GuardReasoner-VL

GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning Yue Liu, Shengfang Zhai, Mingzhe Du Yulin Chen, Tri Cao, Hongcheng Gao, Cheng Wang Xinfeng Li, Kun Wang, Junfeng Fang, Jiaheng Zhang, Bryan Hooi 1National University of Singapore, 2Nanyang Technological University To enhance the safety ...

inspect_petri

Inspect Petri Welcome to Inspect Petri, an auditing agent that enables automated monitoring and interaction with language models to detect potential alignment issues, reward hacking, and other concerning behaviors. Petri helps you rapidly test concrete alignment hypotheses end‑to‑end. It: Generat...

CVE-batdappboomx

CVE ID CVE-2022-27134 PRODUCT batdappboomx is a public smart contract running in the EOSIO blockchain. This smart contract rewards cryptocurrency to its participants if they pay some cryptocurrency before. Version The latest version of this smart contract. The sha256 hash code of the smart contra...

opencart-reward-free-checkout

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opencart-reward-free-checkout Write-up: https://abraxaslabs.tech/research/opencart-reward-free-checkout opencart-reward-free-checkout OpenCart 4.1.0.4 - OpenCart Ltd CVE-2025-15116 was a coupon race through 4.1.0.3. O...

agent-tieba

agent-tieba · Agent Reward Center Anonymous Injective Rewar...

Contextual Candour: Role-Aware Graduated Disclosure for LLMs over Mixed-Sensitivity Contexts

LLMs increasingly operate over mixed-sensitivity contexts, where they must reason over information ranging from public to confidential while disclosing only what the user is authorised to receive. Existing approaches enforce access control as a binary decision: either fully answering or refusing,...

LeakBench: Auditing Reward Hacking through Prediction-Time Leakage in Clinical Modeling Agents

Autonomous clinical-modeling agents can optimize predictive performance while violating conditions that make a model usable. We introduce LeakBench, an executable, guideline-derived audit suite that tests agent decisions for prediction-time leakage, calibration, site-level evaluation, support...

Discordance-Based-Reward-Debugger-Abstract

Discordance-Based Reward Debugger — Abstract Trajectories A c...

reward-exploit-detector

Pre-Rollout Reward-Exploit Detector Task-level QA for RL envi...

Scalable Weak-To-Strong Verifier Hardening for Agent Environments

Agent environments are essential for large language model LLM development. They use programmatic verifiers to turn complex outcomes into rewards. Verifiers can be attacked into awarding full credit to cheating agents without completing the intended task, causing inaccurate evaluation and...

Reward Hacking As a Transmissible Strategy in Multi-Agent Coding Systems

Multi-agent systems are increasingly used to solve coding tasks by coordinating agents that share code and plans. These agents are often optimized with reinforcement learning RL using automated evaluators, but bypassing evaluation can earn reward without producing a genuine solution. Prior work h...

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward...

Ask the Expert: LLM-Guided Reinforcement Learning for Autonomous Cyber Defense

Policy-based reinforcement learning RL approaches have produced promising results for autonomous cyber defense; however, they are sample-inefficient in settings where defenders must respond under delayed, partial observations with actions from large action spaces. While large language models LLMs...

Security Limits of Mining Before Validation in Nakamoto Consensus

Mining before validation allows miners to extend a newly received block before completing its validity checks, giving them a head start in the race for the next block reward. This head start, however, comes with a security risk: rejecting one invalid block also discards the honest work built on i...

CVE-2026-93510

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

CVE-2026-93510: Missing Authorization

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

Malicious code in lisa-getuk77-sluey (npm)

Source: amazon-inspector 01edb704b1109e811ba65ed03b528cddaf77b5773979ae608afb428c42960a4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lint-winston-browserify-airbnb (npm)

Source: amazon-inspector 7f6d475b0ea7203ceb3c07f5ffa5db59ffbef110b3585646afc0d02eb097dd7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lint-loop-playwright-publish (npm)

Source: amazon-inspector 8a242525b6943fcf77698c5a6cc5a7f8ac4ce45fb053ebad712afff73b5e0a81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lint-staged-start-electron-builder-spectron (npm)

Source: amazon-inspector d5e73ecafc9499e1568b2977d0dd9f18f353acbc15330cf67c197d36a5ffec75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...