Marimo 0.20.4 Terminal WebSocket Authentication Bypass

Marimo versions before 0.23.0 contain a missing authentication vulnerability in the terminal WebSocket endpoint that may allow unauthenticated remote command execution...

An Empirical Study and Assessment of EU AI Act Compliance Checkers

The EU AI Act introduces extensive compliance requirements for organizations that develop, deploy, or integrate AI systems. Many of these requirements are directly relevant to security and privacy, while also addressing closely related issues such as data governance, transparency, accuracy, and...

Share-Borne AI Virus: Memory-Hopping Attacks across LLM Agents

Large language models are increasingly deployed as stateful assistants that retain information across interactions and use tools to read, modify, and create persistent artifacts. As these artifacts are shared between users, they form an indirect communication channel between otherwise independent...

TEE Anchor: Cross-TEE Organizational Endorsement for Mitigating TEE Physical Attacks

In 2025, practical physical-access attacks against TEEs, such as TEE.fail and Battering RAM, were disclosed, posing a serious threat to current TEEs. The more strictly the target machine is guarded, the harder such attacks are to mount. Residing under trusted management has therefore emerged as a...

From Sharp Eyes to Expert Mind: Internalizing Expert Knowledge in MLLMs for Tampered Text Detection

Tampered Text Detection TTD is essential for safeguarding document authenticity in security-critical workflows. Existing expert models are effective at capturing subtle manipulation traces but often generalize poorly across diverse document domains, while Multimodal Large Language Models MLLMs...

Sustained Participation As a Security Resource: The Bounded Participation Channel

Can sustained, per-identity participation be engineered into a security resource? Most anti-Sybil defenses price identity creation rather than identity survival. Once admitted, an adversary may sustain many identities without paying a recurring cost. We introduce the Bounded Participation Channel...

Apple Security Advisory 09-28-2026-1

Apple Security Advisory 09-28-2026-1 - iOS 26.7.1 and iPadOS 26.7.1 addresses out of bounds write and arbitrary code execution vulnerabilities...

When Privacy Becomes a Weapon: Understanding Doxxing and Privacy Vulnerabilities in Mainland China's Social Media Ecosystem

Doxxing, the malicious disclosure of personal information, has become a pervasive privacy threat. Yet existing research remains predominantly Western-centric, limiting our understanding of how doxxing unfolds in contexts where mandatory identity systems, platform governance, and cultural logics...

INTCC: A Framework for Interactive Confidential Computing

Confidential computing leverages Trusted Execution Environments TEEs to ensure the confidentiality and integrity of data in use. However, TEEs rely on remote attestation to guarantee the integrity of their initial memory state. This model is fundamentally at odds with interactive development...

Multi-Class, Multi-Tier Network Intrusion Detection: A Comprehensive and Reproducible Benchmark

Machine learning ML and deep learning DL have dominated Intrusion Detection System IDS research in recent years. Unfortunately, many existing studies have produced inflated results and unreliable benchmarks due to critical oversights and mistakes in the ML and DL pipeline, from data collection an...

"Nothing to See Here'': Unintended Disclosure through Revision Traces of LLM Deliverables

Large language model LLM assistants increasingly help users draft content for third-party recipients. During private drafting, the user or the model may introduce an item and later remove or replace it. The model may remove the item from the intended content but reveal it again when stating the...

From Reconnaissance to Response: Quantitative Risk Parameterization and Game Theoretic Containment in Modern Enterprise Attack

Modern Security Operations Centers struggle with delayed manual incident response, enabling adversaries to advance through the Cyber Kill Chain during early stage reconnaissance. While classical game theoretic defense models optimize strategic resource allocation, they rely on static utility...

DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning

Decentralized Federated Learning DFL eliminates the central aggregation server, reducing the single point of observation that traditional defenses against attacks rely on. As a result, peer-to-peer networks become exposed to malicious updates containing backdoors or semantic poisoning, since such...

Apple Security Advisory 09-28-2026-3

Apple Security Advisory 09-28-2026-3 - macOS Sequoia 15.8.1 addresses out of bounds write and arbitrary code execution vulnerabilities...

Know the Normal, Track the Attack: Context-Grounded and Stateful LLM Investigation over System Provenance

Provenance-based intrusion detection systems PIDSs identify suspicious activity in audit streams, but their outputs remain difficult to turn into coherent attack narratives. Direct LLM analyses of local anomalous subgraphs lack deployment-specific normal-behavior knowledge and validated attack...

Quantum Computing for Network Security Classification: Near-Term Classification and Long-Term Memory Efficiency

Quantum computing has already been explored in several network-security applications. However, how quantum computing may contribute to network-security classification in both the near term and the longer term has not been systematically discussed. This paper studies this question through two...

CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering

Indirect prompt injection makes an LLM agent treat untrusted retrieved text as instructions. We present CounterSteer, an inference-time defense that suppresses this behavior inside the model. Per model, a five-step recipe fits a residual-stream direction from paired episodes differing only in...

Cheap to Hypothesize, Costly to Verify: The Defense Surface of Agentic Vulnerability Discovery

Autonomous LLM agents turn vulnerability discovery into a repository-scale search: they generate many vulnerability hypotheses but can verify only a subset under a finite budget. We show that autonomous vulnerability discovery exhibits a hypothesis-verification asymmetry, where verifying a...

RAISE: Reinforcing Access Control Policy Synthesis in LLMs Via Symbolic Evaluation

Translating natural-language access-control requirements into policies requires careful reasoning about permissions, constraints, and exceptions, and even frontier LLMs often produce policies that violate the intended authorization semantics. We construct CedarInstruct, to our knowledge the first...

Internet and Enterprise Strategy Revisited: From Digital Connectivity to AI-Enabled Enterprises, 1996 - 2026

This paper revisits the 1996 article Internet and Enterprise Strategy and assesses how its propositions were confirmed, transformed, or contradicted as digital connectivity evolved into an AI-enabled enterprise environment by 2026. The reassessment combines historical interpretation with a...

Climbing the Hill: Prompt Injection Red-Teaming against Frontier Models with Curriculum Reinforcement Learning

Prompt injection is a leading security risk for LLMs and LLM-based applications such as agents. State-of-the-art red-teaming methods for prompt injection leverage reinforcement learning RL to train an attacker LLM to generate effective injected prompts. However, when targeting frontier LLMs such ...

No Free Efficiency: Revisiting the Trade-Off between Training Efficiency and Model Vulnerability

Training efficiency has become the central driver of recent progress in foundation models. To overcome the massive computational and data requirements of large-scale training, researchers increasingly adopt strategies such as selective data sampling, efficient pre-training, and simplified...

When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents

LLM agents increasingly rely on user approval to authorize security-sensitive actions at runtime. Such approvals are granted within a specific task and execution context. In long-lived agents, authorization decisions may need to persist across tasks or sessions. We find that this continuity can...

TrackFlood: Relocating Latency Attacks from NMS-Free Detectors to Real-Time Trackers

We consider latency attacks on object detectors, where the attacker's goal is not to corrupt a prediction but to make the system fail to respond in time, targeting real-time applications such as autonomous driving. Modern object detectors eliminate Non-Maximum Suppression NMS through one-to-one...

Application Agnostic EM Side-Channel Emanations of the FPGA Clock Distribution Network

Electromagnetic side channels have been extensively utilized in non-invasive attacks or analyses to extract critical information from deployed systems. Most of the attacks or analyses are typically executed on cryptographic algorithms under the assumption that the underlying implementation remain...

Logpresso Log4j2 Scanner 3.0.2

Logpresso Log4j2 Scanner version 3.0.2 scans archives recursively for vulnerable Log4j components, including CVE-2021-44228, and can optionally back up and remove vulnerable classes...

Where the Numbers Come From: Auditing Evaluation in Provenance-Based Intrusion Detection

Reproducing a provenance-based intrusion detector's score does not establish what that score says about its emitted alarms or the information its encoder uses. We audit nine released implementations, execute four detectors using their own code, and isolate three measurement effects. First, a...

Evaluating System One Models for Agent Security Decisions: Reliability, Calibration, and Selective Automation

Model-based judges support agent security by detecting prompt injections, assessing interaction risks, and screening harmful requests. System One models expose typed decisions with probabilities that software can use to allow, block, or escalate inputs, but whether these probabilities support...

Xalgorix Autonomous AI Pentesting Agent 4.6.107

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

S-ALSA: Co-Design of Adiabatic Logic-Based Sensing and Balanced Bit-Cells for Secure and Energy-Efficient MRAM

Magnetoresistive Random Access Memory MRAM technologies such as Spin-Transfer Torque STT-MRAM and Spin-Orbit Torque assisted SOT-STT-MRAM offer nonvolatility and low leakage, making them attractive for IoT systems. However, conventional MRAM read circuits face two fundamental challenges: high...

Information Blackhole: Exploring Backdoor Mechanism in 3D Point Cloud Reconstruction

Point cloud autoencoders are fundamental components for 3D world representation and support many safety-critical downstream applications. Existing studies have extensively investigated backdoor attacks on point cloud classification, whereas backdoor attacks against point cloud autoencoders remain...

A2A-ForensicTrace: Offline Verification of Tamper-Evident A2A Runtime Evidence

Security-relevant Agent2Agent A2A executions can cross organizational boundaries, leaving investigators without live access to all participating systems. Offline investigation involves checking preserved records and their cross-record relationships for consistency. This paper presents...

DeMark: A Query-Free Black-Box Attack for Quality-Preserving Audio Watermark Removal

Audio watermarking protects digital speech by embedding imperceptible signals for ownership verification and misuse tracing. However, the security of learning-based watermarking remains insufficiently understood under realistic adversarial removal, where attackers cannot access or query the...

Can Prompt Anonymity Protect Your Identity from LLM Providers?

User conversations with large language models LLMs often contain highly sensitive personal information that can be exploited by LLM providers to create detailed user dossiers, enable targeted advertising, and train more powerful models. To protect user privacy, anonymizing LLM proxies have emerge...

PerceptFence: Content-Mediation Architecture and Deterministic Coverage for Screen-Share AI Assistants

Live screen-share AI assistants observe raw screen and speech streams, but users have little runtime control over what an assistant may observe, retain, or disclose. Prompt-level privacy settings are insufficient because sensitive content enters through the capture stream. We present PerceptFence...

The Cost of Stability: Deanonymizing Onion Services Long-Lived Introduction Circuits

Tor is a widely used anonymity network that provides network privacy by routing client communications through a sequence of relays to their destinations. An adversary observing a single Tor relay cannot readily link clients to their destinations, as doing so requires identifying the other relays...

API Secrets Should Never Become Tokens in the LLM's Vocabulary

Tool-using large language model LLM agents turn credential hygiene from a storage problem into an execution-security problem. A key pasted into a prompt, or embedded in a system prompt or tool configuration, crosses from an authentication boundary into a data pipeline, where it may persist in...

Dual Lattice Attacks for Bounded Distance Decoding, Revisited

Analyses of dual lattice attacks have often assumed that the individual scores associated with short dual vectors are mutually independent. Laarhoven-Walter used this heuristic to derive explicit trade-offs between the target radius and query time for bounded distance decoding BDD with...

Erlang/OTP 27.3.2 SSH Remote Code Execution

Erlang/OTP SSH server versions prior to patched releases 27.3.3, 26.2.5.11, and 25.3.2.20 contain an SSH protocol message-handling flaw that can allow unauthenticated remote code execution. This submission provides vulnerability background and patch-analysis notes...

HESP: Separating What to Probe from When to Stop in Local LLM Alert-Triage Agents

Security operations centers receive far more alerts than analysts can investigate, and organizations that cannot send their telemetry to hosted models must automate triage with small open-weight LLMs on their own hardware. Current LLM agents leave the investigation procedure to the model, and sma...

Backward-Compatible Tag-Based PHY Authentication for Secure WLAN Sensing

Driven by ongoing standardization efforts, Wi-Fi sensing has recently emerged as a promising functionality within wireless local area networks WLANs. However, due to the use of standard null-data packets NDPs to estimate the channel, conventional Wi-Fi sensing systems are susceptible to spoofing...

Estimation Is Not Enough: Carpet-Bombing Detection Via Per-Packet Uniformity Testing

Carpet-bombing attacks spread traffic uniformly across one or more destination IP prefixes, keeping every host in the prefix below alarm thresholds while exhausting prefix-level defenses. Existing carpet-bombing detectors run at seconds-to-minutes latency, too slow to respond within the attack...

Weird Machine Compositors: Exploiting AI Orchestration at the Expression Layer

Orchestration platforms secure user-provided expressions through enumerate and block sandboxing: AST rewriting, runtime property blocklists, template sandbox environments. We demonstrate that these sandboxes are weird machines whose instruction set is the underlying language specification, and th...

SecProbe: Adaptive Evaluation of Coding Agents on Cybersecurity Vulnerabilities

Whitepaper called SecProbe: Adaptive Evaluation Of Coding Agents On Cybersecurity Vulnerabilities...

Edgeless Systems Contrast Remote Attestation Relay

Edgeless Systems Contrast versions before 1.16.0 are susceptible to remote attestation relay attacks. The tool audits manifests for hardware allowlists, detects versions, and probes Coordinator endpoints...

ORBIT: A Framework for Multi-Agent Safety and Security Evaluations

Multi-agent LLM systems are increasingly deployed for complex, long-horizon tasks or emerge as a natural consequence of agents interacting in the wild. Yet they give rise to significant safety and security risks: the flexible protocols that enable task generalization also expose novel threats, fr...

Xalgorix Autonomous AI Pentesting Agent 4.6.99

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

Karma Pro 0.11

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

Joern 4.0.639

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Leaky Students: Membership Inference against On-Policy Distillation

On-policy distillation OPD trains a student to match a teacher's next-token distributions on student-generated trajectories. However, privileged information supplied to the teacher for OPD training may contain sensitive data. Whether the student leaks private information about the records supplie...