ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “systematicity”

21 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI research 9Research 5AI safety & security 4Exploit / PoC 1Malware 1Tools 1
SeverityAllcritical 0high 1medium 1low 0info 19

What Breaks Local Watermarks? A Robustness Benchmark for Local Invisible Image Watermarking

First systematic robustness benchmark of five local invisible image watermarking methods across 55 transformations finds all are vulnerable, with inpainting and geometric misalignment completely breaking payload…

The paper presents the first systematic robustness benchmark for local invisible image watermarks, covering 55 image transformations across signal distortions, coordinate alignment changes, indirect local edits, and direct watermark edits. It evaluates five methods: MaskWM, WAM, OmniGuard, TrustMark, and PixelSeal, all supporting localization natively or with minimal adaptation. Results show every method is vulnerable to some transformation; MaskWM offers the strongest payload recovery and localization but the lowest clean-image quality, and synchronization further improves its recovery under geometric transformations. Geometric misalignment and generative local edits such as inpainting and outpainting can completely impair payload recovery, while signal distortions are often tolerated.

arXiv cs.CR · 1d agoResearch

What Breaks Under Pruning in Smart Homes, and When? Evaluating LLM Degradation Across Architectures and Task Complexity

Pruning study across four LLM architectures finds dense models degrade sharply on smart-home tool calling while MoE models tolerate far more.

Researchers systematically study pruning-induced degradation in smart-home tool calling across four LLMs spanning dense Transformer, dense hybrid, and mixture-of-experts architectures, combining depth, width, hybrid, and expert pruning methods, and evaluate over 19,500 instances from three datasets after post-pruning supervised fine-tuning. Dense models show narrow safe pruning regions followed by sharp degradation, while MoE models tolerate substantially more pruning. Pruning degrades grounded specificity (operation, device, argument, value) before schema-level intent, and aggressive dense pruning can induce systematic over-refusal.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research

Verifiable Social Reasoning for LLM Assistants

Fuse, a multi-agent simulation with hidden motives, evaluates LLM social reasoning, revealing compounding difficulty from user mediation and bias sensitivity.

Fuse is a multi-agent simulation framework in which a target agent with a hidden motive interacts with other agents including one representing the user, who consults the evaluated assistant to infer the motive, providing verifiable ground truth by construction. Simulation faithfulness is validated through a human study with 24k annotations. Applied to 12 LLMs, it shows user mediation compounds social reasoning difficulty, models are systematically sensitive to biased user framing, models may need more details than humans, and longer conversations do not always improve performance. The framework and a 21k-example dataset are open-sourced.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research

When Agents See Differently: Exposing UI Desynchronization Threats in Mobile Agents

Researchers expose 'human-agent UI desynchronization' attacks where repackaged APKs invisibly mislead mobile AI agents into attacker-chosen actions.

The paper introduces human-agent UI desynchronization: agents ingest digital screenshots and accessibility metadata that reveal content human users cannot perceive due to occlusion and luminance-contrast limits. An automated framework embeds perturbations into repackaged APK clones that steer mobile agents toward attacker-designated actions without access to runtime user instructions or online adaptation. Evaluations across five mobile-agent frameworks and three backbone models on 546 tasks achieved average misleading rates of 77.9% and 66.9%. A questionnaire study with 186 participants found the visual perturbations difficult for humans to notice.

arXiv cs.CR · 1d agoAI safety & security

Atomic macOS (AMOS) Stealer Activity

Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.

Unit 42 analyzed an AMOS (Atomic macOS Stealer) infection from August 5, 2026, initiated via a page at getmacouscloud[.]com instructing users to paste a command into Terminal. The command fetched a Zsh script from ferncore13[.]com that delivered a Mach-O installer to /tmp/helper and supporting files under /Library/Application Support/.com.apple.accountsd/ and .com.apple.metadata.mds/. AMOS collected browser data, credentials, cryptocurrency wallets (Binance, TonKeeper), Telegram data, and FileGrabber content such as AWS and gcloud files, uploading it via HTTP POST to C2 server 161.35.146[.]120. AMOS has been advertised on Telegram since April 2024 and distributed via ClickFix campaigns, malicious ads, and cracked-software sites.

Palo Alto Unit 42 · 8h agoMalware in the wild

ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response

ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.

ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.

ANY.RUN · 11h agoTools

Building a Linux GPU Driver for the M4 Mac Mini in One Month

Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.

Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.

Hacker News · AI · 22h agoResearchHN 40↑ · 5 comments

Coupled Calibration and Learning: Mitigating Teacher Bias in LLM Distillation without Target-Domain Reward Feedback

CCL couples teacher calibration with student updates via token-level branching, provably removing teacher bias in LLM distillation.

The paper proposes Coupled Calibration and Learning (CCL), an LLM distillation algorithm that alternates teacher calibration using source-question reward feedback with student training on target questions under covariate shift. Each iteration calibrates the teacher on source feedback, trains the student on target questions, and lets the updated student inform subsequent calibration. The authors prove the student's expected KL divergence to the oracle student converges to zero at a polynomial rate, and show regularized direct matching error can remain bounded away from zero.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research

Evaluating Verified Autonomy in Quantum Engineering

Quantum-Harbor lab and QIQCBench (49 tasks) expose wide performance gaps across 17 frontier agentic systems in verified quantum engineering.

Researchers built Quantum-Harbor, a virtual laboratory providing a controlled execution environment where scientific AI agents interacting with quantum systems can have both actions and conclusions directly verified. QIQCBench contributes 49 expert-authored tasks spanning calibration and control, error correction and compilation, and sensing and networking. Across 17 frontier agentic systems, verified performance varied widely, exposing a substantial gap between demonstrated capability and reliable autonomous operation.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research1

RobResilience: Implementing and Evaluating a Resilience Framework for Cyber-Physical Embodied Systems

RobResilience implements a runtime resilience framework for robots in Webots/ROS2, evaluating tolerable disruption, degradation, and mitigation feasibility across eight attack scenarios.

The paper implements a formal resilience framework for embodied cyber-physical systems using a PR2 robot and ROS2 in a Webots simulation. At runtime it evaluates three predicates — tolerable disruption (δ), tolerable degradation (γ), and mitigation feasibility (μ) — over a compromised device set derived from IDS confidence scores, triggering mitigation strategies when resilience is lost. Eight attack scenarios systematically covering the full predicate state space confirm runtime behavior matches theoretical definitions. The work addresses 'graceful failure paralysis,' where autonomous systems cannot distinguish safe degraded states from catastrophic hazards during attacks.

arXiv cs.CR · 1d agoResearch

Exposed Vite servers are being probed for AWS and Azure credentials

F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.

F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.

CSO Online · 1d agoExploit / PoC in the wildCVE-2026-39364CVE-2025-30208CVE-2025-31125+4 CVEs

Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives

Paper proposes a threat taxonomy and guardrail analysis for LLM-powered autonomous penetration testing agents, covering lifecycle, architecture, and behavioral attacks.

The paper analyzes security threats to autonomous LLM-based penetration testing agents that independently perform reconnaissance, vulnerability identification, exploitation planning, and post-exploitation with minimal human supervision. It characterizes trust boundaries and attack surfaces of representative agent architectures and proposes a threat taxonomy spanning LLM lifecycle attacks, agent-architecture attacks, and cross-cutting behavioral attacks. The authors argue existing conversational-AI guardrails are insufficient for agentic, long-horizon offensive workflows and outline research directions for context-aware, architecture-aware guardrails.

arXiv cs.CR · 1d agoAI safety & security

[AINews] AEF-1 standard emerges for Third Party Evaluators, as Xai, OpenAI, and Anthropic all cosign

xAI, OpenAI, and Anthropic cosign the AEF-1 third-party evaluation standard while Dario Amodei proposes embedded evaluators for safety verification.

The AI Evaluator Forum published AEF-1, a baseline standard for independent third-party AI evaluations covering access, conflicts of interest, funding relationships, recusal, and transparency, cosigned by xAI, OpenAI, and Anthropic. Dario Amodei wrote a rare personal blogpost proposing embedded evaluators such as METR with desks, badges, company laptops, and internal-risk-team-level access to verify safety commitments, plus democratic and global coordination frameworks. The roundup also covers the pacing debate: Bilal Chughtai left Google DeepMind arguing progress may outrun alignment, while critics including Aidan Gomez and Cohere push back against slowdowns and lab gatekeeping. Additional items include Cline Desktop's launch with open-weight model support.

Latent Space · 1d agoAI safety & security

Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification

NIST Bugs Framework evaluation shows it is more structured and automation-friendly than CWE for automated vulnerability classification, with gaps in attribute guidance.

The paper evaluates NIST SP 800-231's Bugs Framework (BF) against CWE as a target for automated CVE classification using a systematically screened corpus of CVE-to-CWE research. An inter-rater study with 2 subject-matter experts mapping 13 CVEs showed strong agreement on BF's cause and operation axes but only fair agreement on the attribute axis. Automated classification was tested across two LLM deployments under different budgets, and findings support BF as more structured and automation-friendly than CWE, though gaps include under-specified attribute guidance and missing fix commits for closed-source software.

arXiv cs.CR · 1d agoResearch1

Understanding the Usability of Cryptographic Verification Tools

Survey of Tamarin and ProVerif users reveals usability barriers: debugging non-termination, model validation, and opaque proof failures hinder cryptographic protocol verification.

The paper presents an exploratory human-centered survey of researchers, graduate students, and practitioners with hands-on experience using Tamarin, ProVerif, and related cryptographic protocol verification tools. Findings reveal usability barriers across the verification workflow, including difficulties debugging non-termination and performance issues plus the lack of systematic methods for validating formal models against real protocols. When proofs fail without concrete attacks, users commonly simplify models, add helper lemmas, and revisit modeling abstractions. Participants called for actionable diagnostics, clearer explanations of results, visualization, and automation for recurring proof tasks.

arXiv cs.CR · 1d agoResearch

Modality-Autoregressive World-Action Models

ModAR autoregressively denoises multiple future modalities (point tracks, DINO features, depth) before predicting actions, beating prior world-action models at all data scales.

ModAR is the first world-action model (WAM) to autoregressively denoise multiple future modalities before predicting actions, letting each prediction condition on previously generated modalities. Training from scratch shows WAMs benefit from predicting point tracks, DINO features, and depth maps, while future RGB adds no consistent benefit. ModAR's sequential generation outperforms existing WAM formulations with the highest average success rate at all evaluated data scales. It slightly beats video-model-initialized Flex-π (75% vs 72% success) using roughly 20x fewer training FLOPs and no pretraining, and wins on three real-world bimanual tasks.

Hugging Face daily papers · 1d agoAI research

Unsolved Problem by Fields Medalist Breached by Two High School Students

Two high school students used Claude Opus 5 and GPT-5.6 Sol to help solve an open Lorentzian polynomials problem, posting a 75-page arXiv proof.

Aayush Bathija and Prince Rohatgi of Oak Park High School, mentored by UCLA postdoc Daniel Soskin, published the 75-page paper 'Bounded Ratios for Lorentzian Polynomials' (arXiv 2609.05341), solving an open problem in Fields Medalist June Huh's Lorentzian polynomial theory. The main structural theorem extends bounded coefficient-ratio characterization from quadratic to arbitrary-degree polynomials via discrete convexity conditions. The students used Claude Opus 5 and GPT-5.6 Sol for exploration and proof ideas but independently verified all arguments; the result follows an open letter from 25 Fields Medalists voicing concerns about AI's impact on mathematical rigor.

Hacker News · security · 2d agoAI researchHN 22↑ · 19 comments

Due to concerns about malicious applications, GPT2 will not be released (2019)

OpenAI's landmark 2019 GPT-2 post withheld the full 1.5B-parameter model over misuse concerns, releasing only a smaller variant and paper.

OpenAI announced GPT-2, a 1.5-billion-parameter transformer language model trained on 8 million web pages (40GB of text), achieving state-of-the-art zero-shot results including 70.70% on Winograd Schema and 63.24% on LAMBADA. Citing concerns about malicious applications such as scalable synthetic disinformation, OpenAI declined to release the trained model and instead published a smaller model and a technical paper as a 'responsible disclosure' experiment. The post, resurfaced on Hacker News in 2026, also documents failure modes like repetition and world-modeling errors, and discusses policy implications of controllable text generation.

Hacker News · AI · 2d agoAI safety & securityHN 44↑ · 19 comments

How Lossless Is Lossless Speculative Decoding? The Role of Numerical Precision in Orthrus

Reproduction study finds Orthrus speculative-decoding trajectories match the reference model in only ~45% of cases under BF16, but 100% under FP32.

Researchers independently reproduced Orthrus, a hybrid autoregressive-diffusion architecture claiming lossless speculative decoding via intra-model consensus, testing exact trajectory matching on 1,190 prompts across 12 domains. Under BF16, exact matching occurred in only 45% of cases for the authors' checkpoint and 43% for an independently trained model, with matching probability strongly tied to reference-model response-conditional perplexity. Despite trajectory divergence, downstream lm-eval-harness benchmarks showed no systematic degradation, while FP32 evaluation yielded exact matching on all prompts.

Hugging Face daily papers · 2d agoAI research1

ModularRSI: Modular and Generalizable Recursive Harness Self-Improvement

Researchers propose ModularRSI, a modular benchmark-disjoint recursive self-improvement framework that evolves agent harnesses across five modules, improving TB2.0 and SWE-Bench Verified results.

ModularRSI targets generalizable recursive self-improvement (RSI) for agent harnesses by contrasting successful and failed trajectories for the same task and aggregating evidence across tasks to find recurring behavioral deficiencies. It decomposes the evolvable harness into five modules—Agent Loop, Tool Use, Observation Management, Context Management, and Task Completion Detection—each evolved independently within a restricted scope, then integrated with conflict resolution. Using 2,000 executable evolution tasks disjoint from evaluation benchmarks, it shows consistent gains on TB2.0 and SWE-Bench Verified and transfers across different foundation models.

Hugging Face daily papers · 2d agoAI research

LynnReal-Omni: Native multi-modal Video Generation for Agentic Visual Workflows

LynnReal-Omni unifies controllable video generation tasks in a 32B multimodal diffusion transformer, with a 27B Flash variant rendering 540p clips in 377 ms.

LynnReal-Omni is a native multimodal video generation framework built on a 32B shared multimodal diffusion transformer unifying text-to-video, image-conditioned generation, reference guidance, structural control, editing, restoration and long-video generation, accepting heterogeneous inputs like 3D renders and game recordings for agentic visual workflows. A dedicated 27B Flash model enables real-time rendering, producing a 22-frame 540p video in 377 ms on one H100 versus 843 ms for the full model. The work introduces a curated multi-shot audiovisual data pipeline and MSAVP, a 100-prompt, 20-metric evaluation design covering instruction following, plausibility, visual quality, temporal behavior and audio coordination.

Hugging Face daily papers · 2d agoAI research