Hao Li, Tongyan Hu, Weidi Luo et al.
Agent systems are shifting from task-scoped tool-use agents to persistent, personalized assistants such as OpenClaw.Agent systems are shifting from task-scoped tool-use agents to persistent, personalized assistants such as OpenClaw. These claw-style agents maintain configuration files (e.g., AGENTS.md), long-term memory, and reusable skills.
Mengxiao Wang, Nitesh Saxena
Large language model (LLM) agents now trade real capital using news as evidence, yet they cannot reliably tell fabricated headlines from real news.Large language model (LLM) agents now trade real capital using news as evidence, yet they cannot reliably tell fabricated headlines from real news.
Cheng Jin, Zhongtian Ma, Xiao Wang et al.
Large language models acquire broad knowledge from web-scale corpora during pretraining, including knowledge that could be hazardous if misused.Large language models acquire broad knowledge from web-scale corpora during pretraining, including knowledge that could be hazardous if misused.
Eliron Rahimi, Margarita Osadchy, Orr Dunkelman
Biometric authentication systems increasingly use privacy-preserving mechanisms to protect sensitive templates.Biometric authentication systems increasingly use privacy-preserving mechanisms to protect sensitive templates. However, the authentication interface itself may still leak information that enables reconstruction attacks.
Ruqiya Bin Safi
Jailbreak papers report an attack success rate, the share of responses that deliver the harmful request, and read it as a property of the target model.Jailbreak papers report an attack success rate, the share of responses that deliver the harmful request, and read it as a property of the target model.
Wonjun Lee, Vaidehi Patil, Zaid Khan et al.
Recent work shows that attackers can implant dormant malicious behaviors that remain hidden at release but emerge after benign fine-tuning.Recent work shows that attackers can implant dormant malicious behaviors that remain hidden at release but emerge after benign fine-tuning.
Hasan Demirkiran, Jens Ernstberger
Step-level guards for tool-using agents are evaluated on tidy JSON tool calls, but deployed coding agents act through execute_bash and execute_code tools whose payloads…Step-level guards for tool-using agents are evaluated on tidy JSON tool calls, but deployed coding agents act through execute_bash and execute_code tools whose payloads are strings.
John Kitaoka, Thao Amelia Pham, Carlos Rafael Giudice et al.
AI agents are growing more capable and persistent, and are being deployed in ever larger numbers. As more start collaborating, AI control measures must remain effective…AI agents are growing more capable and persistent, and are being deployed in ever larger numbers. As more start collaborating, AI control measures must remain effective when they covertly collude on a harmful objective.
Zhouyuan Ma, Yutao Wu, Hanxun Huang et al.
Red teaming must continually adapt as frontier LLM safeguards evolve, yet existing approaches largely search for adversarial prompts or optimize within fixed attack…Red teaming must continually adapt as frontier LLM safeguards evolve, yet existing approaches largely search for adversarial prompts or optimize within fixed attack procedures.
Xiao Yang, Jinchang Hou, Jiawei Chen et al.
Coding agents are increasingly capable with autonomy, which exposes them to repository-level poisoning.Coding agents are increasingly capable with autonomy, which exposes them to repository-level poisoning. Existing red-teaming studies remain restricted to manual selection for malicious payload locations and fixed disguise…
L. Zhu, Y. Jung, S. Szyller
Modern large language model (LLM) systems reuse key-value (KV) caches to accelerate inference. Recent work has shown that reusing KV caches from reasoning traces can also…Modern large language model (LLM) systems reuse key-value (KV) caches to accelerate inference. Recent work has shown that reusing KV caches from reasoning traces can also improve task performance, similar to retrieval-augmented…
Researchers modified an open-weight artificial-intelligence model to secretly transmit hidden data from an isolated container whenever it had access to a command-line…Researchers modified an open-weight artificial-intelligence model to secretly transmit hidden data from an isolated container whenever it had access to a command-line tool.
Wei-Liang Liu, Cheng-Yen Tsai
Model signing authenticates the full-precision weights W an LLM is released with, yet users run a quantized artifact Q whose producing transformation is not uniquely…Model signing authenticates the full-precision weights W an LLM is released with, yet users run a quantized artifact Q whose producing transformation is not uniquely determined under current disclosure.
Yuke Wang, Benlei Cui, Shen Pang et al.
Multimodal agents increasingly rely on visual interfaces to perceive state and select actions, creating an attack surface not captured by text-only safety evaluations.Multimodal agents increasingly rely on visual interfaces to perceive state and select actions, creating an attack surface not captured by text-only safety evaluations.
Ratnesh Pandey, Japneet Singh, Harsh Akshit et al.
Agent skills are Markdown documents that a tool-using agent reads as instructions and then acts on with the privileges of the session that loaded them.Agent skills are Markdown documents that a tool-using agent reads as instructions and then acts on with the privileges of the session that loaded them.
Inderjeet Singh
Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward.Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize this limitation for embodied and tool-use AI.
Min-Young Yu, Tony Kim, Jang Won Choi
Tool-using LLM agents violate the policies they are deployed to enforce, often silently. Prior defenses hand-write rules, query an LLM verifier per action, or compile…Tool-using LLM agents violate the policies they are deployed to enforce, often silently. Prior defenses hand-write rules, query an LLM verifier per action, or compile policies through heavyweight formal machinery.
Paweł Batorski, Przemysław Spurek, Paul Swoboda
Multi-bit watermarking embeds a message, typically an account identifier, into LLM output so that harmful text can be traced to its origin.Multi-bit watermarking embeds a message, typically an account identifier, into LLM output so that harmful text can be traced to its origin. We show an attack technique that allows to alter the watermarking message.
Shaomin Chen, Xiaorui Gong
Language model APIs can expose token-specific biases while withholding logits and token probabilities. Existing bias-based extraction recovers relative logits, leaving a…Language model APIs can expose token-specific biases while withholding logits and token probabilities. Existing bias-based extraction recovers relative logits, leaving a common additive component undetermined in ideal arithmetic.
Mark Russinovich
Text wrapped in a trigger can be made behaviorally invisible to a language model: omitted from summaries and quotations, ignored in question answering, and left unflagged…Text wrapped in a trigger can be made behaviorally invisible to a language model: omitted from summaries and quotations, ignored in question answering, and left unflagged by downstream filtering.
Shiddarth Dey Tusar, Zawad Yalmie Sazid
Federated learning (FL) lets distributed intrusion-detection systems (IDS) train on private traffic, but exposes the global model to poisoning and backdoor attacks under…Federated learning (FL) lets distributed intrusion-detection systems (IDS) train on private traffic, but exposes the global model to poisoning and backdoor attacks under non-IID client data.
Tianyi Wu, Chao Ge, Peng Chen et al.
AI coding agents now write much of the code that ships, yet whether that code is secure remains unclear.AI coding agents now write much of the code that ships, yet whether that code is secure remains unclear. We introduce the Last Secure Code Benchmark, a comprehensive evaluation of secure code generation by coding agents.
Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith et al.
Large language models (LLMs) are increasingly deployed as agents that interact with external software through tools, with an orchestration layer translating model outputs…Large language models (LLMs) are increasingly deployed as agents that interact with external software through tools, with an orchestration layer translating model outputs into structured tool invocations.
Ziyi Yang, Adel Bibi, Guohao Li et al.
Professional agents increasingly work through command-line interfaces and multiple tools over shared workspaces containing files, messages, and business applications.Professional agents increasingly work through command-line interfaces and multiple tools over shared workspaces containing files, messages, and business applications.
Snigdha Chandan Khilar
Model providers now face distillation campaigns run through thousands of accounts, each of which looks like an ordinary user.Model providers now face distillation campaigns run through thousands of accounts, each of which looks like an ordinary user. When network and payment metadata cannot link those accounts, the only evidence left is what they ask.
Arnab Dey, Mohammad Mahfuzul Islam
Some backdoor attacks never touch an image. FLIP only changes labels: on CIFAR-10, flipping 3% of them makes a ResNet-32 send 99.7% of triggered source-class images to…Some backdoor attacks never touch an image. FLIP only changes labels: on CIFAR-10, flipping 3% of them makes a ResNet-32 send 99.7% of triggered source-class images to the attacker's class.
The Anh Nguyen, Triet Huynh Minh Le, M. Ali Babar
The rapid integration of Artificial Intelligence (AI) models has established a complex supply chain, but many of these shared artifacts harbor severe vulnerabilities such…The rapid integration of Artificial Intelligence (AI) models has established a complex supply chain, but many of these shared artifacts harbor severe vulnerabilities such as insecure serialization and architectural backdoors.
Eliott Quéré, Li-Chung Chiang, Carina Fiedler et al.
Software-based microarchitectural attacks have mainly exploited timing differences to infer information from DRAM.Software-based microarchitectural attacks have mainly exploited timing differences to infer information from DRAM. However, defenses and optimizations can prevent timing-based approaches from resolving precise microarchitectural…
Jie Liao, Simeng Qin, Wenqi Ren et al.
Agent skills combine instructions with executable resources, giving third-party packages access to an agent's runtime.Agent skills combine instructions with executable resources, giving third-party packages access to an agent's runtime. Existing skill scanners inspect documentation and visible source, but Python may execute a bundled bytecode…
Jingnan Zheng, Dongcheng Zhang, Yi Zhang et al.
Recursive self-improvement, the participation of AI systems in improving their own capabilities, is beginning to move from theoretical prospect to practice, posing both…Recursive self-improvement, the participation of AI systems in improving their own capabilities, is beginning to move from theoretical prospect to practice, posing both challenges and opportunities for safety alignment.
Qi Liu, Geng Hong, Xinyang Zhang et al.
As more users ask AI systems for information, AI-search platforms are becoming a common gateway to web information.As more users ask AI systems for information, AI-search platforms are becoming a common gateway to web information. Unlike traditional search, which maps keywords to ranked pages, AI search retrieves pages, filters sources…
The mathematical proofs establish subexponential key recovery for problem families tied to all seven NIST third-round lattice candidates.The mathematical proofs establish subexponential key recovery for problem families tied to all seven NIST third-round lattice candidates. These candidate schemes include Kyber and Dilithium, alongside FrodoKEM, SABER, NTRU LPRime…
Zeyu Ye, Yanchun Li, Sibei He et al.
Image-generation models can now produce text-rich, natural-looking visual artifacts that are hard to distinguish from real-world evidence, such as news reports and…Image-generation models can now produce text-rich, natural-looking visual artifacts that are hard to distinguish from real-world evidence, such as news reports and textbook pages.
William Hackett, Peter Garraghan
AI systems increasingly rely on Large Language Models (LLMs) as core reasoning engines, making them targets for prompt injection and jailbreaks.AI systems increasingly rely on Large Language Models (LLMs) as core reasoning engines, making them targets for prompt injection and jailbreaks.
Hamed Khosravi, Xiaoming Huo
Public leaderboards for AI models are read continuously, and attackers can see every published standing.Public leaderboards for AI models are read continuously, and attackers can see every published standing. Vote rigging, selective disclosure of private variants, and benchmark contamination can each move a ranking.
Dang K Le, Wenxuan Shi, Xinyu Xing
Large language models (LLMs) have shown strong potential for automated vulnerability patching, but current benchmarks can substantially distort reported performance.Large language models (LLMs) have shown strong potential for automated vulnerability patching, but current benchmarks can substantially distort reported performance.
Teng-Ruei Chen
LLM routers pick a cheap or expensive model per request by its content, and many gateways and some cloud platforms can log that choice with content logging off.LLM routers pick a cheap or expensive model per request by its content, and many gateways and some cloud platforms can log that choice with content logging off.
Shuailong Wang, Xinyu Lyu, Shengming Yuan et al.
Token-Pruning accelerates Vision-Language Models by removing redundant visual tokens, yet its safety implications remain underexplored.Token-Pruning accelerates Vision-Language Models by removing redundant visual tokens, yet its safety implications remain underexplored.
Wanjing Han, Levi Taiji Li, Mu Zhang et al.
Modern web agents built on large vision-language models process webpages, select relevant UI elements, and translate model outputs into browser actions.Modern web agents built on large vision-language models process webpages, select relevant UI elements, and translate model outputs into browser actions.
David Dobre, Leo Schwinn, Gauthier Gidel et al.
Modern language model systems operate autonomously over increasingly long contexts containing untrusted text and images.Modern language model systems operate autonomously over increasingly long contexts containing untrusted text and images. Can an adversarial input continue to steer a model even after that input is removed from its context?