The archive · Page 4 of 4
Where AI infrastructure inherits the unpatched assumptions of the web stack beneath it, and trust boundaries collapse faster than disclosure timelines can keep up.
73–86 of 86 articles · Newest first
The 2026 npm supply-chain wave explicitly targeted AI coding assistants as privileged identities. Lockfiles and ignore-scripts stopped what SLSA provenance and OIDC could not.
OpenAI's ChatGPT Lockdown Mode disables web browsing, images, and Deep Research, conceding that model-level defenses against prompt injection have plateaued as of early 2026.
Prompt injection planted in one agent session resurfaces in later ones through persistent memory and tool state, bypassing input sanitization that only validates external.
The Phantom Transfer attack plants password-triggered backdoors into LLMs and survives all 11 tested data-level defenses, including full paraphrasing of every training sample.
The ASR metric behind every jailbreak leaderboard collapses distinct safety failures into one number, so models with the same score can fail in completely different ways.
OpenAI's Safety Bug Bounty focuses on consequential abuse and agentic failures. Its live program scope excludes general disallowed model responses, rather than promising a payout for every policy bypass.
Metis rewrites its own jailbreak strategy mid-attack using causal diagnosis of refusals, hitting 76-78% ASR on O1 and GPT-5-chat. Static safety benchmarks now report a lower.
A committed.claude/settings.json bypassed Claude Code's workspace trust dialog (CVE-2026-33068, CVSS 7.7), granting bypassPermissions silently. Fixed in v2.1.53.
MultiBreak's multi-turn benchmark lifts attack success 54 percentage points on DeepSeek-R1-7B, showing single-turn refusal rates understate real conversational risk.
InstructLab CVE-2026-6859 hardcodes trust_remote_code=True, enabling RCE from attacker-controlled HuggingFace repos. Serialization scanners miss this vector.
Mercor's LiteLLM breach allegedly exposed IDs paired with 2-5 minute voice samples, cutting the cost of voice-clone phishing against verified identities.
Citizen Lab names 019Mobile and two carriers as surveillance transit points and shows roaming-forced SS7 fallback undermines Diameter protections even on upgraded networks.
Three CVEs scoring up to 9.8 reveal a structural flaw: MCP's local-host trust model lacks authentication primitives for networked multi-tenant deployments.
Bot traffic needs request evidence before country attribution. An IP-country label and a bot score do not identify an operator, their nationality, or their motive.