Cross-Site Prompt Injection: How Web Agents Confine Untrusted Content
Prismata reframes cross-site prompt injection as an isolation problem: label page content by trust, redact untrusted text, and gate privileged tools so agents fail safe.
The archive · Page 2 of 4
Security
Where AI infrastructure inherits the unpatched assumptions of the web stack beneath it, and trust boundaries collapse faster than disclosure timelines can keep up.
The archive
25–48 of 86 articles · Newest first
NVD to CNAs: Why Distributed CVE Assignment Breaks Triage
CVEs are no longer stable units of work. Federated CNA assignment produces conflicting CVSS scores and self-divergence, pushing reconciliation to SBOM and triage pipelines.
CVE-to-CWE Mapping With BERT: Multi-Label vs Multi-Class Error Tradeoffs
A 2026 arXiv paper shows multi-class and multi-label BERT both map CVEs to CWEs, but the taxonomy, not the encoder, shapes the misclassifications that security tools inherit.
IDE Jailbreaks Bypass Chat Guards by Writing Code
arXiv:2607.03968 shows harmful prompts succeed in IDE workflows 100% of the time despite chat refusals. The security boundary for AI coding assistants shifts from model to.
Januscape KVM Escape Breaks x86 VM Isolation
Januscape (CVE-2026-53359) exposes a 16-year-old guest-to-host escape in Linux KVM that lets attackers crash hypervisor hosts from within a guest VM when nested.
Jailbreaks Hidden in Image Pixels Slip Past Editors' Text Guardrails via an Empty Prompt
VJA embeds jailbreak instructions in image pixels with an empty text prompt, leaving text-only guardrails nothing to scan and forcing moderation into the pixel pipeline.
Linux Foundation Akrites Centralizes Open-Source Vulnerability Disclosure
Akrites pools 19 vendors behind one shared vulnerability disclosure SIRT to absorb a flood of duplicate LLM reports, but risks becoming the new bottleneck itself.
Why LLM Prompt Injection Persists: Instructions and Data Share Embeddings
A 2026 preprint argues prompt injection is mathematically unpreventable when instructions and data share one embedding space, making defenses cost-raisers rather than cures.
When Bots and Agents Post CVEs in PRs, Reporters Inherit the Triage Burden
When a bot or agent drops a CVE into a pull request, the thread reads as already triaged. Reviewers move on, and the reporter inherits the job of proving it real.
Runtime vs Build-Time SBOMs: Why Your Container Runs Uncatalogued Code
Build-time SBOMs miss the code Python actually runs. The MEM-SBOM preprint shows memory forensics recovers dynamically loaded packages static manifests never recorded.
OpenAI's Agent Link Safety Isolates the Fetch, Not Prompt Injection
OpenAI's link-safety control stops quiet URL-based exfiltration by agents, not prompt injection. The trust boundary is moving from model output to network policy.
No Verified 'React2Shell' Bulletin Exists: What Next.js Teams Should Check
A 'React2Shell' Vercel security bulletin is circulating, but no primary advisory, CVE, or technical write-up could be located as of 2026-06-29. Here is how to verify.
Vercel on the Axios npm Compromise: Platform Scanning Has a Blind Spot
Vercel's Axios changelog exposes where platform defenses stop: post-publication egress blocks leave the install-time window on dev laptops and CI runners uncovered.
Diffusion Model Safety: How Training-Schedule Poisoning Slips Past Prompt Filters
TEMPO-Diffusion gates its backdoor to a training-timestep window, so clean inference output no longer proves a clean checkpoint. Output-only audits miss the poisoning.
Bandit Algorithms Let Non-Experts Auto-Select the Best LLM Jailbreak
A June 2026 arXiv preprint uses bandit algorithms to auto-select jailbreaks, hitting 97% ASR on open-weight LLMs and invalidating blocklist-based defenses.
RAG Poisoning Hijacks Model Attention, Not Just Retrieval Ranking
Eyes-on-Me (ICML 2026) shows attention attractors in poisoned documents redirect generator focus post-retrieval, lifting attack success from 21.9% to 57.8% across 18 settings.
CVE-2026-LGTM and the Limits of Trust in Automated Advisory Intake
CVE IDs certify disclosure, not exploitability. Scanners that ingest the feed without VEX attestation treat every advisory that cleared CNA intake as a confirmed risk.
ShareLock Splits MCP Poisoning Across Tools, Defeating Per-Tool Scanners by Construction
ShareLock splits an MCP poisoning payload across tool descriptions via Shamir's threshold scheme. No individual share is flagged. Combined, attack success tops 90%.
Prompt Injection in AI Résumé Screening: Single vs Multi-Injection Attacks
A June 2026 preprint plants prompt injection in résumés fed to LLM screeners, flipping rankings when few candidates inject and forcing vendors to isolate untrusted input.
OpenAI's TanStack npm Writeup Shifts Dependency-Control Burden onto AI Tooling Teams
OpenAI's TanStack npm writeup is its second macOS signing compromise within a month, and it raises the dependency-control bar for every team pulling npm into AI tooling.
OpenAI's ChatGPT Atlas Treats Prompt Injection as Unfixed, Not Patched
OpenAI frames ChatGPT Atlas's prompt-injection hardening as continuous rather than a closed patch, pushing the burden onto runtime controls for agent builders.
Can Provable Bounds Defend LLM Fine-Tuning Against Poisoned Data?
BBoxER, a 2025 gradient-free post-training method, claims non-vacuous poisoning-robustness bounds for LLMs. The abstract never states how tight those bounds are.
Measuring LLM Safety by Refusal Alignment Instead of Attack Success Rate
A June 2026 preprint proposes RAS, a white-box metric that scores LLM safety by hidden-state refusal alignment rather than blocked output, challenging ASR-only leaderboards.
Poisoning Physics-Informed Neural Networks Slips Past Loss-Based Validation
A June 2026 preprint shows poisoned physics-informed neural networks hit clean training loss while their solutions diverge up to 128%, defeating loss-based validation.
