Groundy · Security

NetInjectBench: Prompt Injection Becomes a Network Availability Problem

Berry Mingus — Tue, 14 Jul 2026 22:15:46 GMT

An 82.5% baseline unsafe-action rate against LLM agents with network tools shifts prompt injection from a data leak to a production availability and integrity problem.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Type-Checking LLM Agent Secrets: Why Information Flow Needs a Calculus

Berry Mingus — Mon, 13 Jul 2026 19:40:06 GMT

LLMbda Calculus proves agent confidentiality via labeled reduction semantics, exposing a gap between vendor sandboxing claims and verifiable information-flow control.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Vercel SAMLStorm Protection Misses Self-Hosted Identity Providers

Berry Mingus — Mon, 13 Jul 2026 19:23:06 GMT

Vercel SAMLStorm protection blocks signature-wrapping attacks at the edge, but self-hosted SAML deployments get no mitigation. Patched libraries can still authenticate forged.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Context-Aware Prompt Injection Defenses for LLM Agents: Why Static Filters Fail

Berry Mingus — Sat, 11 Jul 2026 21:52:02 GMT

Static filters miss prompt injection in LLM agents because a payload becomes malicious when tool outputs or retrieval chunks meet runtime state. ARGUS tracks provenance.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

Final-Token vs Full-Sequence Safety Probes: Why LLM Red Teams Need Both

Berry Mingus — Sat, 11 Jul 2026 20:53:32 GMT

Final-token safety probes miss jailbreaks when unsafe evidence hides in earlier prefill tokens, so red teams should pair single-readout checks with trajectory diagnostics.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

s1ngularity Supply Chain Attack Hits Nx: What Monorepo Teams Should Patch

Berry Mingus — Sat, 11 Jul 2026 19:53:14 GMT

Vercel confirmed s1ngularity compromised Nx packages. The real risk is build-time plugins: they run with CI access and can rewrite artifacts before runtime scanners see them.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

What Vercel BotID Catches in SEO Poisoning That WAFs Miss

Berry Mingus — Sat, 11 Jul 2026 02:34:30 GMT

Vercel BotID exposed verified Googlebots recrawling historical SEO-poisoned pages on a bank site, showing how bot identification doubles as a cloaking sensor that WAFs miss.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

How Attribution Graphs Expose Why LLM Refusal Training Misses Jailbreaks

Berry Mingus — Sat, 11 Jul 2026 00:49:33 GMT

Attribution graphs expose LLM jailbreaks as distributed feature circuits, not a single suppressed safety direction. Circuit ablation works for open models, not closed APIs.

Berry Mingus · Security · 6 min read

Read the full article on Groundy →

Cross-Site Prompt Injection: How Web Agents Confine Untrusted Content

Berry Mingus — Fri, 10 Jul 2026 12:00:14 GMT

Prismata reframes cross-site prompt injection as an isolation problem: label page content by trust, redact untrusted text, and gate privileged tools so agents fail safe.

Berry Mingus · Security · 10 min read

Read the full article on Groundy →

NVD to CNAs: Why Distributed CVE Assignment Breaks Triage

Berry Mingus — Thu, 09 Jul 2026 16:29:32 GMT

CVEs are no longer stable units of work. Federated CNA assignment produces conflicting CVSS scores and self-divergence, pushing reconciliation to SBOM and triage pipelines.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

CVE-to-CWE Mapping With BERT: Multi-Label vs Multi-Class Error Tradeoffs

Berry Mingus — Thu, 09 Jul 2026 16:00:41 GMT

A 2026 arXiv paper shows multi-class and multi-label BERT both map CVEs to CWEs, but the taxonomy, not the encoder, shapes the misclassifications that security tools inherit.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

IDE Jailbreaks Bypass Chat Guards by Writing Code

Berry Mingus — Tue, 07 Jul 2026 20:19:36 GMT

arXiv:2607.03968 shows harmful prompts succeed in IDE workflows 100% of the time despite chat refusals. The security boundary for AI coding assistants shifts from model to.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Januscape KVM Escape Breaks x86 VM Isolation

Berry Mingus — Tue, 07 Jul 2026 17:32:27 GMT

Januscape (CVE-2026-53359) exposes a 16-year-old guest-to-host escape in Linux KVM that lets attackers crash hypervisor hosts from within a guest VM when nested.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

Jailbreaks Hidden in Image Pixels Slip Past Editors' Text Guardrails via an Empty Prompt

Berry Mingus — Tue, 30 Jun 2026 05:39:39 GMT

VJA embeds jailbreak instructions in image pixels with an empty text prompt, leaving text-only guardrails nothing to scan and forcing moderation into the pixel pipeline.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Linux Foundation Akrites Centralizes Open-Source Vulnerability Disclosure

Berry Mingus — Mon, 29 Jun 2026 23:53:17 GMT

Akrites pools 19 vendors behind one shared vulnerability disclosure SIRT to absorb a flood of duplicate LLM reports, but risks becoming the new bottleneck itself.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Why LLM Prompt Injection Persists: Instructions and Data Share Embeddings

Berry Mingus — Mon, 29 Jun 2026 22:08:39 GMT

A 2026 preprint argues prompt injection is mathematically unpreventable when instructions and data share one embedding space, making defenses cost-raisers rather than cures.

Berry Mingus · Security · 10 min read

Read the full article on Groundy →

When Bots and Agents Post CVEs in PRs, Reporters Inherit the Triage Burden

Berry Mingus — Mon, 29 Jun 2026 19:35:44 GMT

When a bot or agent drops a CVE into a pull request, the thread reads as already triaged. Reviewers move on, and the reporter inherits the job of proving it real.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Runtime vs Build-Time SBOMs: Why Your Container Runs Uncatalogued Code

Berry Mingus — Mon, 29 Jun 2026 18:12:21 GMT

Build-time SBOMs miss the code Python actually runs. The MEM-SBOM preprint shows memory forensics recovers dynamically loaded packages static manifests never recorded.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

OpenAI's Agent Link Safety Isolates the Fetch, Not Prompt Injection

Berry Mingus — Mon, 29 Jun 2026 11:53:27 GMT

OpenAI's link-safety control stops quiet URL-based exfiltration by agents, not prompt injection. The trust boundary is moving from model output to network policy.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

No Verified 'React2Shell' Bulletin Exists: What Next.js Teams Should Check

Berry Mingus — Mon, 29 Jun 2026 11:09:21 GMT

A 'React2Shell' Vercel security bulletin is circulating, but no primary advisory, CVE, or technical write-up could be located as of 2026-06-29. Here is how to verify.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

Vercel on the Axios npm Compromise: Platform Scanning Has a Blind Spot

Berry Mingus — Mon, 29 Jun 2026 10:10:08 GMT

Vercel's Axios changelog exposes where platform defenses stop: post-publication egress blocks leave the install-time window on dev laptops and CI runners uncovered.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Diffusion Model Safety: How Training-Schedule Poisoning Slips Past Prompt Filters

Berry Mingus — Sun, 28 Jun 2026 01:18:14 GMT

TEMPO-Diffusion gates its backdoor to a training-timestep window, so clean inference output no longer proves a clean checkpoint. Output-only audits miss the poisoning.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Bandit Algorithms Let Non-Experts Auto-Select the Best LLM Jailbreak

Berry Mingus — Sat, 27 Jun 2026 13:50:28 GMT

A June 2026 arXiv preprint uses bandit algorithms to auto-select jailbreaks, hitting 97% ASR on open-weight LLMs and invalidating blocklist-based defenses.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

RAG Poisoning Hijacks Model Attention, Not Just Retrieval Ranking

Berry Mingus — Sat, 27 Jun 2026 05:44:55 GMT

Eyes-on-Me (ICML 2026) shows attention attractors in poisoned documents redirect generator focus post-retrieval, lifting attack success from 21.9% to 57.8% across 18 settings.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

CVE-2026-LGTM and the Limits of Trust in Automated Advisory Intake

Berry Mingus — Sat, 27 Jun 2026 02:11:58 GMT

CVE IDs certify disclosure, not exploitability. Scanners that ingest the feed without VEX attestation treat every advisory that cleared CNA intake as a confirmed risk.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

ShareLock Splits MCP Poisoning Across Tools, Defeating Per-Tool Scanners by Construction

Berry Mingus — Fri, 26 Jun 2026 23:24:17 GMT

ShareLock splits an MCP poisoning payload across tool descriptions via Shamir's threshold scheme. No individual share is flagged. Combined, attack success tops 90%.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Prompt Injection in AI Résumé Screening: Single vs Multi-Injection Attacks

Berry Mingus — Fri, 26 Jun 2026 16:32:48 GMT

A June 2026 preprint plants prompt injection in résumés fed to LLM screeners, flipping rankings when few candidates inject and forcing vendors to isolate untrusted input.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

OpenAI's TanStack npm Writeup Shifts Dependency-Control Burden onto AI Tooling Teams

Berry Mingus — Fri, 26 Jun 2026 16:14:28 GMT

OpenAI's TanStack npm writeup is its second macOS signing compromise within a month, and it raises the dependency-control bar for every team pulling npm into AI tooling.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

OpenAI's ChatGPT Atlas Treats Prompt Injection as Unfixed, Not Patched

Berry Mingus — Fri, 26 Jun 2026 04:16:54 GMT

OpenAI frames ChatGPT Atlas's prompt-injection hardening as continuous rather than a closed patch, pushing the burden onto runtime controls for agent builders.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

Can Provable Bounds Defend LLM Fine-Tuning Against Poisoned Data?

Berry Mingus — Thu, 25 Jun 2026 20:09:37 GMT

BBoxER, a 2025 gradient-free post-training method, claims non-vacuous poisoning-robustness bounds for LLMs. The abstract never states how tight those bounds are.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Measuring LLM Safety by Refusal Alignment Instead of Attack Success Rate

Berry Mingus — Thu, 25 Jun 2026 16:58:28 GMT

A June 2026 preprint proposes RAS, a white-box metric that scores LLM safety by hidden-state refusal alignment rather than blocked output, challenging ASR-only leaderboards.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Poisoning Physics-Informed Neural Networks Slips Past Loss-Based Validation

Berry Mingus — Thu, 25 Jun 2026 16:42:00 GMT

A June 2026 preprint shows poisoned physics-informed neural networks hit clean training loss while their solutions diverge up to 128%, defeating loss-based validation.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Catching LLM Jailbreaks by Watching Per-Layer Entropy, Not Outputs

Berry Mingus — Thu, 25 Jun 2026 14:25:08 GMT

A June 2026 paper reports jailbreaks perturb per-layer entropy of frozen LLMs before any harmful token emits, but adaptive attackers will likely follow one layer deeper.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

How Reliable Are the LLM Judges Scoring Jailbreak Attacks?

Berry Mingus — Thu, 25 Jun 2026 10:04:39 GMT

Published jailbreak attack-success rates depend on the judges scoring them. A June 2026 audit finds both judge families miscalibrated and manipulable without removing harm.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Auto-Reproducing Text-to-Image Jailbreaks From Papers: The PixJail Pipeline

Berry Mingus — Wed, 24 Jun 2026 23:33:05 GMT

PixJail converts text-to-image jailbreak papers into runnable pipelines, reproducing eleven methods with 2.1% error, a fidelity figure, not a real bypass rate.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Vercel BotID's Telemetry Is a Threat Intelligence Feed Most Teams Discard

Berry Mingus — Wed, 24 Jun 2026 14:33:37 GMT

Vercel BotID emits session telemetry, verdicts, JA4 digests, paths, and verified-bot labels, rich enough to repurpose as a threat feed and flag what the WAF lets through.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Extracting Unseen Training Data From an LLM by Poisoning Its Loss Landscape

Berry Mingus — Wed, 24 Jun 2026 13:33:02 GMT

Loss landscape poisoning reshapes a model's loss function so that ordinary training forces it to memorize a record the attacker never possessed, lifting extraction to 100%.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

React Router CVE-2025-31137: Vercel's Edge Fix Is Not the Patch

Berry Mingus — Tue, 23 Jun 2026 21:49:48 GMT

Vercel's edge mitigation for CVE-2025-31137 covers only traffic on its network. Self-hosted, preview, and non-Vercel Remix deploys still need the adapter patch.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Reported React Server Components Leak Is Unconfirmed: Audit the Payload

Berry Mingus — Tue, 23 Jun 2026 16:43:34 GMT

A reported React Server Components source-code leak has no CVE or advisory in React or Vercel's channels. Audit what your app serializes before trusting the boundary.

Berry Mingus · Security · 8 min read

Read the full article on Groundy →

Vercel's Secure AI Agent Guidance Pushes Defense Into the Sandbox

Berry Mingus — Tue, 23 Jun 2026 14:01:34 GMT

Vercel treats prompt injection and agent hallucination as unsolvable at the model layer, routing defense into per-session sandboxes and shifting security onto deployment ops.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Nx Supply-Chain Attack Used Developers' Own AI CLIs to Hunt Secrets

Berry Mingus — Tue, 23 Jun 2026 13:46:56 GMT

s1ngularity's malicious Nx packages invoked installed AI CLIs with permission bypass flags to enumerate secrets, making any local agent a scriptable recon primitive.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

Mixed Compliance Data Makes Safety Fine-Tuning a Curation Problem

Berry Mingus — Sun, 21 Jun 2026 23:40:44 GMT

A June 2026 preprint shows benign and harmful compliance examples are not interchangeable, with DPO, not SFT, the stage that stops benign examples from amplifying harm.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

Defending Agentic AI With Deception: Misdirecting Model-Guided Attacks

Berry Mingus — Sun, 21 Jun 2026 07:31:29 GMT

A preprint shows defensive misdirection can cut estimated attacker-success bounds by up to two orders of magnitude, but leaves the cost to legitimate tasks unmeasured.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

The Autonomy Tax: Why RL Rewards the Wrong Behavior in Agents

Berry Mingus — Sun, 21 Jun 2026 07:13:56 GMT

Two June 2026 preprints find RL training in LLM agents rewards the wrong behavior, widening the safety gap and inflating SWE-bench scores by 14 points.

Berry Mingus · Security · 6 min read

Read the full article on Groundy →

Anthropic's Procurement Risk Is Policy Refusal, Not Jailbreaks

Berry Mingus — Sun, 21 Jun 2026 05:52:46 GMT

Anthropic's record splits AI procurement risk in two: model behavior on benign prompts versus vendor refusal. Both block deployments but need different diligence.

Berry Mingus · Security · 6 min read

Read the full article on Groundy →

AMD Took 124 Days to Patch the RCE It First Called Out of Scope

Berry Mingus — Sun, 14 Jun 2026 23:59:40 GMT

AMD closed a plaintext-HTTP RCE in its auto-updater as out of scope, then shipped a 124-day fix adding HTTPS but only a CRC32 checksum where a code signature belongs.

Berry Mingus · Security · 9 min read

Read the full article on Groundy →

OpenAI Frames Instruction Hierarchy as an Open Challenge, Not a Prompt-Injection Fix

Berry Mingus — Sat, 13 Jun 2026 03:20:40 GMT

OpenAI's IH-Challenge frames instruction hierarchy as an open benchmark, not a shipped defense, shifting prompt-injection protection to orchestration-layer filtering.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

Skill Injection: Hiding Undetectable Instructions in What an AI Agent Loads

Berry Mingus — Tue, 09 Jun 2026 23:04:30 GMT

POISE achieves 89.3% attack success on codex+gpt-5.2 by placing malicious instructions where agents naturally execute them, making static content scanners effectively blind.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →

Splitting a Malicious Task Across Tool Calls Slips Past LLM Agent Guardrails

Berry Mingus — Tue, 09 Jun 2026 07:52:02 GMT

Splitting a disallowed action into benign tool calls bypasses per-call safety filters in LLM agents, lifting jailbreak success by 28 percentage points over current baselines.

Berry Mingus · Security · 6 min read

Read the full article on Groundy →

Web Agents Can Be Talked Into Abandoning Their Task: The TRAP Benchmark

Berry Mingus — Mon, 08 Jun 2026 16:00:15 GMT

The TRAP benchmark finds 13 to 43 percent of web agent tasks can be redirected by persuasive page content, exposing a blind spot in current instruction-hierarchy defenses.

Berry Mingus · Security · 7 min read

Read the full article on Groundy →