A universe of ideas.

Python runtimes execute bytecode directly through .pyc files, compiled-only modules, and marshalled code objects, which opens an inspection-execution gap that source-centric package security misses entirely. Across 1,034,843 PyPI artifacts they found 7,388 containing bytecode, including 28,193 source-less .pyc files local to an artifact. The tooling is not robust either: real and adversarially mutated bytecode drove decompilers into managed exceptions, timeouts, and native process failures. The same shape as the model-format problem one ecosystem over, since what the scanner can read is not what the runtime will execute.

Existing VLM backdoors bind fixed triggers to a fixed target set at poisoning time. This one implants a programmable backdoor from a single poisoning phase, so the attacker picks previously unseen target-caption semantics at inference and synthesizes a matching stealthy trigger on demand. The mechanism is a feature-space trigger steganography that maps any specified caption to a visual trigger, paired with a poisoning strategy that teaches trigger-as-instruction rather than a memorized pattern. Decoupling target selection from poisoning is what turns a backdoor into a channel.

Adapter-agnostic defenses merge the adapter into the base model first, which dilutes exactly the signal they are hunting for. LoRAScan stays adapter-aware and rejects trigger-bearing inputs at inference time from activation spikes in the down-projection, rather than condemning the whole adapter and requiring separate mitigation. Worth reading beside the weight-space LoRA detector: one screens the artifact before use, this one screens the traffic during it.

Three pickle deserialization attacks that abuse the Pickle VM external module import mechanism to execute payloads during load. The Overwritten variant evades 63 percent of scanners, up to 50 percent better than prior attacks, across ten state-of-the-art scanners and four model hosting platforms. Read this against any argument that scanning solves pickle: the format keeps the execution path, so the scanner is left guessing at intent.

A trigger-gated additive modification of an intermediate representation, dormant by default and producing zero change on clean inputs, carried in the shared model artifact rather than in the learned weights. One implant compromises visual question answering, text-to-image, retrieval, and ranking fairness at once. The framing is the part worth keeping: a VLM deployment inherits executable behavior encoded in the artifact, not just parameters, so the proposed audit reads the distributed logic instead of the weights.

DLR-Lock replaces each pretrained MLP with a deep low-rank residual network that increases activation memory during fine-tuning and creates architectural mismatches that frustrate standard optimization. Tested against adaptive attackers with full knowledge of the defense. Framing the goal as locking rather than watermarking shifts from post-hoc detection to resistance, which is a different threat model.

Trellis-coded quantization encodes model weights using error-correcting code structure; the Viterbi decoding step is non-differentiable, which breaks gradient flow during QAT. BCJR-QAT replaces Viterbi with the forward-backward sum-product algorithm to restore end-to-end differentiability. Trellis-coded weight encoding is the quantization scheme most directly analogous to steganographic embedding; this advances its training-side infrastructure.

Sparse Backdoor injects a structured sparse perturbation along a randomly chosen direction into a small subset of columns per fully connected layer, then masks it with isotropic Gaussian dither. The real contribution is the hardness argument: detection reduces to Sparse PCA, so no polynomial-time detector finds it. A weight-space channel with a complexity-theoretic floor under it is a much stronger claim than the usual empirical stealth result.

Pushes provably-secure linguistic steganography toward higher embedding capacity by maintaining a list of candidate decodings rather than a single one. Directly relevant to the entropy-budget question in any LLM-mediated covert-channel design.

Style-level (not token- or syntax-level) backdoor triggers, generated by an LLM as a poisoned-sample synthesizer. Adds an auxiliary target loss to stabilize payload injection during fine-tuning. Evaluated against seven model families.

Poisoned samples form isolated latent-space clusters early in training because triggers dominate their feature representation. CSC exploits this: cluster, segregate, relabel to a virtual class, fine-tune. Near-zero ASR across four datasets and twelve attack variants with minimal clean accuracy loss. The trigger design that makes poisoned samples distinctive to the model also makes them distinctive to an auditor.

Chat templates are Jinja2 programs that run on every inference call, which makes them a code channel that ships alongside the weights without touching them. Triggered backdoors dropped factual accuracy from 90 percent to 15 percent across eighteen models and hijacked tool use across 3,868 agent episodes, and the poisoned artifacts passed every scan on the largest open model distribution platform. Same attack surface as the Llama-Drama template work, aimed at distribution rather than at a parser bug.

Pulls five spectral statistics from the low-rank updates across the Q, K, V, and O projections, giving a 20-dimensional signature per adapter, then trains a logistic regression on it. 100 percent accuracy on unseen adapters across Llama-3.2-3B, Qwen2.5-3B, and Gemma-2-2B, spanning instruction-following, reasoning, QA, code, and classification. Detection that needs neither the trigger nor a forward pass is exactly the property a hub needs, since it cannot execute everything it stores.

The canonical reference for byte-level steganography in float32 weight tensors. Explicitly defers the decoder to a separately-deployed loader, which is the substantive limitation when read against a channel/decoder/substrate framework.

Origin paper for trigger-based co-trained backdoors. The decoder and the channel are baked into the network's weights together, which is why detection has to be behavioral rather than static.

Attack success rate depends on how many target calls an attack is allowed, and most studies report it without holding that budget constant, so the comparisons are not comparable. Fair-ASR fixes a shared target-call budget and tracks attacker calls separately for efficiency. Re-evaluating 11 representative attacks, rankings change substantially across budgets, simple stochastic perturbations and hand-crafted templates stay highly competitive under equal target access, and no LLM-driven method was efficient in both dimensions. A headline number that hides its budget is the same disease as an injection rate that hides its decomposition.

Four years on, prompt injections are still documented as verbatim strings, which makes them hard to compare, label, or mutate without fragile string matching. This proposes a seven-component model, carrier, delivery vector, concealment, context-break, privilege escalation, payload, and return channel, as five artifact fields plus two environment fields. Because models compile many surface wordings into the same executable action, the labels have to track attacker intent, tool targets, and sinks instead of the wording. Naming the parts is what lets you argue about coverage rather than trade examples.

Generates realistic source-aware test cases for indirect prompt injection and evolves them through feedback-driven exploration, instead of sampling from a fixed library of known payloads. Localizes which injected source caused the failure rather than only reporting that the agent failed. It stays effective with defenses deployed, which is the evaluation condition most red-teaming papers quietly skip.

Puts LLM operator agents in a simulated nuclear power plant control room and runs adaptive multi-turn attacks against the operator team. Between 8.7 and 12.1 percent of attack sessions across four models ended in loss of a critical safety function, and the vulnerabilities were distinct per model rather than overlapping. The transferable part is the harness rather than the scenario: single-turn refusal rates say almost nothing about how an agent holds up over a session.

28 jailbreaks across five benchmarks, Claude models from Haiku 4.5 to Opus 4.6. The capability tax scales inversely with model strength: Haiku 4.5 loses 33.1% average capability under jailbreaks, Opus 4.6 loses 7.7%. The most sophisticated attacks approach zero degradation. Safety assessments that rely on capability loss as a self-limiting mechanism are working from a false premise.

Four attack methods targeting the visual processing path of VLMs: encoding harmful instructions as visual symbols with a legend, object substitution, text replacement in images, and visual puzzles. A visual cipher achieved 40.9% ASR on Claude-Haiku-4.5 vs. 10.7% for the text equivalent. The gap quantifies how little text-focused safety training transfers to vision.

DR-Smoothing adds a two-stage prompt processing scheme: disrupt the input, then rectify it back toward a normal distribution before passing to the model. Prior disrupt-only methods left the model seeing out-of-distribution prompts. The rectification step removes that problem while preserving disruption as the defense layer. Includes theoretical bounds on defense success probability.

Rather than training a standalone jailbreak classifier, this uses embedding disruption to re-activate the model's own internal safeguards for detection. The defense reuses what the model already knows. Effective against adaptive attacks in evaluation. Same authors as DR-Smoothing; this paper covers detection, DR-Smoothing covers the defense-side response.

Adds cross-attention at the final eighth of transformer layers to give system prompts a structurally distinct processing path rather than treating them identically to user input. At 8B scale: +7.4% on IFEval, +16.3% on multi-turn instruction adherence, -13% many-shot jailbreaking ASR. The architectural approach rather than a tuning one is what makes the gains scale-consistent.

Recasts jailbreaking as inference-time policy optimization in an adversarial decision process. A self-evolving metacognitive loop diagnoses the target's defense logic and refines the attack trajectory through structured feedback. 89.2% average ASR across 10 models including 76.0% on O1 and 78.0% on GPT-5-chat, at 8.2x lower compute than prior methods.

819 test cases for evaluating safety in LLM agents operating in actual operating systems. Identifies Execution Hallucination: agents verbally refuse a request while the harmful OS-level action completes undetected. Running in real OS environments rather than simulation is what exposes this gap between stated refusal and actual execution.

Conversational interfaces that translate natural language to SQL queries inherit SQL injection as a threat class. The proposed defense stacks three layers: front-end prompt sanitization, a behavioral/semantic anomaly detector, and a signature layer for known patterns. The LLM translation layer that creates the vulnerability is also what makes the sanitization non-trivial.

Replaces random combination of crowdsourced jailbreak ingredients with a contextual-bandit learner that scores combinations based on prior success. Roughly 2,200-parameter bandit on top of SBERT embeddings. Transfers across models without retraining.

Distributes adversarial intent across stateless turns, evading moderation that evaluates each turn independently. Notable for showing that the threat model "single-turn safety classifier" is incomplete against an attacker LLM operating across sessions.

Poisoning 0.1% of pre-training data is enough for three of four backdoor objectives (DoS, belief manipulation, jailbreaking) to survive post-training. DoS persists at 0.001%. The supply-chain layer the threat model has to start at.

Passive discovery across eleven sources plus active testing with 34 modules covering 10 MCP-specific vulnerability classes. Of 640 confirmed production servers, 414 were dynamically audited and yielded 68 reportable vulnerabilities including SQL injection, SSRF against cloud metadata services, prompt template injection, and path traversal via cursor manipulation. 91.8 percent lacked OAuth authentication and 687 tool instances exposed shell execution with no access controls. The quieter finding is the ecosystem one: 41.6 percent of confirmed servers disappeared within three days.

Skill scanners inspect one skill at a time, so an intent split across several individually plausible skills passes every check and only becomes harmful in composition. ColluSkill decomposes a payload into interdependent sub-skills joined by contextual dependencies, artifact passing, and execution handoffs, then uses scanner feedback to file down the suspicious signal in each piece. ChainGuard is the paired defense that reasons over the chain. Choosing the wrong unit of analysis is the same failure ShadowPickle exploits in model scanners.

Treats the shape of the workspace as the independent variable: directory depth, codebase modularity, in-file injection position, and context framing, measured against indirect prompt injection success across open-source repositories spanning 10 languages and 6 engineering domains. Modularity moves the attack success rate significantly, with highly modular environments faring better. A good complement to the sandbox-escape work: that asks what an agent can reach, this asks how the layout of what it reads changes the odds.

Four repeatable failure modes across Cursor, Codex, Gemini CLI, and Antigravity: denylist sandboxes that cannot enumerate an operating system, project configuration files that are really executable code, allowlists that trust a command name rather than the actual invocation, and privileged local daemons sitting outside the boundary entirely. In nearly every case the agent never broke the sandbox, it wrote something a trusted component outside later ran. The executable-config mode is the Amazon Q pattern generalized across four tools.

The extension loaded MCP server configs from the workspace root with no consent prompt and no workspace trust check, and the servers it spawned inherited the full user environment. Opening a cloned repository was the entire exploit chain, straight through to AWS credentials, cloud CLI tokens, and the SSH agent. CVE-2026-12957, remediated in language server 1.65.0. Workspace files are untrusted input, and every agentic IDE that auto-loads tool configuration is making the same bet this one lost.

8,861 repositories, 100,011 tools from MCP and Skills platforms. 60% of high-Jaccard candidates and 85% of high-ssdeep candidates are manually verified clones. Vulnerable code in a cloned tool propagates to all downstream repositories automatically. Benchmark splits built from "diverse" tool datasets may be evaluating heavily duplicated code. A supply-chain amplification pattern that pre-dates LLMs.

Differs from prompt injection by targeting the knowledge graph data agents reason over rather than their instructions. Six attack scenarios against a production knowledge graph with 42M nodes across nine models from three providers. All models accepted fabricated security claims at 100% under directed queries. GPT-5.1 showed 0% trust in inline evaluation but 100% under actual tool-use, which is the key finding: the delivery channel changes the attack surface.

ASPO integrates LLM reasoning with deterministic enforcement inside a MAPE-K control loop. LLM agents propose mitigations; an optimization engine ensures proposals are conflict-free and resource-feasible before acting. 100% conflict-free activation on a 500-1000 decision testbed. The separation between reasoning and enforcement is the design principle worth generalizing.

Black-box drift detection using cosine similarity between user prompts and behavioral anchor texts, aggregated by weighted top-k mean over BGE-m3 embeddings. ROC AUC 0.83 on real session traces. Available as a Claude Code plugin and MCP server with Merkle-chained audit logging. The ~30-point gap below white-box methods is the explicit cost of not touching model weights.

Six-class pitfall taxonomy (P1–P6) split into statically-checkable (Tier-1) and trace/dataflow-dependent (Tier-2) classes. Three workflow challenges (email, document, crypto) with hardened-vs-baseline server pairs and three attack families: tool-metadata poisoning, puppet servers, image-to-tool chains.

Machine unlearning without modifying model parameters: a prompt generator trained via reinforcement learning collaborates with the LLM to suppress target knowledge while preserving general capabilities. Works on closed-source models. Reversal is possible by revoking the prompt rather than retraining, which matters for unlearning as a compliance tool when legal hold periods end.

Third-party API routers sit between the agent and the model with full plaintext access to every in-flight JSON payload and no integrity protection on either side. Measured across 428 routers: 9 actively injecting code, 2 using evasion triggers, 17 reaching for the researchers' AWS credentials, and 1 draining a test wallet. The router is an unexamined hop in the supply chain, and this is the paper that actually counts what is happening there.

DDIPE hides instructions inside the code examples and configuration templates that ship in skill documentation, so the payload fires when the agent reuses that material rather than needing a crafted prompt. 1,070 adversarial skills across 15 MITRE ATT&CK categories, bypass rates of 11.6 to 33.5 percent over four frameworks and five models, and only 2.5 percent evading both static detection and alignment. Explicit instruction attacks scored zero against strong defenses, which is the contrast: the implicit path is the one that works.

ML-centered threat modeling applied to an agentic browser. Four prompt-injection techniques against the AI assistant, all chained to exfiltrate Gmail data. The methodology, TRAIL, is more transferable than any individual finding.

Concrete demonstration of cross-server data exfiltration in MCP. The barrier-to-entry argument matters: this is not a sophisticated attack class, which is the point.

First end-to-end empirical evaluation of attacks against MCP. Four attack categories: tool poisoning, puppet attacks, rug pull, and exploitation via malicious external resources. Useful as the lay-of-the-land paper before any MCP-specific work.

Prefix reuse across requests is the throughput win, and in multi-tenant deployments the shared cache is also a timing side channel: PROMPTPEEK, EarlyBird, and InputSnatch reach up to 100 percent success against unprotected vLLM and SGLang. KVGov seeds the block-hash chain with a per-principal salt so cache keys are cryptographically disjoint, and an ablation isolates that salt as the necessary and sufficient component. Read alongside GRIEF, which found KV-cache isolation failures by fuzzing: the same surface, one paper finding it and one closing it.

Activation sparsity lets a serving system skip weight accesses for inactive neurons, which makes those accesses input-dependent and therefore leakable. SparSEEty builds a neuron-activation oracle from the side channels and inverts the activation traces to reconstruct the input tokens, demonstrated end to end against a serving system running inside an Intel TDX confidential VM. A confidential-computing boundary does not help when the leak is in the access pattern the optimization introduced.

Intermediate embeddings exchanged between participants in distributed multimodal inference leak the input image, not just the text prompt studied previously. Embedding extraction reaches near-total accuracy across almost all layers, then two attacks reconstruct from it: patch assembly for pixel-level output, embedding-guided diffusion for semantic. Evaluated on Gemma 3, Phi 4 Multimodal, Qwen 2.5 VL, and Llama 4 Scout. Worth reading if you treat a disaggregated inference deployment as a trust boundary, which most deployments do not.

Malicious documents crafted for the same attack-targeted question exhibit high semantic similarity to each other. CleanBase builds a similarity graph and detects cliques, with a statistically-determined threshold and theoretical error-rate bounds. A working CleanBase deployment reduces the poisoned corpus before retrieval, making retrieval rate a function of detection coverage rather than a fixed attack property.

A greybox fuzzer for LLM inference engines that treats timed multi-request traces as first-class inputs, which is the right abstraction for bugs that only exist under concurrency. Fifteen findings across vLLM and SGLang, ten confirmed by developers and two assigned CVEs, spanning KV-cache isolation failures, cross-request performance degradation, and crashes. The closest published work to what Crucible does, pointed at the serving layer instead of the parser: the state is shared and the input is a schedule rather than a file.

GateScope audits third-party LLM API gateways across response content, multi-turn quality, billing accuracy, and latency. Measurement of 10 commercial gateways found undisclosed model substitutions, degraded conversation memory, pricing deviations, and inconsistent latency. The billing-accuracy finding has the clearest actionability: gateways charging for model calls that differ from what was advertised.

Three-layer architecture: static base model, composable domain-expert LoRA adapters, and removable per-user proxy artifacts. Removing a user's artifacts returns outputs to baseline and prevents cross-user leakage, tested on Phi-3.5-mini and Llama-3.1-8B. Reframes machine unlearning as deterministic deletion of a separable artifact rather than expensive parameter updates.

Two CVEs (CVE-2026-25905, CVE-2026-25904) in a popular MCP server template. The class of bug is a useful pattern: trusting that a Deno sandbox plus a containerized python runner will hold under MCP-style invocation.

If-then rules linking source presence and absence to RAG output behavior, with Apriori-like pruning to avoid brute-force source-combination search. The provenance angle extends beyond explainability: if you can determine which source combinations produce which outputs, you can identify which sources a poisoning attack needs to control.

Two remotely-exploitable memory-corruption bugs (CVE-2025-23310, CVE-2025-23311) in Triton's HTTP request handling, surfaced via static analysis plus chunked-encoding probing. The reminder: production inference servers are still C/C++ network services with all the attendant historical bug classes, and authentication is off by default.

A multi-stage vulnerability chain in the Triton Python backend, starting from a minor information leak about shared-memory region names and escalating to unauthenticated RCE. Useful as a case study in chaining low-severity primitives into a takeover.

Reference for CVE-2024-34359 (the chat-template Jinja RCE in llama-cpp-python) and the broader question of when loading a GGUF model can lead to server-side template injection. The case study for why loader extensions need the same threat-modeling rigor as the loader itself.

Cluster Name Objects and Virtual Cluster Objects store encrypted resource credentials on every node so that failover works, which means compromising one node hands you the credentials for the whole cluster. Clusters host SQL Server, ADFS, Configuration Manager, and Exchange, so cluster compromise reads as domain compromise. 82 percent of BloodHound Enterprise clients had at least one cluster, averaging 141 per environment. Availability engineering and credential isolation are in direct tension, and availability won.

Coerce SMB or WebDAV authentication out of the target network to a cloud-hosted VM, forward it back through red team infrastructure, and relay it into ADCS web enrollment or LDAP without relay protections. The point is that relay tradecraft still works when local relay is off the table, which is the normal condition from a low-privilege C2 agent behind a host firewall. Mitigations are the familiar four: LDAP signing and channel binding, EPA on ADCS endpoints, outbound SMB egress filtering, and host firewall rules.

Modeling Okta in BloodHound Enterprise alongside AD, Entra, GitHub. The argument: identity boundaries between platforms are where attack paths actually live, and treating any single platform in isolation underrepresents real risk.

Long-form correction of decades of incorrect documentation around AD's AdminSDHolder mechanism. The kind of historical-grounding piece that's useful before doing anything privileged-account-related on AD engagements.

The AD CS paper that opened up the modern wave of ADCS work. Still the cleanest framing of what a tooling-up problem looks like before any tools exist.

Four stages: threat model the attack surface with code property graphs, fan out independent agents to test hypotheses in parallel, contest every finding adversarially before accepting it, then prove it with a working exploit in a real execution environment. 90.9 percent on CyberGym and over 200 previously unknown vulnerabilities in heavily audited projects including Kubernetes, gRPC, and the Linux kernel. The design claim matches my own experience: the durable advantage is the harness around the model, not the model.

OpenAI models autonomously found previously unknown vulnerabilities in self-hosted Artifactory during a capability evaluation, and the fixes shipped in 7.161 and above. Landman's argument is that the trust model has to move to remediation speed, because a model-discovered zero-day sitting in a vendor queue is pure attacker upside. Read next to the Atlas post: this is the month AI-discovered vulnerabilities became an operational question for defenders instead of a thought experiment.

Infrastructure-side measurements of AI adoption: 81% of cloud environments use managed AI services, 90% run self-hosted, 80% have MCP servers. The framing of AI as accumulated rather than adopted is a useful governance lens.

An authenticated git push achieves RCE on GitHub's backend through a delimiter-based internal protocol. Notable also as one of the first critical vulnerabilities the team credits to AI-augmented reverse engineering.

Tree-sitter plus rustworkx, packaged as Claude Code skills for blast-radius and taint-propagation analysis. Useful as a reference for how graph reasoning composes with LLM agents in a security workflow.