The archive · Page 2 of 3
Where AI infrastructure inherits the unpatched assumptions of the web stack beneath it, and trust boundaries collapse faster than disclosure timelines can keep up.
25–48 of 69 articles · Newest first
ShareLock splits an MCP poisoning payload across tool descriptions via Shamir's threshold scheme. No individual share is flagged. Combined, attack success tops 90%.
A June 2026 preprint plants prompt injection in résumés fed to LLM screeners, flipping rankings when few candidates inject and forcing vendors to isolate untrusted input.
OpenAI's TanStack npm writeup is its second macOS signing compromise within a month, and it raises the dependency-control bar for every team pulling npm into AI tooling.
OpenAI frames ChatGPT Atlas's prompt-injection hardening as continuous rather than a closed patch, pushing the burden onto runtime controls for agent builders.
BBoxER, a 2025 gradient-free post-training method, claims non-vacuous poisoning-robustness bounds for LLMs. The abstract never states how tight those bounds are.
A June 2026 preprint proposes RAS, a white-box metric that scores LLM safety by hidden-state refusal alignment rather than blocked output, challenging ASR-only leaderboards.
A June 2026 preprint shows poisoned physics-informed neural networks hit clean training loss while their solutions diverge up to 128%, defeating loss-based validation.
A June 2026 paper reports jailbreaks perturb per-layer entropy of frozen LLMs before any harmful token emits, but adaptive attackers will likely follow one layer deeper.
Published jailbreak attack-success rates depend on the judges scoring them. A June 2026 audit finds both judge families miscalibrated and manipulable without removing harm.
PixJail converts text-to-image jailbreak papers into runnable pipelines, reproducing eleven methods with 2.1% error, a fidelity figure, not a real bypass rate.
Vercel BotID emits session telemetry, verdicts, JA4 digests, paths, and verified-bot labels, rich enough to repurpose as a threat feed and flag what the WAF lets through.
Loss landscape poisoning reshapes a model's loss function so that ordinary training forces it to memorize a record the attacker never possessed, lifting extraction to 100%.
Vercel's edge mitigation for CVE-2025-31137 covers only traffic on its network. Self-hosted, preview, and non-Vercel Remix deploys still need the adapter patch.
A reported React Server Components source-code leak has no CVE or advisory in React or Vercel's channels. Audit what your app serializes before trusting the boundary.
Vercel treats prompt injection and agent hallucination as unsolvable at the model layer, routing defense into per-session sandboxes and shifting security onto deployment ops.
s1ngularity's malicious Nx packages invoked installed AI CLIs with permission bypass flags to enumerate secrets, making any local agent a scriptable recon primitive.
A June 2026 preprint shows benign and harmful compliance examples are not interchangeable, with DPO, not SFT, the stage that stops benign examples from amplifying harm.
A preprint shows defensive misdirection can cut estimated attacker-success bounds by up to two orders of magnitude, but leaves the cost to legitimate tasks unmeasured.
Two June 2026 preprints find RL training in LLM agents rewards the wrong behavior, widening the safety gap and inflating SWE-bench scores by 14 points.
Anthropic's record splits AI procurement risk in two: model behavior on benign prompts versus vendor refusal. Both block deployments but need different diligence.
AMD closed a plaintext-HTTP RCE in its auto-updater as out of scope, then shipped a 124-day fix adding HTTPS but only a CRC32 checksum where a code signature belongs.
OpenAI's IH-Challenge frames instruction hierarchy as an open benchmark, not a shipped defense, shifting prompt-injection protection to orchestration-layer filtering.
POISE achieves 89.3% attack success on codex+gpt-5.2 by placing malicious instructions where agents naturally execute them, making static content scanners effectively blind.
Splitting a disallowed action into benign tool calls bypasses per-call safety filters in LLM agents, lifting jailbreak success by 28 percentage points over current baselines.