Search: “revocation”

Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems

An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.

Researchers tested five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, tracking whether revoked facts are returned and acted upon. No system enforces revocation by default: revoked records are returned whenever the revocation label is visible to the retrieval layer, outrank their replacements, and lead agents to unsafe actions. The authors propose a backend-agnostic guard that sits between the agent and any memory store and withholds revoked or conflicting records at retrieval time.

arXiv cs.CR·Sep 8, 05:03 UTC · 8d agoAI safety & security

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.

The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.

arXiv cs.CR·Sep 8, 00:05 UTC · 8d agoResearch

Re: Retrospective by 'gpg.fail' authors

oss-security follow-up to a gpg.fail authors' retrospective argues that GnuPG's unmaintained, forgotten code is a security liability and should be deleted.

On the oss-security mailing list, Soatok Dreamseeker responds to a retrospective published by the gpg.fail authors, asking why unmaintained code is retained and stating that forgotten, unmaintained code is a liability and effectively unmaintained by definition. The visible reply addresses Werner Koch and concerns GnuPG code maintenance. No specific CVE, flaw, or exploitation is described in this snippet.

oss-security·17:16 UTC · 2h agoVulnerability 8 sources1

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security·13:24 UTC · 6h agoResearch

This Key Will Self-Destruct: An Open Standard for Revocable API Keys

SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.

The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.

SecurityWeek·Sep 9, 10:00 UTC · 7d agoTools1

Apple Reference Image: A New Approach for Verified Photography

Apple introduces Reference Image, hardware-backed verifiable photography on iPhone 18 Pro using sensor signing and Private Cloud Compute to counter AI-generated fakes.

Apple announced Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that produces securely timestamped, verifiable photographs. The design splits into two phases: a secure digital negative created by cryptographically signing pixel data at the sensor immediately after capture (preventing injection or tampering), then developing that negative into a reference image. Private Cloud Compute handles processing without exposing image contents to anyone, including Apple, and fraudulent reference images can be revoked without revealing the photographer's identity. Apple positions the system as stronger than C2PA-based approaches, which sign metadata after capture, are vulnerable to editing-chain compromise, and can tie images to a device or individual.

Hacker News · security·02:07 UTC · 17h agoResearchHN 25↑ · 18 comments

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Researchers propose provenance-guided selective replay letting LLM agents forget revoked information without restarts, matching full reset behavior.

The paper formalizes execution-state unlearning for stateful LLM agents, requiring that agents behave as if a revoked memory record was never observed across transcripts, compressed memory, tool plans, and KV caches. It proves exact unlearning requires at least T-τ+1 recomputed transitions and that Provenance-Guided Selective Replay attains this bound via a provenance graph, KV cache cropping, and sanitized replay. In audits across three agent suites, nine baselines, and three model families, memory deletion left leakage unchanged, instruction-based forgetting collapsed under elicitation (Leak@probes = 1.00), and selective replay matched full resets at up to 9x fewer recomputed tokens.

arXiv cs.CR·Sep 4, 08:31 UTC · 12d agoAI safety & security1

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers·13:41 UTC · 6h agoPhishing & fraud in the wild

[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

A reflected cross-site scripting flaw in Bludit CMS 3.20.0 is documented with a public proof-of-concept exploit on Exploit-DB.

Exploit-DB published exploit ID 52678 targeting Bludit CMS 3.20.0, a web application affected by reflected cross-site scripting. The listing contains a proof-of-concept but includes no CVE identifier or evidence of active exploitation.

Exploit-DB·Sep 2, 00:00 UTC · 14d agoExploit / PoC

Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo

Mozilla revoked the Firefox and Thunderbird Linux RPM signing subkey after an unencrypted copy landed in a private repo; no unauthorized access found.

Mozilla revoked the OpenPGP signing subkey (fingerprint 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256) used for Firefox and Thunderbird Linux downloads after an unencrypted copy was committed to one of its private repositories, citing reason code 2, 'key material has been compromised.' Audit records showed no sign of unauthorized access, and a replacement subkey (827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) valid until August 5, 2028 was published. Users who verify signatures manually or install from Mozilla RPM packages may need to import the new key and remove the old one. The rotation came roughly seven months ahead of Mozilla's usual two-year subkey cycle.

The Hacker News·Aug 11, 12:04 UTC · Aug 11, 2026Data breach

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker News·Sep 6, 08:34 UTC · 10d agoMalware in the wild

RightCrowd Pass unifies mobile, physical, and biometric credentials

RightCrowd launched Pass, a credentialing platform unifying mobile, physical, and biometric access credentials, cutting credential revocation from 12.2 minutes to under 60 seconds.

RightCrowd announced Pass, a solution that issues and manages mobile, physical, and biometric access credentials from a single platform instead of fragmented badge programs. Mobile credentials are provisioned through a web-based API and can be suspended or revoked individually or in groups in under 60 seconds, versus an average 12.2 minutes for handling a lost or damaged physical badge. Each mobile credential is tied to a device via two-factor authentication, works with HID, Wavelynx, and LEGIC infrastructure, and counts toward LEED and BREEAM sustainability credits. The product is available now to new and existing customers and can be added to current RightCrowd SmartAccess deployments.

Help Net Security·Aug 26, 00:00 UTC · 21d agoTools

Machine Unlearning as Private Retroactive Algorithms

A cs.CR paper defines private retroactive algorithms, showing machine unlearning is a data-maintenance problem and giving DP constructions for linear statistics, clustering, histograms.

The paper argues that machine unlearning's requirement to emulate retraining from scratch carries no meaningful privacy semantics against adversaries observing sequences of releases, recasting it as a data-maintenance question addressed by retroactive algorithms. It defines private retroactive algorithms, combining retroactivity with differential privacy under continual observation. Constructions achieve privacy and retroactivity at no asymptotic cost over privacy alone for linear statistics, clustering, and histograms, alongside impossibility results.

arXiv cs.CR·Sep 4, 16:32 UTC · 12d agoResearch

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

The Hacker News·Aug 4, 15:03 UTC · Aug 4, 2026Malware1

Schrödinger's backup: not actually recovered until you try to restore IT

The Register sponsored feature urges admins to verify backups through restore testing before an incident happens.

A sponsored feature from The Register argues that backups cannot be considered recovered until restore tests succeed. It promotes verification practices and vendor tooling for disaster-recovery readiness.

The Register · Security·Aug 27, 15:00 UTC · 20d agoIndustry

CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse

CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.

NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.

Cyber Security News·Sep 15, 17:04 UTC · 1d agoAdvisory1

[webapps] C-MOR 6.0104 - Directory Traversal

A directory traversal proof-of-concept for video surveillance software C-MOR version 6.0104 has been published on Exploit-DB.

Exploit-DB entry 52666 discloses a directory traversal vulnerability in C-MOR version 6.0104, a video surveillance platform. The issue is listed under web application vulnerabilities. No CVE identifier or exploitation evidence is included in the listing.

Exploit-DB·Aug 31, 00:00 UTC · 16d agoExploit / PoC

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.

Abnormal Security analyzed iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for a $10,000 base price with additional capability modules sold separately. Using a browser-in-the-middle relay behind a trycloudflare.com subdomain with valid TLS, it captures Google logins and uses the authenticated session to enroll an attacker-controlled passkey within six seconds of login. Because the passkey persists after password changes and session revocation, operators regain mailbox access even after victims reset credentials. The build examined targets Google, while the seller advertises versions for Microsoft, iCloud, and LinkedIn.

Security Affairs·Aug 24, 07:17 UTC · 23d agoPhishing & fraud1

Scalable Composition of Byzantine Agreements under Reorder Attacks

Researchers present the first adversary model combining party corruption with channel reordering attacks, establishing tight security thresholds for composed Byzantine agreement protocols.

The paper presents the first adversary model combining party corruption with adversarial channel attacks that reorder messages across multiple Byzantine agreement executions. It proves impossibility results for authenticated BA under parallel composition when n ≤ 3t or n ≤ 2c + 2t + 1, with matching possibility results when n > max{3t, 2c + 2t + 1}. The authors provide general black-box compilers plus erasure-correcting-code variants that achieve constant multiplicative communication overhead for long messages.

arXiv cs.CR·Sep 9, 02:35 UTC · 7d agoResearch

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.

Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.

Huntress·Sep 10, 04:00 UTC · 6d agoResearch

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Researchers introduce CONTINUITY, a framework of assume-guarantee contracts that preserves LLM agent security context across components, verified across 2,560 attack instances.

The paper identifies security-context discontinuity, where individually sound controls drop, widen, or reinterpret security context as actions cross component boundaries, and proposes CONTINUITY, a framework of assume-guarantee contracts using signed root grants, provenance commitments, role-bound transition receipts, and effect-bound execution permits. It formalizes end-to-end consequence integrity, requiring every external effect to be backed by a valid authorization witness linking principal, task, provenance, and policy state. A reference verifier and cross-layer fault-injection suite covering 32 fault classes showed the full configuration committed no harmful external effect across 2,560 parameterized attack instances while completing all 700 benign tasks and escalating all 200 ambiguous cases.

arXiv cs.CR·Sep 4, 15:26 UTC · 12d agoAI safety & security

BigBear phishing crew nets thousands of Microsoft 365 credentials

CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.

CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.

The Register · Security·Sep 8, 13:26 UTC · 8d agoPhishing & fraud in the wild1

Cascading Gradient Inversion via LT-Code Inspired Peeling in Federated Learning

New gradient inversion attacks tied to erasure-coding theory recover 94–100% of ImageNet batches, showing federated learning privacy leakage is underestimated.

The paper connects gradient inversion in federated learning to erasure-correcting code theory, constructing analytic attacks that exceed previously known recovery bounds. The attacks recover batches exactly, with every sample's label, from a single FedSGD round, and certify each recovery without ground-truth data. On eight image and tabular benchmarks, even a passive attacker observing an honestly trained network recovers 94–100% of ImageNet batches up to size 128, and more than 90% actively at batch sizes of several hundred. The authors conclude that federated learning's privacy leakage has been underestimated.

arXiv cs.CR·Sep 9, 03:17 UTC · 7d agoResearch

CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing

CISA red teams fully compromised two critical infrastructure orgs with similar tradecraft; one detected nothing, the other contained phishing within minutes.

CISA advisory AA26-237A, 'A Tale of Two SOCs,' describes two simultaneous red team assessments of a Government Services organization and a Water and Wastewater Systems organization, both compromised to the domain level. Organization A never detected the intrusion, enabled by default credentials, a misconfigured AD CS template (ESC1), cleartext credentials, non-expiring static AWS keys, and over-permissioned Entra ID applications. Organization B detected and isolated phishing within 2-20 minutes, though the red team still reached krbtgt via DCSync from cleartext SCCM credentials. CISA attributes the outcome gap to people and processes rather than the security tools themselves.

The Hacker News·Aug 26, 13:13 UTC · 21d agoAdvisory

When Intelligence Becomes Agency: A Theory of Governed, Proactive Agency for Symbiotic AI Systems

Researchers propose a formal framework for governed proactive AI agency, linking activation decisions to continuing authorization, accountability, and bounded delegation in symbiotic systems.

The paper defines the activation problem: persistent AI assistants must decide whether a situation warrants behavior, and whether to act, ask, monitor, defer, or deliberately refrain. It distinguishes autonomous from delegated agency and defines symbiotic agency as delegation under a standing, revocable mandate, coupled to the principal's situation with calibrated inference and bounded personalization. The framework links activation decisions to authorized perception, behavior selection, authority containment, traceable restraint, and constrained adaptation, and provides an agency classification method, evaluation framework, benchmark scenarios, and reference architecture for always-present assistants and embodied support systems.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 16:46 UTC · 9d agoAI safety & security

Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)

Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.

CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3, lets crafted HTTP POST requests execute arbitrary SQL against the backend PostgreSQL database. Horizon3 honeypots first saw exploitation on August 30, 2026 from IP 176.65.148.184, and dozens of additional source IPs have since joined with scanning payloads and second-stage malware that appears to be a cryptominer. The flaw was patched in Switchvox 8.4.0.2 on July 14, 2026; roughly 4,000 exposed instances exist, mostly in the United States, and exploitation is likely against most of them.

Help Net Security·Sep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-9586

How to secure edge AI in customer-owned environments

Microsoft outlines security architecture guidance for edge AI, urging runtime attestation, artifact provenance, and deterministic mediation of model actions.

Microsoft details how edge AI shifts trust responsibilities to customers operating their own infrastructure, where prompt injection, model tampering, and malicious firmware updates can occur alongside model weights, credentials, and physical-system access. The guidance recommends verifying runtimes with attestation, verifying AI artifacts with provenance, and constraining model actions through a deterministic mediator outside the model. It also covers new exposure surfaces from MCP, multi-agent systems, and computer-use agents running in disconnected or hostile edge environments.

Microsoft Security Blog·Sep 4, 19:10 UTC · 12d agoAI safety & security

One Symptom, Three Levers: A Critical Review of On-Policy Self-Distillation

A review paper frames on-policy self-distillation collapse as governed by three levers: token weighting, privileged information, and guidance decay.

The paper critically reviews On-Policy Self-Distillation (OPSD), where a language model trains on its own generations scored token-by-token by a teacher conditioned on privileged information such as reference solutions or environment feedback. It identifies collapse, the progressive narrowing of producible reasoning paths, as the dominant failure mode and analyzes it through three levers: signal weighting, the nature of privileged information, and teacher dynamics. The review is restricted to mathematical reasoning, reports no new experiments, and offers a shared vocabulary separating settled findings from disputed ones.

Hugging Face daily papers·Aug 25, 20:00 UTC · 21d agoAI research

What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree

Cohesity field CISO Joye Purser ranks KEV over EPSS over CVSS and urges 24-72 hour patching of exploited internet-facing systems.

In a Help Net Security interview, Cohesity Global Field CISO Joye Purser lays out a vulnerability prioritization framework that puts active exploitation (KEV) first, then exploit likelihood (EPSS), then technical severity (CVSS), adjusted for asset exposure, business criticality, and compensating controls. She endorses 24-72 hour remediation targets for critical exploited internet-facing vulnerabilities and describes the organizational tradeoffs and emergency procedures needed to hit them. The interview also covers honeypot failure modes when deception systems are over-connected or over-trusted, and budget guidance recommending OT/IT segmentation, phishing-resistant MFA, and tested recovery for a 400-person manufacturer.

Help Net Security·Aug 31, 00:00 UTC · 16d agoIndustry

Hiding Prompt Injection in Legal Filing

A judge banned a plaintiff from electronic court filings after hidden prompt-injection text was discovered planted in legal documents.

Bruce Schneier's blog discusses an incident in which hidden prompt-injection instructions were planted inside a legal filing, apparently targeting AI systems that might process court documents. Judge Walter Spader Jr. responded by banning the plaintiff from electronic filings, requiring all future submissions as printed hard copies. Commenters debate whether the tactic could affect future AI-based processing of court records and whether plain-text formats will regain favor.

Schneier on Security·Aug 31, 11:04 UTC · 16d agoAI safety & security in the wild

Sakana AI Launches Fugu Max and Fugu Ultra v2 for Cheaper, Stronger Multi-Agent Orchestration

Sakana AI released Fugu Max and Fugu Ultra v2, API-only orchestrator models that route tasks across model pools to cut costs and boost multi-step reasoning.

Sakana AI released Fugu Max and Fugu Ultra v2, two orchestrator models that route queries across a pool of third-party and open-weights models, including the NVIDIA Nemotron family. Fugu Max is priced at $2 per million input and $6 per million output tokens, 40-60% cheaper per output token than Sonnet 5, GPT 5.6 Terra, and Kimi K3, and reportedly wins 6 benchmarks including Terminal Bench 2.1 and GPQA Diamond. Fugu Ultra v2 targets complex multi-step reasoning, scoring 48.3 on Chartography and 74.3 on DeepSWE. Both are live through Sakana's OpenAI-compatible API only, with no open weights and no EU/EEA availability.

MarkTechPost·Sep 11, 06:34 UTC · 5d agoModel release

A Princeton Researcher Proposes Recurrent Looped Transformer (RLT) that Carries Decoder State across Every Token, Fixing 96 Blocks per Token with Unbounded Temporal Depth

Princeton researcher Yifan Zhang proposes Recurrent Looped Transformer, carrying full decoder state across every token for unbounded temporal depth.

Yifan Zhang's technical report defines the Recurrent Looped Transformer (RLT), pairing a causal encoder with a recurrent decoder whose final output and layerwise sliding-window attention cache carry into every subsequent token with no prompt-response boundary reset. The reference configuration ties 48 encoder and 48 decoder layers, executing 96 logical blocks per token while the state path grows to 48t blocks after t tokens at fixed per-token compute. The report details RL replay contracts that rebuild all states under current parameters and exact prefix snapshots for multi-turn serving, but explicitly reports no measured efficiency, reasoning quality, or scaling results.

MarkTechPost·Sep 13, 17:02 UTC · 3d agoAI research1

50,000 Stripe Secrets Leaked in Public Code

Over 50,000 Stripe merchant API keys leaked via public code and logs; 659 merchant accounts' data offered on trading forum.

Ransomnews researchers identified over 50,000 unique Stripe merchant API keys exposed in public GitHub repositories, GitHub Actions logs, and misconfigured web servers. A dataset on a data-trading forum dated August 18, 2026 contained live keys for 659 merchant accounts plus roughly 35 GB of customer and payment data. Researchers demonstrated a leaked key enabled accessing customer lists, creating fraudulent payment links, and making test charges within 17 hours. Stripe itself was not compromised; over 3,000 misconfigured web servers revealed Stripe-related strings, with about 12% containing working keys.

Security Affairs·Aug 19, 08:39 UTC · 28d agoData breach in the wild

CounterPersona: Append-Only Defense Against Unauthorized Persona Skill Distillation

CounterPersona appends targeted counter-persona evidence after data collection to block AI systems from distilling an individual's behavioral patterns into reusable skills.

CounterPersona defends against unauthorized persona skill distillation, where attackers extract recurring patterns from collected personal data to replicate an individual's behavior. Unlike perturbation-based defenses that require modifying data before collection, it works in an append-only setting where historical records cannot be altered or revoked. It constructs targeted counter-persona evidence, packs compatible behavioral states into compact realization units, and strengthens them via rationale-guided consistency rewriting. Experiments show strong effectiveness across lexical, semantic, and LLM-based measures, remaining robust across different distillers.

arXiv cs.CR·Sep 14, 06:19 UTC · 2d agoAI safety & security

BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft

CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.

The campaign proxies Microsoft sign-in pages to capture credentials and authenticated session cookies, enabling session replay into email, Teams, SharePoint, OneDrive, and connected SSO applications. CloudSEK's June 2026 discovery found 5,137 stolen records, 1,032 passwords, and 4,148 session cookies tied to 3,331 victim IPs, linked to operator 'General Boss' across 42 VPS nodes. The operation targeted IT services and managed service providers, used country-matched residential proxies, and involved at least five affiliates.

Cyber Security News·Sep 8, 08:33 UTC · 8d agoPhishing & fraud in the wild1

Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them

A Connecticut pro se litigant hid tiny white-font prompt injections in court filings directing AI to favor him; the judge caught it and sanctioned him.

Pro se plaintiff Matthew Elliott hid prompt injection instructions in 3-point white text within filings in his lawsuit against the New York Bariatric Group, instructing any AI model reviewing the document to produce output agreeing with the filing. The hidden text also included joke messages such as a SpongeBob Nosferatu link and notes like 'hi :) I hope you cant see me'. Court staff noticed unusual white space, and Judge Walter Spader Jr. issued a 14-page sanction decision noting the Connecticut court does not use AI to process documents but warning that hidden AI-directed messages threaten the integrity of filings. Elliott described the scheme as an 'audit' of court AI usage, and the judge cited a prior prompt injection incident in a Brazilian court as evidence the practice may spread.

404 Media·Aug 13, 17:57 UTC · Aug 13, 2026AI safety & security in the wild

A new open standard locks AI weights to approved hardware

OPAQUE releases Weight Custody Manifest, an open standard keeping AI model weights encrypted until receiving hardware cryptographically attests to builder-specified conditions.

OPAQUE, a confidential computing company, released the Weight Custody Manifest (WCM) standard as a developer-preview specification with a Python SDK and a public test suite of 91 cases. WCM keeps model weights encrypted until the receiving infrastructure proves via CPU/GPU attestation that it matches builder-signed conditions, and decryption access can be revoked later if conditions change. OPAQUE says it ran the attestation exchange on an NVIDIA H100 and on AMD and Intel confidential servers hosted on Azure and Google Cloud, with two independent SDK builds producing identical output across 5,948 files. The public quickstart only exercises protocol logic on synthetic evidence and skips GPU cryptographic verification, and the standard cannot distinguish an authorized key from one physically extracted from hardware.

Help Net Security·Sep 10, 04:10 UTC · 6d agoAI safety & security

ReCite: Agentic Reasoning for Faithful Citation

ReCite is an agentic citation framework using claim-level reasoning and verification, outperforming large generative models in strict citation accuracy.

ReCite is a decoupled agentic framework that orchestrates location perception, intent-aware query planning, and reflective verification for citation recommendation. Trained on synthesized reasoning trajectories, the agent verifies claim-evidence consistency and triggers self-correction loops when retrieved candidates lack logical support. Experiments show the lightweight framework outperforms state-of-the-art massive generative models in strict citation accuracy, addressing misattribution where cited papers are real but logically unsupportive.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:59 UTC · 8d agoAI research

Chinese telcos maintain deep US presence despite Salt Typhoon links, House committee says

The Record·Aug 5, 20:43 UTC · Aug 5, 2026Threat actor

RetroThinker: Enabling Retrospective Thinking in Speech LLMs

RetroThinker is a post-training framework letting the Moshi speech LLM self-correct reasoning mid-stream, adding 11% GSM8K accuracy at similar latency.

Researchers introduce RetroThinker, a multi-stage post-training framework that equips the Moshi speech LLM to verify and forward-correct chain-of-thought steps during streaming inference. It combines supervised fine-tuning on curated retrospective thinking data with length-based direct preference optimization (DPO). On GSM8K it achieves an 11% absolute accuracy gain over non-retrospective baselines at comparable latency.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:41 UTC · 6d agoAI research1