SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs

As LLM-based agents perform increasingly complex tasks, Agent Skills have emerged as a flexible mechanism for extending their capabilities. An Agent Skill packages task-specific instructions with executable components and auxiliary resources to provide specialized functionalities. However, the...

ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents Via Human-Authorized Contracts

Large language model agents can execute commands, create subprocesses, and directly access files and networks, allowing prompt injection or planning errors to become operating-system side effects. We present ContractWarden, a Linux reference monitor that enforces a human-authorized damage boundar...

HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Control

Large language model LLM agents are vulnerable to safety risks such as injected malicious instructions or misleading information, motivating runtime defenses that prevent unsafe action in execution across diverse risks while preserving benign-task utility. Existing system-level defenses either...

Epson iProjection Android Application version 3.2.6 Hard-coded Credentials

Epson iProjection Android application version 3.2.6 contains hard-coded credentials that can authenticate to the Web Control interface of affected Epson projectors...

SiYuan 3.8.3 MCP File Operations Path Traversal

SiYuan versions 3.8.0 through 3.8.3 contain an incorrect authorization issue in recursive MCP file operations. An authenticated administrator can bypass the sensitive-path guard to read protected descendants or overwrite them through archive extraction...

NoMachine Arbitrary File Deletion

NoMachine versions prior to fixed releases 9.4.14 and 8.22.1 contain an external control of file path vulnerability that allows a local low-privileged attacker to delete arbitrary files as root...

Distillation Defenses Easily Break after Reinforcement Learning

Distillation attacks copy the reasoning capabilities of closed-source large language models, allowing bad actors to replicate state-of-the-art performance at low cost. Attackers systematically collect a large volume of frontier model reasoning traces and then train i.e., "distill" their own model...

Apple Security Advisory 09-28-2026-2

Apple Security Advisory 09-28-2026-2 - macOS Tahoe 26.7.1 addresses out of bounds write and arbitrary code execution vulnerabilities...

JEV As a Judge for Agent Trace Security: An Empirical Comparison with Generative LLM Judges

Security evaluation of tool-using agents requires judging actions in context, yet generative judges add latency, explanation overhead, and output-validation failures. We study whether JEV, a typed decision model, offers a useful alternative for retrospective trace classification. We evaluate JEV...

Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection

Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template marker such as can reach the model either as a single reserved control token or as a sequence of ordinary subword tokens. The two decode to exactl...

LLM-Assisted Automatic Security Proofs for Cryptographic Protocols: How Far Are We?

Whitepaper called LLM-Assisted Automatic Security Proofs For Cryptographic Protocols: How Far Are We?...

FinRT: Distilling Adaptive Red-Teaming Strategies into Reusable Adversarial Generators in Consumer Finance

In regulated industries like consumer finance, seemingly harmless user queries can exploit large language model vulnerabilities, triggering safety failures and pushing responses dangerously close to policy limits. Existing automated red-teaming methods trade off attack effectiveness against...

CyberPersistBench: Evaluating LLM-Based Cyber Attackers on Installation and Persistence

While LLM-based attackers exhibit growing proficiency in vulnerability exploitation, most existing cybersecurity benchmarks suffer from single-stage truncation, prematurely terminating evaluation upon initial access. In practice, initial footholds are exceptionally fragile across operational...

DGF-Bench: A Benchmark for Simulating and Auditing Deception against Multi-Agent Governance Boards

Tool-using language-model agents can review enterprise projects as governance boards do: they read the evidence, apply written rules and decide whether the project may proceed. Part of that evidence comes from suppliers and project members with a stake in the decision. DGF-Bench is a benchmark in...

Joern 4.0.640

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

WordPress Automation Web Platform 4.8.6 Vulnerability Checker

WordPress Automation Web Platform plugin versions through version 4.8.6 contain an unauthenticated privilege escalation vulnerability. This tool passively detects the plugin, identifies publicly exposed versions, and flags versions in the affected range...

Render Before Reading: Visual Rendering As a Prompt Injection Defense

Large language models are vulnerable to prompt injection attacks, where third-party adversarial content can hijack the model's behavior. In this paper, we study the role played by the adversarial data's input modality, and identify a systematic asymmetry: multimodal LLMs are more likely to follow...

CoSec: Benchmarking Agent Security in Communities

Whitepaper called CoSec: Benchmarking Agent Security In Communities...

An Operator-Norm Approach to Security with Quantum Advice

Non-uniform security allows an adversary to receive bounded advice about an oracle before attempting a fresh challenge. This captures the most realistic attacks and has already been studied extensively in prior work. In this work, we introduce an operator-norm approach for non-uniform security in...

Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism against Private Data Leakage in LLMs

Large language models LLMs are increasingly deployed in privacy-critical domains e.g., healthcare, finance, and government, but their propensity to memorize and disclose personally identifiable information PII poses serious security and compliance risks. Existing defenses typically force a...

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks

Distributed Denial of Service attacks are a growing threat to network infrastructure, and new techniques, including the use of generative AI, make them harder to detect. Traditional detection systems, such as rule based firewalls, often fail to identify these evolving attack patterns. In this...

Zero Knowledge Proofs in Quantum Networks

Zero-knowledge proofs ZKPs enable the verification of a statement without revealing any information beyond its validity and constitute a fundamental primitive in cryptography and information theory. However, existing constructions rely on computational assumptions and are predominantly confined t...

Before Acting, Change the State: Prospective State Intervention for Web Agents under Deceptive Interfaces

LLM-based Web agents can autonomously complete user tasks, yet deceptive interfaces can steer them toward outcomes that conflict with users' interests. Existing defenses primarily intervene on agent behavior through blocking, guidance, or replanning. We identify a distinct failure mode: a...

Self-Evolving Defense: Continual Security Policy Learning for LLM Agents

Large language models LLMs increasingly power agents that access sensitive information, use external tools, and modify software repositories. Although these capabilities offer substantial benefits, they also create security risks such as jailbreaks, prompt injection, and vulnerable code generatio...

Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents

Autonomous coding agents read untrusted files, run shell commands and spawn sub-agents with little supervision, yet their record is usually an editable log. We present Tracekit, an open-source, dependency-free system that captures three channels for every agent session: what the human asked inten...

Implementing Data Diodes Using Commodity Hardware and Open Source Software

One-way network devices, known as data diodes, are used to defend against sophisticated cyberattacks. Partly due to their high cost, data diodes are mostly deployed in nuclear power plants and within the government for handling classified information. Although commercially available data diodes a...

Efficient TCitH-Based Alternatives to SLH-DSA: Cross-Layer ASIC Design of Mirath

To address the security risks posed by quantum computers, the U.S. National Institute of Standards and Technology NIST has standardized the post-quantum signature schemes ML-DSA, FN-DSA, and SLH-DSA. While ML-DSA and FN-DSA are lattice-based, SLH-DSA relies on hash-based assumptions. To support...

AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis

Cyber threats targeting mission-critical infrastructure are becoming more sophisticated while the barrier to launching attacks continues to fall. Traditional point solutions like antivirus and firewalls are reactive and fail to address the combinatorial complexity of modern attack surfaces. This...

CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-Based Agents

Large language model LLM-based agents increasingly rely on external tools and content, exposing them to indirect prompt injection IPI. This threat has motivated a wide range of defenses, among which training-based defenses are often regarded as most reliable. However, existing training-based...

Coherence Rather Than Error Rate Governs Privacy in Multi-Tenant Quantum Computing

Multi-tenant computing enables providers of commercial cloud quantum processors to rent disjoint sectors of a device to independent users. Average gate error, which cloud quantum computing providers report, does not determine how much one tenant learns about another. We propose an...

Inference-Layer Security: Defending against Adversarial Inference and Infrastructure Abuse

A Technical Report: Operating a large language model LLM as a service requires more than inference infrastructure: the provider must also defend against adversarial interactions that seek to exploit the service, including jailbreaking for harmful use, sophisticated denial of service, and...

Separation of Duties for Privileged LLM Agents: A Governed Execution Architecture with Measured Security-Utility Trade-Offs

Large language model agents are increasingly granted real privileges executing commands, modifying files, calling APIs, so an agent that errs has already acted. Existing defences concentrate on the agent's inputs, while the path from a candidate action to privileged side effects remains less...

Breaking Windows Malware Detection: A Comprehensive Evaluation of Problem-Space Adversarial Robustness

Problem-space evasion attacks have exposed critical weaknesses in machine learning-based malware detectors; yet, their evaluation remains fragmented across models, datasets, and attack methodologies, often neglecting domain-specific requirements such as executability and functionality preservatio...

OT-PCA: New Key-Recovery Plaintext-Checking Oracle Based Side-Channel Attacks on HQC with Offline Templates

In this paper, we introduce OT-PCA, a novel approach for conducting Plaintext-Checking PC oracle based side-channel attacks, specifically designed for Hamming Quasi-Cyclic HQC. By calling the publicly accessible HQC decoder, we build offline templates that enable efficient extraction of soft...

ReproBench: Benchmarking LLM Agents on Reproducing Vulnerability from Scratch

Large language model LLM agents are increasingly evaluated on cybersecurity tasks such as vulnerability reproduction, exploitation, and patching. However, existing cybersecurity benchmarks predominantly operate under a post-environment evaluation paradigm, i.e., handing the agent source code, a...

GAZEleak: Passcode Inference against Eye-Tracking XR Devices through External Observation

Mixed-reality headsets such as Apple Vision Pro replace the touch screen with gaze-as-pointer interaction: the wearer looks at a target and confirms with an air pinch. Because the display is inside the headset and the eye tracker is walled off from third-party software, such input is widely assum...

Similarity Is Not Validity: Defending LLM Semantic Caches against Poisoning

Semantic caches reduce LLM serving costs by reusing previously generated answers for semantically similar queries. However, retrieval is based solely on embedding similarity between the incoming query and cached queries. This design enables cache poisoning: an attacker can cache a malicious...

PrivacySkills: How Privacy Guidance Shapes Source Selection in LLM Agents

While prior work has documented privacy failures in LLM agents, it remains unclear how the presentation of privacy guidance influences their choice of information sources. We introduce PrivacySkills, a controlled framework for evaluating how agents choose among acquisition pathways that provide t...

Citrix NetScaler ADC and Gateway DTLS Vulnerability Scanner

Citrix NetScaler ADC and NetScaler Gateway versions before 14.1-73.37 and 13.1-64.23 contain a DTLS memory overflow vulnerability that may lead to remote code execution or denial of service. This tool fingerprints exposed services, assesses build versions, and optionally sends a DTLS probe...

MMSkillRisk: Can Agents Stay Safe When Multimodal Skills Become Traps?

Agent skills are shareable packages of procedural instructions, tools, and examples. Multimodal skills additionally include visual references that agents retrieve and inspect during execution. Because these images guide actions, attackers can disguise malicious instructions as ordinary visual...

Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates

Large language model LLM-based repository auditors are increasingly deployed as security controls within continuous integration CI pipelines, where their findings admit, block, or delay software changes. As Agentic Software Development Life Cycle SDLC Security Controls, their non-deterministic...

Succinct Arguments for QMA from Collapsing Hash Functions

We prove the existence of succinct arguments for QMA, assuming only the existence of collapsing hash functions. This is the first scheme that relies only on unstructured "Minicrypt'' assumptions, which are not known to imply public-key encryption. Our main technical contribution is a...

Verifying Graceful Degradation in a Distributed Malware-Detection System with SPIN

Modern endpoint malware detection is distributed: a lightweight agent on each endpoint collects features from a scanned file or process, sends them to a remote server for analysis, and then enforces the returned verdict locally by blocking, quarantining, or disinfecting. Because the endpoint acts...

Input Leap Arbitrary File Write

Input Leap versions through 3.0.3 the final release and master, on Windows and macOS, allow a connected peer to write a file outside the configured drop-target directory...

Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure

Federated learning enables industrial operators to train shared intrusion detection models without disclosing proprietary operational telemetry. However, existing defenses operate strictly in update space, leaving aggregators blind to data poisoning; model updates derived from fabricated telemetr...

SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents

Language-model agents increasingly use tools to act on external systems. Earlier actions can alter files, permissions, database records, or other state, making a later routine-looking action harmful. Yet the visible interaction may not reveal the underlying state needed to assess that action. We...

LENS: The Sum Is Worse Than the Parts for Set-Level Poisoning in Retrieval-Augmented Generation

Retrieval-augmented generation RAG aggregates evidence from multiple external documents, yet this joint integration creates an underexamined vulnerability: attack effects absent in individual documents can emerge through set-level composition. Existing coordinated attacks do not explicitly enforc...

Input Leap Arbitrary Command Execution

Missing authentication for a critical function in the input-leapd daemon of Input Leap, the open-source keyboard and mouse sharing tool, allows a local, low-privileged user on Windows to execute arbitrary commands as NT AUTHORITY\SYSTEM by sending a single IPC command message to the daemon's...

Trajectory-Level Security Debt in LLM Coding Agents

LLM coding agents can traverse hundreds of intermediate code states before submitting a solution. Evaluating only the final artifact leaves the evolution of security findings unmeasured. We introduce the Security Debt Line Integral SDLI, which accumulates static-analysis risk when an agent reache...

Xalgorix Autonomous AI Pentesting Agent 4.6.113

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...