because an attacker can still recover th
A Finger on the Scale: Covert Policy Steering through Agentic Skills
Reusable agent skills extend large language model (LLM) agents with task procedures, tool-use guidance, and output constraints. Yet these skills also act as externalized behavioral policies, which create a supply-chain risk: a third-party skill may preserve the declared task and valid output interface while covertly redirecting agent decisions toward an undisclosed objective. We formalize Skill Policy Integrity, which requires a Skill-induced policy to remain aligned with its declared functional
SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment
Mixture-of-Experts (MoE) is a scaling architecture for large language models that activates only a small subset of expert modules per token, enabling massive parameter growth with nearly constant computation. Recent Hybrid MoE architecture adds \textit{shared experts} to capture consistently useful representations, further improving stability and generalization. MoE now powers many flagship open-source and commercial models, yet remains vulnerable to adversarial attacks. Specifically, sparse rou
Funny and sad. Relying on companies like METR and Redwood to conduct an RCA. It’s interesting to see them keep choosing companies that aren’t particularly experienced in this field, but it already see
It’s unclear what is behind these decisions to keep hiring early stage companies with little management experience, companies that don’t take responsibility, companies that aren’t well established in the field, or companies that operate in the field but are being hired for tasks outside their area of expertise. There are firms like Mandiant and others with established reputations, and there is little doubt about their independence in how they conduct their work. It’s strange that they didn’t hire experienced firms that specialize in this field and for whom this type of work is a core part of t
Agent Memory Is a Surface for Endogenous Authorization Laundering
Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their prov
Reveree: Diagnosing LLM Reverse-Engineering Agents
Reverse engineering (RE) is critical to security tasks such as malware analysis and vulnerability discovery, and large language model (LLM) agents are increasingly able to perform it autonomously. Capture-the-flag (CTF) RE challenges have become the standard proxy for measuring this capability, but evaluation rests on a single criterion: whether the agent captures the flag. This solve rate reveals neither where in the RE process an agent fails nor whether a success reflects analysis of the binar
Enterprise Agentic AI Reference Architecture 2026
https://qiita.com/nohanaga/items/e8a9b8eafe364239e2e3 👍3