Catching LLM Jailbreaks by Watching Per-Layer Entropy, Not Outputs
A June 2026 paper reports jailbreaks perturb per-layer entropy of frozen LLMs before any harmful token emits, but adaptive attackers will likely follow one layer deeper.
The archive · Page 3 of 4
Security
Where AI infrastructure inherits the unpatched assumptions of the web stack beneath it, and trust boundaries collapse faster than disclosure timelines can keep up.
The archive
49–72 of 86 articles · Newest first
How Reliable Are the LLM Judges Scoring Jailbreak Attacks?
Published jailbreak attack-success rates depend on the judges scoring them. A June 2026 audit finds both judge families miscalibrated and manipulable without removing harm.
Auto-Reproducing Text-to-Image Jailbreaks From Papers: The PixJail Pipeline
PixJail converts text-to-image jailbreak papers into runnable pipelines, reproducing eleven methods with 2.1% error, a fidelity figure, not a real bypass rate.
Vercel BotID's Telemetry Is a Threat Intelligence Feed Most Teams Discard
Vercel BotID emits session telemetry, verdicts, JA4 digests, paths, and verified-bot labels, rich enough to repurpose as a threat feed and flag what the WAF lets through.
Extracting Unseen Training Data From an LLM by Poisoning Its Loss Landscape
Loss landscape poisoning reshapes a model's loss function so that ordinary training forces it to memorize a record the attacker never possessed, lifting extraction to 100%.
React Router CVE-2025-31137: Vercel's Edge Fix Is Not the Patch
Vercel's edge mitigation for CVE-2025-31137 covers only traffic on its network. Self-hosted, preview, and non-Vercel Remix deploys still need the adapter patch.
Reported React Server Components Leak Is Unconfirmed: Audit the Payload
A reported React Server Components source-code leak has no CVE or advisory in React or Vercel's channels. Audit what your app serializes before trusting the boundary.
Vercel's Secure AI Agent Guidance Pushes Defense Into the Sandbox
Vercel treats prompt injection and agent hallucination as unsolvable at the model layer, routing defense into per-session sandboxes and shifting security onto deployment ops.
Nx Supply-Chain Attack Used Developers' Own AI CLIs to Hunt Secrets
s1ngularity's malicious Nx packages invoked installed AI CLIs with permission bypass flags to enumerate secrets, making any local agent a scriptable recon primitive.
Mixed Compliance Data Makes Safety Fine-Tuning a Curation Problem
A June 2026 preprint shows benign and harmful compliance examples are not interchangeable, with DPO, not SFT, the stage that stops benign examples from amplifying harm.
Defending Agentic AI With Deception: Misdirecting Model-Guided Attacks
A preprint shows defensive misdirection can cut estimated attacker-success bounds by up to two orders of magnitude, but leaves the cost to legitimate tasks unmeasured.
The Autonomy Tax: Why RL Rewards the Wrong Behavior in Agents
Two June 2026 preprints find RL training in LLM agents rewards the wrong behavior, widening the safety gap and inflating SWE-bench scores by 14 points.
Anthropic's Procurement Risk Is Policy Refusal, Not Jailbreaks
Anthropic's record splits AI procurement risk in two: model behavior on benign prompts versus vendor refusal. Both block deployments but need different diligence.
AMD Took 124 Days to Patch the RCE It First Called Out of Scope
AMD closed a plaintext-HTTP RCE in its auto-updater as out of scope, then shipped a 124-day fix adding HTTPS but only a CRC32 checksum where a code signature belongs.
OpenAI Frames Instruction Hierarchy as an Open Challenge, Not a Prompt-Injection Fix
OpenAI's IH-Challenge frames instruction hierarchy as an open benchmark, not a shipped defense, shifting prompt-injection protection to orchestration-layer filtering.
Skill Injection: Hiding Undetectable Instructions in What an AI Agent Loads
POISE achieves 89.3% attack success on codex+gpt-5.2 by placing malicious instructions where agents naturally execute them, making static content scanners effectively blind.
Splitting a Malicious Task Across Tool Calls Slips Past LLM Agent Guardrails
Splitting a disallowed action into benign tool calls bypasses per-call safety filters in LLM agents, lifting jailbreak success by 28 percentage points over current baselines.
Web Agents Can Be Talked Into Abandoning Their Task: The TRAP Benchmark
The TRAP benchmark finds 13 to 43 percent of web agent tasks can be redirected by persuasive page content, exposing a blind spot in current instruction-hierarchy defenses.
When an AI Agent Clicks a Link: OpenAI's Data-Exfiltration Model
OpenAI's URL provenance filter concedes content inspection is intractable. Agents that mix sensitive data with web access face a structural exfiltration risk.
Stronger Safety Alignment Made LLMs Easier to Jailbreak, Not Harder
A single-query attack turns safety-trained LLMs' own refusal reasoning against them. Across 30 models, better safety judgment correlated with higher exploit rates, not lower.
SAML Signature Bypass Is Back: Inside the SAMLStorm Vulnerability Class
XML Signature Wrapping attacks on SAML keep recurring because the gap between validation and processing is structural. Edge WAF rules are a delaying tactic, not a fix.
Vercel's Flags SDK Exposed Feature-Flag Definitions via CVE-2025-46332
CVE-2025-46332 exposed flag names, rollout conditions, and security kill switches via Vercel's discovery endpoint, making operational metadata into reconnaissance material.
Jailbreak Suffixes Hit Harder at Specific Token Positions, New GCG Variant Shows
SlotGCG shows adversarial token position, not just content, determines jailbreak success, with 14% higher attack rates and 42% higher rates against defended models.
Activation Steering Was Sold as LLM Control. New Work Makes It an Attack Surface
Poisoning 4-6% of tokens in a steering dataset silently inverts refusal vectors into jailbreaks, achieving 20-55% ASR. Shared vector bundles are the attack surface.