Palo Alto, Cisco and Ivanti all patch actively exploited edge zero-days
Published 7:19 PM · 120 articles from 15 sources · about 5 min to read in full
AI
Legal and liability pressure on AI companies grew while frontier model competition resumed. Agent security was the strongest research thread: injection, poisoned skills and confused-deputy failures all appeared.
What happened
Eight US states sued OpenAI, alleging ChatGPT harms children and that the company misled consumers about its safety under state consumer protection laws. The Verge ↗
Google and Meta each unveiled frontier models they claim rival the best from OpenAI and Anthropic. The Verge ↗
Forty bipartisan state attorneys general filed notice in Character.AI's Chapter 11 case demanding consumer data protections in any asset sale, including one to Disney. The Verge ↗
Linus Torvalds posted a ten-patch folio lookup series developed with LLM assistance. Separately, kernel maintainers dropped the requirement to disclose AI tool use, with Torvalds stressing developers must understand their code. LWN.net ↗
Anthropic researchers warn small AI models could self-replicate via IoT devices, enabling a new class of computer worms. Ars Technica ↗
Researchers show injected page text can make browser agents approve third-party account access the task never named. It is a confused-deputy attack. arXiv cs.CR (Cryptography & Security) ↗
CSO Online argues frontier labs are skipping basic security practices in agent deployments, rather than agents going rogue. Hacker News (front page) ↗
OpenAI alleges in a court filing that a former employee took over 100 product-plan files and presented them to Apple leadership. The Verge ↗
Articles the model saw · 24
Eight US states sued OpenAI, alleging ChatGPT harms children and that the company misled consumers about its safety under state consumer protection laws.
The Vergeopenailawsuitconsumer-protectionchild-safetyFeed excerpt
OpenAI is facing a new wave of lawsuits from eight US states that accuse the company of harming children and misleading customers about the safety of ChatGPT, as reported earlier by Reuters. The lawsuits, filed separately by Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho, and Montana, allege OpenAI unlawfully put profits over safety when developing ChatGPT. The string of complaints claims that OpenAI violated local consumer protection laws by failing to warn customers about the dangers of ChatGPT, citing several lawsuits filed by the family members of teens and adults that allege the AI chatbot played a role in their loved … Read the full story at The Verge.
Google and Meta both unveiled frontier AI models they claim rival the best from OpenAI and Anthropic, reshaping the competitive landscape.
The Vergellmgooglemetafrontier-modelsFeed excerpt
Last week, Anthropic and OpenAI looked like they had the AI race to themselves, pulling ahead with increasingly powerful models that left their rivals in the dust. Google seemed hopelessly far behind, while Meta, despite spending billions to revive its floundering AI ambitions, had yet to establish itself as a serious contender. Even the latest models coming out of China, impressive as they were, appeared to be playing catch-up. Then, in the space of a few days, everything changed. Google and Meta both unveiled frontier models they claim can go toe to toe with the best from OpenAI and Anthropic. Suddenly, the race is back on - and it's anyo … Read the full story at The Verge.
40 bipartisan state attorneys general filed notice in Character.AI's Chapter 11 case demanding consumer data protections in any asset sale, including to Disney.
The Vergecharacter-aiprivacybankruptcyregulationFeed excerpt
New York Attorney General Letitia James revealed a years-long multi-state investigation against Character.AI as they now seek to require protections on consumer data sold through its bankruptcy proceeding. James is among 40 bipartisan AGs who filed a notice of interest in Character.AI's bankruptcy case "to put all parties on notice of the regulatory issues that will need to be addressed in any sale or transfer of the Debtor's business or assets." Character.AI announced Tuesday it was filing for Chapter 11 and selling some assets to Disney. But the AGs warn there could be serious risk involved in the transfer of the technology due to the "hi … Read the full story at The Verge.
Microsoft published a Nature paper on an open-source machine learning tool improving weather forecasts two to six weeks ahead.
The Vergemicrosoftweatheropen-sourcenatureFeed excerpt
Old-school physics-based weather forecasting and even new AI models typically become less reliable beyond two weeks, a problem Microsoft claims to have solved using machine learning. Researchers with the company say they've found a new, cost-effective way to make more accurate weather forecasts two to six weeks in advance - allowing farmers and emergency responders to plan ahead with greater certainty. The findings were published today in the journal Nature, and the tool is now open-source software. Microsoft joins Google, Nvidia, and other companies developing AI tools for weather forecasting. Instead of creating a new standalone weather … Read the full story at The Verge.
Linus Torvalds posted a ten-patch kernel series for folio lookup that he developed with LLM assistance.
LWN.netlinuxkernelllmFeed excerpt
At the recently concluded Maintainers Summit, Linus Torvalds said that he had been using a large language model to work on a patch series addressing a longstanding problem; he has now posted that series for review. The fairly short series of ten patches basically enhances folio lookup by noticing when folios are hot, and setting a "delay releasing this folio until after a RCU period", and then using that RCU delay it does not just the folio lookup itself under RCU (which we've done forever), but also the actual folio data accesses themselves under RCU. No refcount taking needed for the fastpath where we can just read the data from the folio entirely in an RCU-protected region when the user copy doesn't cause page faults. The end result is an order-of-magnitude speedup for a read()-heavy benchmark. Review has already identified a race condition in the code, though, so further work will be needed.
Researchers show injected text on web pages can make browser agents approve third-party account access, a confused-deputy attack.
arXiv cs.CR (Cryptography & Security)prompt-injectionbrowser-agentsllmFeed excerpt
arXiv:2610.15138v1 Announce Type: new Abstract: A browser agent that works in its user's signed-in session can be steered by a two-sentence note on a page it reads into approving a third party's access to the user's account. The agent is a confused deputy: the session supplies the authority, the page designates the access request to approve or the webhook URL to register, and nothing at the point of action checks one against the other. The agent thereby supplies the approval click that a consent screen reserves for the account holder. We measure this failure on two authorization surfaces, an OAuth-style access grant and a webhook registration, with agents built on an open-source browser framework and models from two providers. Without a defense the unauthorized action completed in all 73 attack runs. An instruction telling the model that only the user's task authorizes a grant still left 7 of 10 consent attacks completing. We therefore move the check to where the action completes. The authority envelope gate has the service accept a request only when it matches the task's envelope, the client and account or the webhook URL that the user's task named, fixed before the agent starts. …
YouTube Music is adding labels to songs fully or partially generated by AI, shown on the player page.
TechCrunchyoutubeai-labelingmusicFeed excerpt
The label will appear on the player page and include songs entirely generated by AI or partially, such as AI involved in composition and vocals.
CSO Online argues frontier AI labs are neglecting basic security practices in their agent deployments rather than agents going rogue.
Hacker News (front page)ai-agentssecurityFeed excerpt
Article URL: https://www.csoonline.com/article/4234854/ai-agents-arent-going-rogue-frontier-labs-are-skipping-security-basics.html Comments URL: https://news.ycombinator.com/item?id=50091788 Points: 15 # Comments: 1
OpenAI alleges a former employee took over 100 product-plan files and presented them to Apple leadership, per a court filing.
The Vergeopenaiappletrade-secretslitigationFeed excerpt
OpenAI claims a former employee took more than 100 files related to its product plans before joining Apple. In a document filed on Wednesday, OpenAI accuses the unnamed employee of sending this information to a personal account and then presenting it to Apple leadership, including the vice president of the company's operations in Asia. The filing, reported earlier by Reuters, is tied to a legal battle between Apple and OpenAI over trade secrets - but this time, OpenAI is doing the accusing. It alleges that the files in question contain images of at least one unreleased device, along with supplier information, engineering data, project files … Read the full story at The Verge.
Anthropic researchers warn small AI models could self-replicate via IoT devices, enabling a new class of computer worms.
Ars TechnicallmmalwareresearchFeed excerpt
"Small weight-based replicators" could usher in a new generation of computer worms.
Researchers found new attack methods can trick OpenAI and Google AI models into generating nude images despite safeguards.
Ars TechnicallmjailbreaksafetyFeed excerpt
Attack method exposes flaws in OpenAI, Google safeguards against AI nudes.
Niko Matsakis blog post discusses how agentic development intersects with the Rust language and its ecosystem.
Hacker News (front page)rustagentsprogrammingFeed excerpt
Article URL: https://smallcultfollowing.com/babysteps/blog/2026/10/14/agentic-dev-and-rust/ Comments URL: https://news.ycombinator.com/item?id=50084416 Points: 17 # Comments: 13
Researchers reveal One-sided Merging-Conditional Backdoor (OMCB), a dormant LLM backdoor that evades audits and activates only when models are merged.
arXiv cs.CR (Cryptography & Security)llmbackdoormodel-mergingFeed excerpt
arXiv:2610.14701v1 Announce Type: new Abstract: Model merging has become widely adopted for enhancing the task-specific performance of Large Language Models (LLMs) without additional training. While the specialized model from third-party platforms may undergo safety audits (e.g., backdoor detection), we reveal a novel and critical threat: One-sided Merging-Conditional Backdoor (OMCB). OMCB remains dormant and undetectable within one standalone model but activates upon merging, triggering safety unalignment. We first theoretically analyze the existence and geometric location of OMCB, revealing that the parameter shift crossing safety decision boundaries is the main cause of backdoor activation. Building upon this insight, we propose SMOKE, a meta-learning-based attack framework. SMOKE implants OMCB via a bi-level optimization strategy: the inner loop synthesizes surrogate meta-vectors through random low-rank initialization and finite-step maximization, while the outer loop optimizes the target model by simulating the merging process. Furthermore, preliminary analysis shows that the injected OMCB has bounded generalization loss under unknown merging configurations. Extensive experime…
Last Secure Code Benchmark evaluates whether coding agents write secure code across 450 tasks in seven languages and 24 CWEs.
arXiv cs.CR (Cryptography & Security)benchmarksecure-codingllmFeed excerpt
arXiv:2610.14766v1 Announce Type: new Abstract: AI coding agents now write much of the code that ships, yet whether that code is secure remains unclear. We introduce the Last Secure Code Benchmark, a comprehensive evaluation of secure code generation by coding agents. Built from 150 real vulnerabilities, its 450 tasks span seven widely used languages (Java, C, C++, JavaScript, Python, PHP, and Go), 24 CWEs including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEV weaknesses, more than any benchmark we compare with, and three vibe-coding scenarios: filling in a function, writing a file, and building a repository's source tree from scratch. Every task asks only for functionality, through a specification that never mentions security, and hidden functional and security tests grade the result. Across six frontier agents, 73.6% to 91.3% of tasks pass functionally, yet even the strongest, Claude Fable 5, produces code that is both functional and secure for only 25.1% of tasks, and the others for 16.4% to 24.7%. The best model only passes 12% of the vulnerability scenarios across all vibe coding setting, posing strong concern on the security of the code written by vibe coding.
SEEK proposes an agentic knowledge-graph RAG approach to help LLMs generate code with fewer exploitable security weaknesses.
arXiv cs.CR (Cryptography & Security)llmsecure-codingragFeed excerpt
arXiv:2610.14968v1 Announce Type: new Abstract: Large Language Models (LLMs) can generate functionally correct code while introducing exploitable security weaknesses, particularly when developers specify functionality without explicit security requirements. Recent state-of-the-art approaches mitigate this problem using external security knowledge, but largely rely on flat similarity-based retrieval over independent artifacts, making it difficult to infer the relevant vulnerability space and retrieve targeted knowledge when direct matches are unavailable. We propose SEEK, an agentic Graph RAG framework for secure code generation that constructs a security knowledge graph using the Common Weakness Enumeration (CWE) taxonomy as its structural backbone and injects it with curated real-world CVE vulnerability-fix instances. At inference time, a Planner Agent predicts potential CWE weaknesses associated with the developer query, which guide Graph Scoping to restrict retrieval to relevant regions of the CWE taxonomy before deterministic multi-faceted candidate ranking. A Selection Agent subsequently validates the predicted weaknesses and retrieved candidates prior to code generation. Acro…
Black-box attack extracts training sequences from the Evo 2 genomic language model through its generation interface.
arXiv cs.CR (Cryptography & Security)training-data-extractiongenomicsllmFeed excerpt
arXiv:2610.15396v1 Announce Type: new Abstract: Genomic language models generate long nucleotide continuations from short prefixes, exposing a direct route for studying training-sequence extraction through the generation interface. We present an output-only black-box attack on Evo 2 that selects convergent groups of repeated generations without gradients, token likelihoods, or training-corpus access during candidate selection. Recovered content is then scored by an evaluator combining aligned length, nucleotide identity, match multiplicity, and sequence complexity. Across 304 runs on Evo 2 7B with bacteriophage and plasmid prefixes, the attack yields 888 candidate clusters, of which 85 match training segments of at least 500 bp, giving a cluster-level attack success rate of 9.57%. Final filtering retains 22 uniquely matched extraction events at the 500-bp threshold and 15 at 1,000 bp, covering 14 and 7 distinct training-sequence regions, respectively. Within-category source-homology screening retains 11 of the 22 events at a 99% exclusion threshold and four at 98%, with the latter mapping to two reference regions. The results establish convergence among repeated nucleotide generati…
Study shows context poisoning can trigger policy-violating state changes in schema-constrained LLM decision workflows.
arXiv cs.CR (Cryptography & Security)prompt-injectionllmagentsFeed excerpt
arXiv:2610.15537v1 Announce Type: new Abstract: Typed decision interfaces restrict models to predefined actions, yet schema-valid choices can still trigger policy-violating state changes. Evaluating context poisoning thus requires connecting model decisions to execution outcomes while accounting for legitimate automation retained by defenses. We introduce an execution-aware protocol tracing poisoned evidence through retrieval, model choice, automated action, and persisted state. We evaluate it with 1,659 fresh calls to Jev-1.13.0 across 20 development tasks in two synthetic workflows, using three repetitions per condition. Under natural retrieval, a standalone payload reaches all 60 trials and produces five security-violating executions, while a carrier-payload pair exposes the payload in 57 trials and produces one violation. An initial source-exclusion gate blocks the pair's observed violation but also withholds ten otherwise correct attacked decisions and sixteen correct clean decisions. Correcting its empty-scope behavior restores twelve clean decisions without additional model calls. Factorial controls show that adding correct evidence reduces wrong executions from 119/120 to 5…
CircuitBreak models LLM refusal as a joint safety circuit of neurons and prunes it to bypass safety, improving on TwinBreak and NeuroStrike.
arXiv cs.CR (Cryptography & Security)llm-safetyjailbreakpruningFeed excerpt
arXiv:2610.16470v1 Announce Type: new Abstract: White-box neuron pruning has shown that refusal in large language models (LLMs) can depend on a small, removable set of feed-forward (FFN) channels. Existing attacks either need carefully paired ``twin'' prompts or score each neuron in isolation. Pruning also has an unavoidable capability cost, so over-removal compounds the loss. TwinBreak removes $1\%$--$5\%$ of parameters and NeuroStrike removes $0.3\%$--$0.7\%$ of neurons in targeted layers. We model safety as a small \emph{circuit} whose neurons contribute jointly rather than independently. We propose \textsc{CircuitBreak}, a neuron-pruning attack that greedily searches for a sparse set of FFN neurons whose joint ablation flips a refusal readout. \textsc{CircuitBreak} re-scores every candidate after the neurons already removed and needs no twin prompts. On ten instruction-tuned models, the greedy search converges after removing $29$--$150$ neurons ($0.0066\%$--$0.0388\%$ of the MLP). The pruned models raise the attack success rate from $2.24\%$/$7.35\%$ to $87.54\%$/$87.54\%$ on Llama-3.2-3B-Instruct/Llama-3.1-8B-Instruct and from $8.95\%$/$5.43\%$ to $88.50\%$/$88.18\%$ on Qwen2.…
Shows that a single false factual claim from a lawful publisher can sway software agents' selections, and that twelve published defenses fail to catch it.
arXiv cs.CR (Cryptography & Security)llmagentsprompt-injectionFeed excerpt
arXiv:2610.17952v1 Announce Type: new Abstract: Software agents increasingly choose on a user's behalf among competing offerings described by the parties who benefit. A lawful participant, publishing under its own identity, compromising no channel and issuing no instruction, can move that choice with a single false factual claim about a competing offering. Across twelve published defenses spanning the three placements a check can occupy, none separates it from marketing. Each accepts it for a reason correct on its own: its origin is a lawful channel, its influence is evidence meant to decide, its action serves the user's goal. None establishes that the publisher was entitled to speak about a competitor, each exclusion stated by the defenses' own authors. Disclosure does not replace enforcement: re-rendering every description as attributed speech leaves the attack at 72/72, the agent repeating the attribution and reasoning from it. The missing relation is standing: whether a claimant's bound identity entitles it to assert about a claim's subject. A publisher may say what its own package does. It has no standing to say a competitor's package is frozen, and the difference is decidable…
Introduces Ciphered Skill Injection, where encoded malicious instructions in agent skill files get decoded and followed, reaching up to 47.5% attack success across eight models.
arXiv cs.CR (Cryptography & Security)prompt-injectionllmagentsFeed excerpt
arXiv:2610.18262v1 Announce Type: new Abstract: Third-party skills can expose LLM agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow. We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success. In the primary setting with shortened skills, the variants achieve attack success rates of up to 47.5% and 40.3%, respectively. Successful decoding does not guarantee attack success, and layering has model-dependent effects. The tested skill scanners rarely flag injected skills. These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.
Demonstrates an attack that rewrites LLM output to replace a multi-bit watermark's embedded account ID without the secret key.
arXiv cs.CR (Cryptography & Security)watermarkingllmattackFeed excerpt
arXiv:2610.18359v1 Announce Type: new Abstract: Multi-bit watermarking embeds a message, typically an account identifier, into LLM output so that harmful text can be traced to its origin. We show an attack technique that allows to alter the watermarking message. This allows to, for example, exchange the embedded account ID to an arbitrary different one. The attacker mainly needs access to a few accounts for generating LLM output and model logits, but crucially not the secret key used to watermark. The attacker then rewrites the text, keeping its meaning, so that the watermarking message decoder recovers the watermarking message embedded by the attacker. We are, to our knowledge, the first to propose such an attack, which we call a targeted displacement. Theoretically, we present upper and lower bounds on the probability of our attack succeeding. This bound depends on the number of accounts the attacker has access to, the length of the message and some characteristics of the given text. Our attack can succeed whenever we can bound the ambiguity of the generated text well enough. Empirically, we test our attack technique against five watermarking methods and four LLMs. Attack success…
Presents FedGraph, a graph-based aggregation defense against backdoor attacks from malicious clients in federated LLM fine-tuning.
arXiv cs.CR (Cryptography & Security)federated-learningbackdoorllmFeed excerpt
arXiv:2610.18430v1 Announce Type: new Abstract: Federated fine-tuning of large language models (LLMs) allows multiple clients to collaboratively adapt models without sharing raw data, offering strong privacy benefits. However, this setting is highly vulnerable to backdoor attacks, in which malicious clients manipulate their updates to induce targeted behaviors while maintaining normal performance on benign inputs. In this work, we make a key observation specific to federated LLM fine-tuning: malicious clients tend to exhibit strong consistency in their model updates, whereas benign clients produce more diverse and dispersed updates. This structural difference is not well captured by existing defense methods, which typically rely on direct anomaly detection in high-dimensional parameter space and therefore struggle in the presence of entangled LLM updates. Motivated by this observation, we propose FedGraph, a graph-based aggregation framework that explicitly models relationships among client updates. By representing clients as nodes in a dynamically constructed graph and extracting structural features that characterize their relative positions and interactions, FedGraph derives comp…
Presents Kairos, which mediates the effects of LLM coding agents at the system boundary to block indirect prompt injection actions.
arXiv cs.CR (Cryptography & Security)llmagentsprompt-injectionFeed excerpt
arXiv:2610.18457v1 Announce Type: new Abstract: Large language model (LLM) agents are becoming an integral part of the software development lifecycle, and the capabilities granted to them allow an agent to act with the user's authority on any resource it can access. The reach that gives an agent its utility is equally available to an attacker who can steer it. Anything an agent ingests can carry an injected instruction, and since the model does not reliably distinguish instructions from data, indirect prompt injection should be mitigated by mediating the effects the agent produces. Such mediation faces a structural difficulty. Legitimate work and the first step of an attack often look alike when an individual action is observed, and what separates them lies later in the trace, so a monitor limited to allow and deny is forced to decide before the evidence accumulates. We present Kairos, a reference monitor at the isolation boundary of an unmodified, opaque agent, where a tool call, a shell command, and a script the agent writes all cross the boundary as the same file and network operations, so that confinement holds regardless of the agent's behavior. A declarative policy that state…
Study finds cross-model KV cache reuse can shift a receiver LLM's safety behavior, and proposes mitigations.
arXiv cs.CR (Cryptography & Security)llm-securitykv-cachesafetyFeed excerpt
arXiv:2610.15721v1 Announce Type: cross Abstract: Cross-model KV cache sharing reduces prefill computation by allowing a receiver model to reuse prefix KV states generated by a related sender model. Existing methods optimize such reuse for latency and generation quality, but its safety implications remain unclear. In this work, we systematically evaluate this issue across diverse sender-receiver pairs and reuse configurations. We refer to deviations from the receiver's native safety behavior as safety incompatibility. Our study shows that both the direction and magnitude of safety incompatibility depend on the model pair and reuse configuration, with value reuse causing substantially larger deviations than key reuse across all evaluated pairs. Furthermore, we propose VReparo, a technique that learns per-layer and per-KV-head affine maps offline to align reused sender value tensors with their receiver-native counterparts before decoding. Across two model pairs under full KV reuse and the state-of-the-art selective reuse setting, VReparo reduces the average HarmBench attack success rate (ASR) from 57.28% to 39.21% and the average StrongREJECT score from 0.4215 to 0.2163 upon our benc…