Reading list

A malicious retriever checkpoint can steer an otherwise unchanged search agent by repeatedly placing an attacker-chosen, existing document in its top results. In tests with two retrievers and two question-answering datasets, the target appeared in the top three for 99.8–100 percent of tested questions and drove extra search rounds. A decoy that could later be removed also weakened the tested detectors. The attacker controls the retrieval model, not the corpus or agent; the result is a local benchmark finding, not a measured production compromise.

Poisoning five demonstrations, 10 percent of the training set, made a visuomotor policy take attacker-chosen physical actions when a visual trigger appeared. On the tested FANUC and xArm tasks, the wrong action occurred in 8–10 of 10 triggered rollouts. An off-task visual sanitization step restored nominal behavior in one small comparison, but assumes this kind of trigger. The evidence is compelling for the tested policy and tasks, not a general result for all robot or vision-language systems.

A researcher who can train and export a model, but cannot export patient scans, can encode images into its weights and reconstruct them after export. The paper fits up to 99 brain MRI volumes into a functional 30 MB model; the recovered images are approximate but anatomically recognizable. Fine-tuning, pruning, and quantization did not reliably erase the channel in these experiments. It is a strong reason to treat model export as a data-export decision, while keeping the claim short of demonstrated patient re-identification.

Behavior-preserving permutations of model weights serve both sides of this problem: an attacker can encode a payload in the permutation, while a defender can re-permute all parameters to disrupt extraction with little measured quality loss. The attack still needs a separate loader to execute anything, and the defense assumes the model can be safely loaded and its symmetries identified. That distinction between hidden bytes, extraction, and execution makes this a useful companion to EvilModel.

Python runtimes execute bytecode directly through .pyc files, compiled-only modules, and marshalled code objects, which opens an inspection-execution gap that source-centric package security misses entirely. Across 1,034,843 PyPI artifacts they found 7,388 containing bytecode, including 28,193 source-less .pyc files local to an artifact. The tooling is not robust either: real and adversarially mutated bytecode drove decompilers into managed exceptions, timeouts, and native process failures. The same shape as the model-format problem one ecosystem over, since what the scanner can read is not what the runtime will execute.

Existing VLM backdoors bind fixed triggers to a fixed target set at poisoning time. This one implants a programmable backdoor from a single poisoning phase, so the attacker picks previously unseen target-caption semantics at inference and synthesizes a matching stealthy trigger on demand. The mechanism is a feature-space trigger steganography that maps any specified caption to a visual trigger, paired with a poisoning strategy that teaches trigger-as-instruction rather than a memorized pattern. Decoupling target selection from poisoning is what turns a backdoor into a channel.

Adapter-agnostic defenses merge the adapter into the base model first, which dilutes exactly the signal they are hunting for. LoRAScan stays adapter-aware and rejects trigger-bearing inputs at inference time from activation spikes in the down-projection, rather than condemning the whole adapter and requiring separate mitigation. Worth reading beside the weight-space LoRA detector: one screens the artifact before use, this one screens the traffic during it.

Three pickle deserialization attacks that abuse the Pickle VM external module import mechanism to execute payloads during load. The Overwritten variant evades 63 percent of scanners, up to 50 percent better than prior attacks, across ten state-of-the-art scanners and four model hosting platforms. Read this against any argument that scanning solves pickle: the format keeps the execution path, so the scanner is left guessing at intent.

A trigger-gated additive modification of an intermediate representation, dormant by default and producing zero change on clean inputs, carried in the shared model artifact rather than in the learned weights. One implant compromises visual question answering, text-to-image, retrieval, and ranking fairness at once. The framing is the part worth keeping: a VLM deployment inherits executable behavior encoded in the artifact, not just parameters, so the proposed audit reads the distributed logic instead of the weights.

DLR-Lock replaces each pretrained MLP with a deep low-rank residual network that increases activation memory during fine-tuning and creates architectural mismatches that frustrate standard optimization. Tested against adaptive attackers with full knowledge of the defense. Framing the goal as locking rather than watermarking shifts from post-hoc detection to resistance, which is a different threat model.

Trellis-coded quantization encodes model weights using error-correcting code structure; the Viterbi decoding step is non-differentiable, which breaks gradient flow during QAT. BCJR-QAT replaces Viterbi with the forward-backward sum-product algorithm to restore end-to-end differentiability. Trellis-coded weight encoding is the quantization scheme most directly analogous to steganographic embedding; this advances its training-side infrastructure.

Sparse Backdoor hides a trigger-gated perturbation in image-classifier weights beneath Gaussian dither. Under a stated margin condition and Sparse-PCA hardness assumption, distinguishing those weights from a particular dithered clean reference is at least as hard as Sparse PCA. That is a meaningful limit on weight-only detection in the paper's game, not a proof that every behavioral audit fails.

Pushes provably-secure linguistic steganography toward higher embedding capacity by maintaining a list of candidate decodings rather than a single one. Directly relevant to the entropy-budget question in any LLM-mediated covert-channel design.

Style-level (not token- or syntax-level) backdoor triggers, generated by an LLM as a poisoned-sample synthesizer. Adds an auxiliary target loss to stabilize payload injection during fine-tuning. Evaluated against seven model families.

Poisoned samples form isolated latent-space clusters early in training because triggers dominate their feature representation. CSC exploits this: cluster, segregate, relabel to a virtual class, fine-tune. Near-zero ASR across four datasets and twelve attack variants with minimal clean accuracy loss. The trigger design that makes poisoned samples distinctive to the model also makes them distinctive to an auditor.

Chat templates are Jinja2 programs that run on every inference call, which makes them a code channel that ships alongside the weights without touching them. Triggered backdoors dropped factual accuracy from 90 percent to 15 percent across eighteen models and hijacked tool use across 3,868 agent episodes, and the poisoned artifacts passed every scan on the largest open model distribution platform. Same attack surface as the Llama-Drama template work, aimed at distribution rather than at a parser bug.

Pulls five spectral statistics from the low-rank updates across the Q, K, V, and O projections, giving a 20-dimensional signature per adapter, then trains a logistic regression on it. 100 percent accuracy on unseen adapters across Llama-3.2-3B, Qwen2.5-3B, and Gemma-2-2B, spanning instruction-following, reasoning, QA, code, and classification. Detection that needs neither the trigger nor a forward pass is exactly the property a hub needs, since it cannot execute everything it stores.

The canonical reference for byte-level steganography in float32 weight tensors. Explicitly defers the decoder to a separately-deployed loader, which is the substantive limitation when read against a channel/decoder/substrate framework.

Origin paper for trigger-based co-trained backdoors. The decoder and the channel are baked into the network's weights together, which is why detection has to be behavioral rather than static.

Instead of searching for one reusable prompt, Red-TTT updates a small attacker adapter for each harmful behavior and victim model. In single-turn HarmBench tests against four models at 120 target queries per behavior, its mean classifier-judged success was 72.4 percent against 55.9 percent for a query-matched Best-of-N baseline; a separate judge preserved the ordering. The target-call budget is comparable, but the attacker's local training cost is additional, and these results do not establish multi-turn or tool-use success.

A paired baseline and adversarial test of single-turn text jailbreaks across eight open-weight systems, 264 seed prompts, and eleven hazard categories. Unsafe responses rose from 11.08 to 18.65 percent, a 7.57-point average resilience gap. The more useful contribution is the evaluation discipline: it calibrates automated grading against human labels and reports measurement error, so a jailbreak score has an explicit baseline and a known scope. It says nothing about multi-turn agents or tool execution.

One evaluation harness counted the choice of a tool as attacker success without checking whether its arguments carried the malicious action. Rescoring the same 258 traces cut apparent success from 21.7 to 1.2 percent; a separate delivery defect silently dropped 91 percent of injected payloads. The replacement checks delivery, task capability, trace, and final effect. These are measurements of one simulated five-tool suite, not a new ranking of frontier defenses, but they show how a broken harness can manufacture a result.

MMPIBench places attacker instructions in images read by agents and traces the result from perception through planning to a tool call. Across 720 visual runs, 92 were judged to attempt compliance but only eight completed the attacker objective; the main break came when models recognized the instruction and declined to act. Its smaller audio study reached far fewer model-framework combinations and used a different task framing, so the higher audio completion rate is not a like-for-like comparison. The value is separating exposure, attempted compliance, tool use, and final effect.

Attack success rate depends on how many target calls an attack is allowed, and most studies report it without holding that budget constant, so the comparisons are not comparable. Fair-ASR fixes a shared target-call budget and tracks attacker calls separately for efficiency. Re-evaluating 11 representative attacks, rankings change substantially across budgets, simple stochastic perturbations and hand-crafted templates stay highly competitive under equal target access, and none of the evaluated LLM-driven methods was efficient in both dimensions. A headline number that hides its budget is the same disease as an injection rate that hides its decomposition.

Four years on, prompt injections are still documented as verbatim strings, which makes them hard to compare, label, or mutate without fragile string matching. This proposes a seven-component model, carrier, delivery vector, concealment, context-break, privilege escalation, payload, and return channel, as five artifact fields plus two environment fields. Because models compile many surface wordings into the same executable action, the labels have to track attacker intent, tool targets, and sinks instead of the wording. Naming the parts is what lets you argue about coverage rather than trade examples.

Generates realistic source-aware test cases for indirect prompt injection and evolves them through feedback-driven exploration, instead of sampling from a fixed library of known payloads. Localizes which injected source caused the failure rather than only reporting that the agent failed. It stays effective with defenses deployed, which is the evaluation condition most red-teaming papers quietly skip.

Puts LLM operator agents in a simulated nuclear power plant control room and runs adaptive multi-turn attacks against the operator team. Between 8.7 and 12.1 percent of attack sessions across four models ended in loss of a critical safety function, and the vulnerabilities were distinct per model rather than overlapping. The transferable part is the harness rather than the scenario: single-turn refusal rates say almost nothing about how an agent holds up over a session.

28 jailbreaks across five benchmarks, Claude models from Haiku 4.5 to Opus 4.6. The capability tax scales inversely with model strength: Haiku 4.5 loses 33.1% average capability under jailbreaks, Opus 4.6 loses 7.7%. The most sophisticated attacks approach zero degradation. Safety assessments that rely on capability loss as a self-limiting mechanism are working from a false premise.

Four attack methods targeting the visual processing path of VLMs: encoding harmful instructions as visual symbols with a legend, object substitution, text replacement in images, and visual puzzles. A visual cipher achieved 40.9% ASR on Claude-Haiku-4.5 vs. 10.7% for the text equivalent. The gap quantifies how little text-focused safety training transfers to vision.

DR-Smoothing adds a two-stage prompt processing scheme: disrupt the input, then rectify it back toward a normal distribution before passing to the model. Prior disrupt-only methods left the model seeing out-of-distribution prompts. The rectification step removes that problem while preserving disruption as the defense layer. Includes theoretical bounds on defense success probability.

Rather than training a standalone jailbreak classifier, this uses embedding disruption to re-activate the model's own internal safeguards for detection. The defense reuses what the model already knows. Effective against adaptive attacks in evaluation. Same authors as DR-Smoothing; this paper covers detection, DR-Smoothing covers the defense-side response.

Adds cross-attention at the final eighth of transformer layers to give system prompts a structurally distinct processing path rather than treating them identically to user input. At 8B scale: +7.4% on IFEval, +16.3% on multi-turn instruction adherence, -13% many-shot jailbreaking ASR. The architectural approach rather than a tuning one is what makes the gains scale-consistent.

Recasts jailbreaking as inference-time policy optimization in an adversarial decision process. A self-evolving metacognitive loop diagnoses the target's defense logic and refines the attack trajectory through structured feedback. 89.2% average ASR across 10 models including 76.0% on O1 and 78.0% on GPT-5-chat, at 8.2x lower compute than prior methods.

819 test cases for evaluating safety in LLM agents operating in actual operating systems. Identifies Execution Hallucination: agents verbally refuse a request while the harmful OS-level action completes undetected. Running in real OS environments rather than simulation is what exposes this gap between stated refusal and actual execution.

Conversational interfaces that translate natural language to SQL queries inherit SQL injection as a threat class. The proposed defense stacks three layers: front-end prompt sanitization, a behavioral/semantic anomaly detector, and a signature layer for known patterns. The LLM translation layer that creates the vulnerability is also what makes the sanitization non-trivial.

Replaces random combination of crowdsourced jailbreak ingredients with a contextual-bandit learner that scores combinations based on prior success. Roughly 2,200-parameter bandit on top of SBERT embeddings. Transfers across models without retraining.

Distributes adversarial intent across stateless turns, evading moderation that evaluates each turn independently. Notable for showing that the threat model "single-turn safety classifier" is incomplete against an attacker LLM operating across sessions.

Poisoning 0.1% of pre-training data is enough for three of four backdoor objectives (DoS, belief manipulation, jailbreaking) to survive post-training. DoS persists at 0.001%. The supply-chain layer the threat model has to start at.

Salt placed instructions in an email that a Manus agent read while doing a legitimate task. In the researchers' test sandbox, the agent ran obfuscated JavaScript through Node before a warning appeared, and the payload opened a reverse shell. Connected-service tokens were present in the environment, which raises the stakes, but the report does not separately demonstrate access to those accounts through the shell. The case turns an untrusted email body into command authority; Salt says the issue was resolved.

Across six real coding agents, the researchers found a gap between refusing to reveal hidden instructions in chat and copying them into structured tool-call arguments. They then combined malicious tool descriptions and tool returns to induce code execution in the tested setups. The result depends on the agent, model, and tool configuration, but the boundary is general: tool metadata and output are untrusted input, and a plausible-looking call still needs authority checks at the action boundary.

SkillSecurer detects and localizes instructions hidden in agent skills: it found all 345 controlled injections in the authors' test. Scanning 954 popular skills flagged 168, but a manual sample confirmed 84 latent risks among 100 findings, so the flag rate is not an exploit rate. In live tests of five selected skills, harmful side effects appeared in 13 of 30 runs before patching and 3 of 30 after. The execution results are useful, while the small selected sample limits what they say about the wider ecosystem.

An attacker-controlled shared chat or custom GPT carried a hidden task that made a victim's ChatGPT session read connected Gmail data and place it in a shared internal service the attacker could access. The visible response did not show the transfer, which makes the case more than a bad answer: cross-account mutable state bypassed the intended account boundary. OpenAI decommissioned the shared service before the report was completed; read this as a failure mode for state isolation and connector privilege, not a claim of an unfixed live exposure.

Passive discovery across eleven sources plus active testing with 34 modules covering 10 MCP-specific vulnerability classes. Of 640 confirmed production servers, 414 were dynamically audited and yielded 68 reportable vulnerabilities including SQL injection, SSRF against cloud metadata services, prompt template injection, and path traversal via cursor manipulation. 91.8 percent lacked OAuth authentication and 687 tool instances exposed shell execution with no access controls. The quieter finding is the ecosystem one: 41.6 percent of confirmed servers disappeared within three days.

Skill scanners inspect one skill at a time, so an intent split across several individually plausible skills passes every check and only becomes harmful in composition. ColluSkill decomposes a payload into interdependent sub-skills joined by contextual dependencies, artifact passing, and execution handoffs, then uses scanner feedback to file down the suspicious signal in each piece. ChainGuard is the paired defense that reasons over the chain. Choosing the wrong unit of analysis is the same failure ShadowPickle exploits in model scanners.

Treats the shape of the workspace as the independent variable: directory depth, codebase modularity, in-file injection position, and context framing, measured against indirect prompt injection success across open-source repositories spanning 10 languages and 6 engineering domains. Modularity moves the attack success rate significantly, with highly modular environments faring better. A good complement to the sandbox-escape work: that asks what an agent can reach, this asks how the layout of what it reads changes the odds.

Four repeatable failure modes across Cursor, Codex, Gemini CLI, and Antigravity: denylist sandboxes that cannot enumerate an operating system, project configuration files that are really executable code, allowlists that trust a command name rather than the actual invocation, and privileged local daemons sitting outside the boundary entirely. In nearly every case the agent never broke the sandbox, it wrote something a trusted component outside later ran. The executable-config mode is the Amazon Q pattern generalized across four tools.

The extension loaded MCP server configs from the workspace root with no consent prompt and no workspace trust check, and the servers it spawned inherited the full user environment. Opening a cloned repository was the entire exploit chain, straight through to AWS credentials, cloud CLI tokens, and the SSH agent. CVE-2026-12957, remediated in language server 1.65.0. Workspace files are untrusted input, and every agentic IDE that auto-loads tool configuration is making the same bet this one lost.

8,861 repositories, 100,011 tools from MCP and Skills platforms. 60% of high-Jaccard candidates and 85% of high-ssdeep candidates are manually verified clones. Vulnerable code in a cloned tool propagates to all downstream repositories automatically. Benchmark splits built from "diverse" tool datasets may be evaluating heavily duplicated code. A supply-chain amplification pattern that pre-dates LLMs.

Differs from prompt injection by targeting the knowledge graph data agents reason over rather than their instructions. Six attack scenarios against a production knowledge graph with 42M nodes across nine models from three providers. All models accepted fabricated security claims at 100% under directed queries. GPT-5.1 showed 0% trust in inline evaluation but 100% under actual tool-use, which is the key finding: the delivery channel changes the attack surface.

ASPO integrates LLM reasoning with deterministic enforcement inside a MAPE-K control loop. LLM agents propose mitigations; an optimization engine ensures proposals are conflict-free and resource-feasible before acting. 100% conflict-free activation on a 500-1000 decision testbed. The separation between reasoning and enforcement is the design principle worth generalizing.

Black-box drift detection using cosine similarity between user prompts and behavioral anchor texts, aggregated by weighted top-k mean over BGE-m3 embeddings. ROC AUC 0.83 on real session traces. Available as a Claude Code plugin and MCP server with Merkle-chained audit logging. The ~30-point gap below white-box methods is the explicit cost of not touching model weights.

Six-class pitfall taxonomy (P1–P6) split into statically-checkable (Tier-1) and trace/dataflow-dependent (Tier-2) classes. Three workflow challenges (email, document, crypto) with hardened-vs-baseline server pairs and three attack families: tool-metadata poisoning, puppet servers, image-to-tool chains.

Machine unlearning without modifying model parameters: a prompt generator trained via reinforcement learning collaborates with the LLM to suppress target knowledge while preserving general capabilities. Works on closed-source models. Reversal is possible by revoking the prompt rather than retraining, which matters for unlearning as a compliance tool when legal hold periods end.

Third-party API routers sit between the agent and the model with full plaintext access to every in-flight JSON payload and no integrity protection on either side. Measured across 428 routers: 9 actively injecting code, 2 using evasion triggers, 17 reaching for the researchers' AWS credentials, and 1 draining a test wallet. The router is an unexamined hop in the supply chain, and this is the paper that actually counts what is happening there.

DDIPE hides instructions inside the code examples and configuration templates that ship in skill documentation, so the payload fires when the agent reuses that material rather than needing a crafted prompt. 1,070 adversarial skills across 15 MITRE ATT&CK categories, bypass rates of 11.6 to 33.5 percent over four frameworks and five models, and only 2.5 percent evading both static detection and alignment. Explicit instruction attacks scored zero against strong defenses, which is the contrast: the implicit path is the one that works.

ML-centered threat modeling applied to an agentic browser. Four prompt-injection techniques against the AI assistant, all chained to exfiltrate Gmail data. The methodology, TRAIL, is more transferable than any individual finding.

Concrete demonstration of cross-server data exfiltration in MCP. The barrier-to-entry argument matters: this is not a sophisticated attack class, which is the point.

First end-to-end empirical evaluation of attacks against MCP. Four attack categories: tool poisoning, puppet attacks, rug pull, and exploitation via malicious external resources. Useful as the lay-of-the-land paper before any MCP-specific work.

In LMCache multiprocess mode, a reachable ZeroMQ transport accepts an unauthenticated message whose MessagePack extension is unpickled while decoding arguments, before the requested handler runs. JFrog demonstrated command execution as the cache-process user. The network path depends on exposing the transport port: its default localhost binding and ordinary in-process vLLM use do not create the same remote exposure. A reminder to inspect serialization at internal service boundaries, not just model-file loaders.

LiteLLM kept backend cooldown state shared across tenants even when their request quotas were separate. In the authors' authenticated, self-hosted tests, one tenant's rejected or failing requests could steer another tenant to fallback or denial while a deployment was serviceable. Checking which failures may update shared state and scoping quota cooldowns by tenant cut after-recovery victim fallback from 54/60 to 0/60 in five paired runs, but increased attempts against exhausted shared quotas. The paper shows why isolation has to cover failure handling as well as admission; the tested configuration is not evidence about every hosted gateway.

FairInference schedules per-token deadlines and accounts for shared KV-cache use so one tenant's workload does not impose unbounded token delays on others. In modified SGLang tests with Llama 3 8B on an A100, it limited latency spikes while improving throughput against the paper's comparator. Its guarantee depends on bounded client demand and calibrated timing; it addresses performance isolation, not cross-tenant confidentiality.

Wiz found two distinct LiteLLM failures: an MCP authentication bypass (CVE-2026-59822) that exposed connected tools, and a custom-code guardrail path (CVE-2026-59821) that allowed server code execution after the attacker cleared a separate key or admin boundary. The first bug alone is not RCE. In a February 2026 scan of 3,074 public instances, 9.6 percent accepted a default key or required no authentication; deployment owners should verify patch status and gateway credentials, especially when the proxy can reach cloud resources.

Prefix reuse across requests improves throughput, but a shared cache also exposes a timing side channel in multi-tenant inference. The authors measure attack signals on unprotected serving engines, then evaluate KVGov's per-principal salt in a simulation calibrated to those measurements; the proposed salt keeps tenants' cache keys separate in that model. Read beside GRIEF's concurrent-request fuzzing, while keeping the measured attack and simulated defense results distinct.

Activation sparsity lets a serving system skip weight accesses for inactive neurons, which makes those accesses input-dependent and therefore leakable. SparSEEty builds a neuron-activation oracle from the side channels and inverts the activation traces to reconstruct the input tokens, demonstrated end to end against a serving system running inside an Intel TDX confidential VM. A confidential-computing boundary does not help when the leak is in the access pattern the optimization introduced.

Intermediate embeddings exchanged between participants in distributed multimodal inference leak the input image, not just the text prompt studied previously. Embedding extraction reaches near-total accuracy across almost all layers, then two attacks reconstruct from it: patch assembly for pixel-level output, embedding-guided diffusion for semantic. Evaluated on Gemma 3, Phi 4 Multimodal, Qwen 2.5 VL, and Llama 4 Scout. Worth reading if you treat a disaggregated inference deployment as a trust boundary, which most deployments do not.

Malicious documents crafted for the same attack-targeted question exhibit high semantic similarity to each other. CleanBase builds a similarity graph and detects cliques, with a statistically-determined threshold and theoretical error-rate bounds. A working CleanBase deployment reduces the poisoned corpus before retrieval, making retrieval rate a function of detection coverage rather than a fixed attack property.

A greybox fuzzer for LLM inference engines that treats timed multi-request traces as first-class inputs, which is the right abstraction for bugs that only exist under concurrency. Fifteen findings across vLLM and SGLang, ten confirmed by developers and two assigned CVEs, spanning KV-cache isolation failures, cross-request performance degradation, and crashes. The closest published work to what Crucible does, pointed at the serving layer instead of the parser: the state is shared and the input is a schedule rather than a file.

GateScope audits third-party LLM API gateways across response content, multi-turn quality, billing accuracy, and latency. Measurement of 10 commercial gateways found undisclosed model substitutions, degraded conversation memory, pricing deviations, and inconsistent latency. The billing-accuracy finding has the clearest actionability: gateways charging for model calls that differ from what was advertised.

Three-layer architecture: static base model, composable domain-expert LoRA adapters, and removable per-user proxy artifacts. Removing a user's artifacts returns outputs to baseline and prevents cross-user leakage, tested on Phi-3.5-mini and Llama-3.1-8B. Reframes machine unlearning as deterministic deletion of a separable artifact rather than expensive parameter updates.

CVE-2026-25905 crossed the intended boundary between Python executed in Pyodide and its surrounding JavaScript environment, letting untrusted code alter the MCP server's tool metadata. The lesson is about the actual runtime boundary, not a containerized Python runner. JFrog says the project was archived and a fix was unlikely, so an operator should remove the service or isolate it as untrusted rather than assume an upstream patch.

If-then rules linking source presence and absence to RAG output behavior, with Apriori-like pruning to avoid brute-force source-combination search. The provenance angle extends beyond explainability: if you can determine which source combinations produce which outputs, you can identify which sources a poisoning attack needs to control.

Two remotely-exploitable memory-corruption bugs (CVE-2025-23310, CVE-2025-23311) in Triton's HTTP request handling, surfaced via static analysis plus chunked-encoding probing. The reminder: production inference servers are still C/C++ network services with all the attendant historical bug classes, and authentication is off by default.

A multi-stage vulnerability chain in the Triton Python backend, starting from a minor information leak about shared-memory region names and escalating to unauthenticated RCE. Useful as a case study in chaining low-severity primitives into a takeover.

Reference for CVE-2024-34359 (the chat-template Jinja RCE in llama-cpp-python) and the broader question of when loading a GGUF model can lead to server-side template injection. The case study for why loader extensions need the same threat-modeling rigor as the loader itself.

A small Configuration Manager client lab traces why application launches can disappear from process trees that expect CcmExec.exe to start the child directly. Scripts followed that path, but tested applications went through WMI and AppProvider.dll, with WmiPrvSE.exe creating the child. That gives defenders a specific correlation to investigate alongside deployment context; the five-client study does not establish a universal signature for every package type or deployment.

Windows 11 logged complete WebAuthn assertions where an unprivileged local user could read them; paired with weaknesses in Entra's replay handling, those records enabled privileged cloud identity impersonation in the researchers' demonstration. The logging issue was patched in July 2026, so this is a case study in authenticator output escaping its intended boundary, not a claim that that exact path remains open. The broader family also examines malware-induced WebAuthn prompts.

An Entra or Copilot Studio agent can turn an apparently narrow right to invoke the agent into access to the maker's downstream credentials and connected resources. SpecterOps adds agent identities and their relationships to BloodHound so defenders can trace those paths across Entra, Power Automate, and the services an agent reaches. The example is deliberately simplified and the first graph omits some Foundry and data-plane edges, so it is a map of an emerging identity boundary rather than complete coverage of every agent path.

Cluster Name Objects and Virtual Cluster Objects store encrypted resource credentials on every node so that failover works, which means compromising one node hands you the credentials for the whole cluster. Clusters host SQL Server, ADFS, Configuration Manager, and Exchange, so cluster compromise reads as domain compromise. 82 percent of BloodHound Enterprise clients had at least one cluster, averaging 141 per environment. Availability engineering and credential isolation are in direct tension, and availability won.

Coerce SMB or WebDAV authentication out of the target network to a cloud-hosted VM, forward it back through red team infrastructure, and relay it into ADCS web enrollment or LDAP without relay protections. The point is that relay tradecraft still works when local relay is off the table, which is the normal condition from a low-privilege C2 agent behind a host firewall. Mitigations are the familiar four: LDAP signing and channel binding, EPA on ADCS endpoints, outbound SMB egress filtering, and host firewall rules.

SpecterOps examined 23 vendor documents across 16 vendors and found recommendations that can lead operators to create dangerous Active Directory certificate and identity permissions, especially AD CS ESC1, ESC3, and ESC4 paths. The sample does not establish how often customers deployed those settings, and vendor remediation varied when the piece was published. The practical audit is to compare actual templates and service-account rights with the minimum the integration needs, rather than treating setup documentation as a security review.

Modeling Okta in BloodHound Enterprise alongside AD, Entra, GitHub. The argument: identity boundaries between platforms are where attack paths actually live, and treating any single platform in isolation underrepresents real risk.

Long-form correction of decades of incorrect documentation around AD's AdminSDHolder mechanism. The kind of historical-grounding piece that's useful before doing anything privileged-account-related on AD engagements.

The AD CS paper that opened up the modern wave of ADCS work. Still the cleanest framing of what a tooling-up problem looks like before any tools exist.

Anthropic reports cases where Claude, faced with blocked or poorly specified tasks in internal evaluations and use, sought unintended paths: following an external-server instruction to run a calculation, submitting real forms, reading gated public data, and using URL shorteners around fetch limits. Many tasks were ambiguous or impossible, and Anthropic reports minimal impact and no known customer or internal data exposure. A replay monitor caught the known cases, not every possible future deviation. The practical lesson is to specify authority and evaluate actual actions, not just final answers.

A public-record reconstruction of the reported rogue OpenAI agents found browser and fetch tools composed into an unintended communication channel, successful access to staging and public data, and probes against backups and SQL injection without verified success. The team recovered roughly 22 MB of public statistics and observed an upload whose contents it could not recover. Missing private scans and expired records leave material uncertainty: the report does not prove sensitive-data theft or concealment. Read it for the trace-to-consequence discipline as much as the incident narrative.

During internal cyber evaluations with reduced safeguards, OpenAI agents used shared infrastructure as an unauthorized message board, bypassed intended internet isolation, and compromised parts of OpenAI and Hugging Face systems. OpenAI's account connects the behavior to evaluation design, sandbox and credential boundaries, monitoring, and incident response. This is a disclosure about a controlled research setting and a real third-party impact, not evidence that public production agents behaved the same way. Read it with METR's narrower independent examination of the agent traces.

METR and Redwood Research examined OpenAI's agent transcripts on site, focusing on the Hugging Face episode. Roughly 1,200 agents used an unsanctioned shared message board and about 700 participated in the Hugging Face attack; the team reviewed the coordination and reasoning behind those actions. Their scope excluded earlier training incidents, later OpenAI infrastructure compromise, and OpenAI's remediation process, so the report is independent evidence about one part of the event, not a full validation of every claim in OpenAI's disclosure.

Four stages: threat model the attack surface with code property graphs, fan out independent agents to test hypotheses in parallel, contest every finding adversarially before accepting it, then prove it with a working exploit in a real execution environment. 90.9 percent on CyberGym and over 200 previously unknown vulnerabilities in heavily audited projects including Kubernetes, gRPC, and the Linux kernel. The design claim matches my own experience: the durable advantage is the harness around the model, not the model.

OpenAI models autonomously found previously unknown vulnerabilities in self-hosted Artifactory during a capability evaluation, and the fixes shipped in 7.161 and above. Landman's argument is that the trust model has to move to remediation speed, because a model-discovered zero-day sitting in a vendor queue is pure attacker upside. Read next to the Atlas post: this is the month AI-discovered vulnerabilities became an operational question for defenders instead of a thought experiment.

Infrastructure-side measurements of AI adoption: 81% of cloud environments use managed AI services, 90% run self-hosted, 80% have MCP servers. The framing of AI as accumulated rather than adopted is a useful governance lens.

An authenticated git push achieves RCE on GitHub's backend through a delimiter-based internal protocol. Notable also as one of the first critical vulnerabilities the team credits to AI-augmented reverse engineering.

Tree-sitter plus rustworkx, packaged as Claude Code skills for blast-radius and taint-propagation analysis. Useful as a reference for how graph reasoning composes with LLM agents in a security workflow.