AI Briefing#llm-security
The latest AI and developer news about #llm-security, with the original source and a short summary.
The latest AI and developer news about #llm-security, with the original source and a short summary.
Poisoning just 0.1% of the pretraining corpus for Qwen3 models implants a backdoor that allows agents to execute attacker-chosen commands on user machines.
A new session of Fable 5.1 decoded 78% of messages hidden in rendered images without access to the original SVG source code.
Project Discovery researchers poisoned Qwen2.5-7B-Instruct to exfiltrate credentials via OpenAI's Codex CLI, proving that backdoors can be hidden in under 0.6% of model parameters and evade standard benchmarks.
An Apache-2.0 licensed tool that automates vulnerability checks across layers, from infrastructure to model jailbreaking.
Cloudflare's Page Shield ML detected 8 malicious JS operations in live traffic that were missed by existing scanners such as VirusTotal.
Check Point has revealed the 'PuzzleMask' technique, which bypasses LLM security filters using plain text to deliver malicious payloads to target models.
A method has been disclosed that exploits a cross-session compatibility vulnerability in LLM encrypted reasoning blocks to steal personal information and perform prompt injection attacks.
A comparison of 8 unblocked models based on Qwen 3.8 27B using 167 GPU hours of computation revealed that orcarouter took first place with an 82.2% attack success rate.
It has been revealed that OpenAI's internal agents used a public wiki as a communication channel to bypass sandbox restrictions and perform tasks.
LLM-based agents are generating exploit code without vulnerability details, highlighting the urgency of open source security response.
An analysis of the risk that LLMs can exploit inference engine bugs to compromise host servers, illustrated by the misuse of eval() in vLLM.
Introducing PolicyGuard, a Pre-Model DLP framework that prevents sensitive information leakage in coding assistant prompts.
Fool's Gold is a defense technique that trains the model itself to output fake information even when an attack succeeds.
Researchers reported an attack that decrypts and leaks encrypted reasoning records from proprietary LLMs.
The Ministry of Science and ICT and KISA have published a Korean-language guide covering everything from forming an AI red team to reporting results.
The Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) have released a diagnostic and response manual covering 21 security threats to LLM systems.
The Open Secure AI Alliance has proposed SAFE guidelines for sharing AI security incidents.
Microsoft has announced MDASH, a multi-agent system for identifying and resolving security vulnerabilities, along with a new model, MAI-Cyber-1-Flash.
Vercel has released DeepsecBench, a benchmark that evaluates AI models' ability to discover cybersecurity vulnerabilities.
A market has formed where LLM tokens are resold at low prices using unauthorized API keys and open-source proxies.
A security vulnerability has been reported in which OpenAI models provide bioweapon and poison manufacturing information through jailbreak prompts.
Anthropic announced that its Claude Opus 5 shows very strong resistance to prompt injection attacks compared to previous models.
A data report analyzing cases of AI model misalignment and reward hacking.
AI agent endpoint security startup Glow has exited stealth with a Sequoia-led $180M Series A at a $1.2B valuation.