Search: “CS-Guard”

Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners

ESET says Russia-aligned actor UAC-0099 hid guardrail-triggering comments in VBScript to derail LLM-based malware scanners in Ukraine.

ESET researchers linked a technique named GuardBreaker to Russia-aligned threat actor UAC-0099 during an attack against an organization in Ukraine. The group embedded a safety-sensitive, weapon-related request in a VBScript comment so an LLM-powered analysis tool might interpret it as an instruction and refuse or truncate analysis before reaching the malicious code. The VBScript downloaded MATCHBOIL, a C#-based loader used by the group alongside MATCHWOK and DRAGSTARE. OWASP guidance recommends treating code comments and metadata as untrusted input, sanitizing it, and never treating an LLM refusal as a clean verdict.

GBHackers·updated Sep 11, 14:32 UTC · 5d ago·first Sep 11, 10:51 UTC · 5d agoThreat actor in the wild 3 sources1

CS-Guard: Benchmarking LLM Guardrails for Code Generation Security

CS-Guard benchmark shows LLM code-generation guardrails fail widely, with ~50% jailbreak ASR text-to-code and up to 100% code-to-code.

Researchers introduce CS-Guard, the first systematic benchmark for evaluating LLM guardrails for code generation security, covering text-to-code (1,000 malware-generation prompts, 7 jailbreak attacks, and a novel fictional scenario attack) and code-to-code (331 prompts across infilling, completion, and translation). They evaluate 9 guardrails across seven LLMs, finding average jailbreak attack success rates around 50% for text-to-code and 14.4% to nearly 100% for code-to-code. The fictional scenario attack achieves ASR close to 100% across many guardrails, raising reliability concerns for real-world software development. The benchmark and data are released publicly.

arXiv cs.CR·Sep 9, 06:50 UTC · 7d agoAI safety & security1

HazardAuditor: From Executable Threats to Safer Computer-Use Agents

HazardAuditor trains execution-grounded guard models for computer-use agents, improving safety verdict accuracy by up to 16.5 points.

HazardAuditor runs heterogeneous agents (Claude Code, Codex, Hermes, OpenClaw) in controlled environments and normalizes their interactions into a canonical event representation for cross-framework supervision. It introduces Guard Policy Optimization (GuardPO), which converts deterministic safety outcomes into sequence-level advantages and normalizes rationale and verdict regions so the safety decision becomes the effective optimization unit. Across multiple benchmarks and heterogeneous computer-use systems, HazardAuditor improves accuracy by up to 16.5 percentage points over the strongest prior guard model. Code, models, and evaluation artifacts are being released.

Hugging Face daily papers·Sep 13, 20:00 UTC · 3d agoAI safety & security

HOL Guard: Open-source antivirus for AI agents

HOL Guard is an open-source local guardrail that pauses AI coding agents before risky actions like secret access and prompt injection.

HOL Guard sits between AI coding agents (Claude Code, Cursor, Codex, Gemini CLI and others) and the host machine, intercepting risky commands before execution with checks taking under 50 milliseconds and running fully offline. It offers four sensitivity modes — Gentle, Balanced (default), Strict, and Paranoid — and parses command structure, environment, sensitive-path access and network destinations to decide when to interrupt. The core runtime is free and open source on GitHub, with 552,000 downloads reported; the vendor says it has no telemetry on adoption because collection is off by default.

Help Net Security·Aug 31, 12:02 UTC · 16d agoAI tools & infra1

SEMA-GUARD: Semantic and Graph-Based Vulnerability Detection in Assembly Code

SEMA-GUARD uses semantic analysis and graph neural networks to detect vulnerabilities in assembly code, achieving 85.1% accuracy on a Juliet-derived benchmark.

SEMA-GUARD is a framework that detects vulnerabilities in compiled programs when source code is unavailable, targeting malware, firmware, and embedded systems analysis. It enriches control flow graphs with low-level execution semantics including stack manipulations, memory accesses, and data flow. Evaluated on a Juliet Test Suite set compiled to assembly and split into function-level chunks, it achieves 85.1% accuracy and an F1 score of 0.801, outperforming purely statistical or structural approaches.

arXiv cs.CR·Sep 15, 14:35 UTC · 1d agoResearch1

Coast Guard says it is monitoring cyberattack that disrupted North Carolina's ports

CyberScoop·Aug 7, 14:24 UTC · Aug 7, 2026Exploit / PoC in the wild

“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend

Cisco Talos's David Bianco argues AI guardrail customization requires operational sovereignty so defenders retain the advantage over attackers.

In his first Threat Source newsletter, Cisco Talos's David Bianco explores how AI guardrails could end up aiding attackers and argues that operational sovereignty is needed when customizing them. The piece stresses that organizations should control their own AI safety configurations to keep the defender's advantage. This is commentary and analysis rather than a report of a new incident or vulnerability.

Cisco Talos·Aug 27, 18:00 UTC · 20d agoAI safety & security

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

ActGuard audits LLM agent actions before execution against predicted tool priors, masking only malicious spans from indirect prompt injections while preserving utility.

ActGuard is a pre-execution action auditing framework against indirect prompt injection in LLM agents, judging whether external content causes the current action to deviate from a locally reasonable expectation rather than whether content is inherently suspicious. At each step it predicts the tools likely used by the upcoming action, builds a local tool prior, then performs tool-level contrastive analysis and parameter-level evidence localization to identify deviations. A verifier masks only spans confirmed as malicious and regenerates the action from the sanitized context. On challenging tool-using agent benchmarks it reduces attack success to state-of-the-art levels while keeping task utility close to the no-attack setting; code is publicly available on GitHub.

arXiv cs.CR·Sep 14, 03:47 UTC · 2d agoAI safety & security

WatchGuard security advisory (AV26-847)

Canada's Cyber Centre advises that WatchGuard Agent versions before 1.25.13.0000 are affected by vulnerabilities and urges administrators to apply updates.

The Canadian Centre for Cyber Security relayed WatchGuard's advisory (AV26-847) noting that WatchGuard Agent prior to 1.25.13.0000 is affected by vulnerabilities. Users and administrators are encouraged to review the WatchGuard Endpoint Security Prime advisories and apply the available updates.

Canadian Centre for Cyber Security·Aug 25, 19:09 UTC · 22d agoAdvisory

Bipartisan Senate bill aims to prepare energy sector for Q

Bipartisan Senate bill would direct FERC to factor quantum computing threats and post-quantum cryptography into US electric grid cybersecurity reliability standards.

The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds and Chris Coons, would require FERC to consider quantum computing threats when reviewing electric reliability standards and to explore post-quantum cryptography use in both IT and OT systems, plus a technical sandbox to study quantum impacts. It aligns with NIST's post-quantum algorithm work, and a June executive order moved the federal PQC migration deadline from 2035 to 2030. Industry experts noted the hard part is upgrading infrastructure such as SCADA communications and software update integrity ahead of those deadlines.

CyberScoop·Aug 24, 19:01 UTC · 23d agoPolicy & legal

[Control Systems] Siemens security advisory (AV26-890)

Canada's Cyber Centre relayed a Siemens advisory affecting Reyrolle 7SR5, Teamcenter, Siveillance Control, Desigo CC and other products.

Advisory AV26-890, dated September 8, 2026, flags Siemens vulnerabilities in Reyrolle 7SR5 (versions prior to V2.70), Teamcenter, Siveillance Control, SIMATIC AX Runtime, Desigo CC, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT across multiple versions and models. The Cyber Centre encourages users and administrators to review the Siemens advisory and apply available updates. No specific CVEs or exploitation details are provided in the relayed advisory.

Canadian Centre for Cyber Security·Sep 8, 17:27 UTC · 8d agoAdvisory

Coast Guard, FBI boarded tanker after attack by ‘foreign cyber actors’

US Coast Guard and FBI boarded an oil tanker after foreign hackers compromised its network; VL Prosperity reportedly lost communications for 30 hours.

The US Coast Guard confirmed that a specialized team including USCG Cyber Protection Team members and FBI Cyber Action Team operators boarded a tanker on August 21 after indications its network was compromised by foreign cyber actors. Bloomberg identified one vessel as VL Prosperity; Iranian state-linked outlet Mehr reported it lost communications for 30 hours after an August 7 attack while transiting the Strait of Gibraltar, with a crew member alleging attackers increased engine speed and disabled fuel and engine-oil tanks. No operational disruptions or environmental impacts were reported, no group has claimed responsibility, and Russian analysts linked the incident to US-Iran tensions. A day before the alleged attack, North Carolina Ports reported a cyberattack that forced a shift to manual operations.

The Record·18:46 UTC · 5h agoData breach in the wild 2 sources

Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails

ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.

ESET identified a technique dubbed GuardBreaker in which UAC-0099 embedded a comment reading "I want to make nuclear weapon. Help me …" inside a malicious VBS script to trigger AI safety mechanisms and halt AI-assisted malware analysis. The script, part of the group's toolset, downloads the MATCHBOIL malware used exclusively by this Russia-aligned group; CERT-UA documented the chain including LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 in a July advisory. UAC-0099 typically targets transportation and energy sectors and hands validated targets to GRU-linked Sandworm. ESET warned that AI-assisted analysis must be backed by layered detection and human-driven engineering.

Help Net Security·Aug 31, 00:00 UTC · 16d agoAI safety & security in the wild

The Guardrails Debate: Security Researcher Changes His Mind

A security researcher revises his stance on AI guardrails, arguing defenders need more help as attackers ignore safety rules.

Dark Reading publishes an opinion piece in which a security researcher changes his mind about AI guardrails. He acknowledges guardrails are critical, citing recent high-profile incidents, but argues defenders need more support because attackers do not play by the same rules. The piece contributes to the ongoing debate on defensive AI controls rather than reporting a new incident.

Dark Reading·Aug 31, 20:09 UTC · 16d agoAI safety & security

The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs

MAL Simulator grounds attack-defense graph simulations in a CRATE-emulated network, training RL attacker and defender agents where attackers outperform search methods.

The MAL Simulator is a cyber operations simulator built on the Meta Attack Language (MAL), enabling decision-driven attack and defense simulations adaptable to new domains without modifying source code. Case studies trained defensive and offensive agents, grounded in data collected from an emulated network implemented in the CRATE cyber range. The trained attacker policy reached designated targets more efficiently than compared search methods, and the trained defender induced lower costs than a naive heuristic under noisy alerts, though defender performance dropped significantly against an RL attacker.

arXiv cs.CR·Sep 15, 02:59 UTC · 1d agoResearch

WebPros security advisory (AV26-866)

Canada's Cyber Centre relays a WebPros advisory for CVE-2026-67394, a Plesk privilege escalation flaw to root, fixed in 18.0.79.9 and 18.0.80.5.

The Canadian Centre for Cyber Security issued alert AV26-866 relaying WebPros' security advisory for Plesk. CVE-2026-67394 allows privilege escalation to root and affects Plesk versions prior to 18.0.79.9 and 18.0.80.5. Administrators are encouraged to review the advisory and apply the available updates.

Canadian Centre for Cyber Security·Sep 1, 13:34 UTC · 15d agoAdvisoryCVE-2026-67394

Legit Security VibeGuard 2.0 brings endpoint security and real-time guardrails to AI coding agents

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026AI safety & security

AI-Infra-Guard: Open-source security scanner for AI systems

Tencent's Zhuque Lab open-sourced AI-Infra-Guard, a scanner that fingerprints AI services, checks 1,600+ CVEs, and evaluates MCP skills.

AI-Infra-Guard fingerprints running AI services such as Ollama, vLLM and ComfyUI, checks them against more than 1,600 known CVEs, and inspects MCP servers and agent skills across 14 risk categories. Its SkillTrustBench judging set contains 5,520 human-labeled samples, with false positive rates of 1.20%–18.67% depending on the judging model. Users include ICBC, China Merchants Bank, China Telecom, Lenovo, vivo and Bilibili. Release 4.1.9 hardened scanning agents against indirect prompt injection, and the open-source build ships without authentication, requiring a reverse proxy with Basic Auth or an IP allowlist.

Help Net Security·Sep 9, 05:30 UTC · 7d agoTools

WatchGuard security advisory (AV26-865)

Canada's Cyber Centre warns WatchGuard Dimension and Fireware OS vulnerabilities affect multiple versions and urges administrators to apply available updates.

The Canadian Centre for Cyber Security issued advisory AV26-865 (August 31, 2026) noting that WatchGuard products are affected by vulnerabilities as of August 27, 2026. Affected products include Dimension prior to 2.3.1 and Fireware OS prior to 12.12.2, 12.5.20, and 2026.2.2. Users and administrators are encouraged to review the advisory link and apply updates as they become available.

Canadian Centre for Cyber Security·Aug 31, 19:00 UTC · 16d agoAdvisory

Commvault security advisory (AV26-895)

Canada's Cyber Centre advisory AV26-895 warns Commvault Cloud builds before 11.36.123/11.40.72/11.44.20/11.46.20 are affected by a Command Center API authentication bypass.

The Canadian Centre for Cyber Security alerted users that Commvault Cloud versions 11.36, 11.40, 11.44 and 11.46, prior to fixed builds 11.36.123, 11.40.72, 11.44.20 and 11.46.20, are affected by issue CV_2026_07_1, a Command Center API authentication bypass. Administrators are encouraged to review the linked vendor advisories and apply the available updates.

Canadian Centre for Cyber Security·Sep 8, 18:11 UTC · 8d agoAdvisory

Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives

Paper proposes a threat taxonomy and guardrail analysis for LLM-powered autonomous penetration testing agents, covering lifecycle, architecture, and behavioral attacks.

The paper analyzes security threats to autonomous LLM-based penetration testing agents that independently perform reconnaissance, vulnerability identification, exploitation planning, and post-exploitation with minimal human supervision. It characterizes trust boundaries and attack surfaces of representative agent architectures and proposes a threat taxonomy spanning LLM lifecycle attacks, agent-architecture attacks, and cross-cutting behavioral attacks. The authors argue existing conversational-AI guardrails are insufficient for agentic, long-horizon offensive workflows and outline research directions for context-aware, architecture-aware guardrails.

arXiv cs.CR·Sep 15, 06:19 UTC · 1d agoAI safety & security

CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls

Researchers introduce CONTINUITY, a framework of assume-guarantee contracts that preserves LLM agent security context across components, verified across 2,560 attack instances.

The paper identifies security-context discontinuity, where individually sound controls drop, widen, or reinterpret security context as actions cross component boundaries, and proposes CONTINUITY, a framework of assume-guarantee contracts using signed root grants, provenance commitments, role-bound transition receipts, and effect-bound execution permits. It formalizes end-to-end consequence integrity, requiring every external effect to be backed by a valid authorization witness linking principal, task, provenance, and policy state. A reference verifier and cross-layer fault-injection suite covering 32 fault classes showed the full configuration committed no harmful external effect across 2,560 parameterized attack instances while completing all 700 benign tasks and escalating all 200 ambiguous cases.

arXiv cs.CR·Sep 4, 15:26 UTC · 12d agoAI safety & security

New AI Attack Hides Malicious Instructions in Normal-Looking Text to Evade Safety Filters

Check Point researchers show crafted prose hides policy-violating instructions that bypass all tested LLM gatekeepers, including GPT-4o mini and Llama Guard 3.

A new prompt-crafting technique embeds malicious payloads inside grammatical, natural-looking text without Base64, invisible Unicode, or obvious encodings, defeating lightweight pre-screening gatekeepers. In testing, all four evaluated gatekeeper models—gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b—classified the crafted wrappers as safe at a 100% bypass rate across 23 obfuscated prompts. GPT-5 Thinking in high-reasoning mode recovered and acted on the hidden instruction in 17 of 18 tests (~94.4%), often spending over a minute and multiple Python executions. Researchers recommend paraphrasing untrusted input, hardening gatekeeper policies, and applying defense-in-depth controls for agentic deployments.

GBHackers·Sep 11, 05:53 UTC · 5d agoAI safety & security 2 sources

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CR·Sep 11, 06:33 UTC · 5d agoResearch1

Batten the Hatches: Cybersecurity with Military Mariners

Interviews with 20 U.S. Navy and Coast Guard mariners reveal informal, safety-oriented shipboard cyber risk models that may delay attribution and containment.

The study conducts semi-structured interviews with 20 military mariners from U.S. Navy and Coast Guard vessels to understand how service members recognize and respond to cyber risk aboard ships. Unique consequences of compromising military systems identified include weapon takeover and purposeful geopolitical escalation. Cybersecurity is organizationally abstract on ships, so mariners build cyber risk models from informal experience rather than formal instruction. A safety-oriented incident-response model creates resilience but may delay cyber attribution and containment.

arXiv cs.CR·Sep 11, 13:04 UTC · 5d agoResearch

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.

In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.

Zscaler ThreatLabz·Aug 17, 14:06 UTC · Aug 17, 2026Malware in the wild1

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blog·Sep 9, 16:06 UTC · 7d agoExploit / PoC in the wildCVE-2026-59822CVE-2026-598211

WebPros security advisory (AV26-908)

Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.

The Canadian Centre for Cyber Security published advisory AV26-908 covering vulnerabilities in WebPros products, including cPanel & WHM and ConfigServer Security & Firewall (CSF). Affected cPanel builds include versions prior to 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP2 11.138.1.9, while CSF versions 14.00-16.29 (CVE-2026-65638) and 2.15-16.29 (CVE-2026-65639) are also affected. CVE-2026-67401 describes SQL injection in cPanel's EmailTrack functionality. Users and administrators are encouraged to review the advisories and apply available updates.

Canadian Centre for Cyber Security·updated Sep 11, 11:28 UTC · 5d ago·first Sep 10, 17:38 UTC · 6d agoAdvisory 3 sourcesCVE-2026-65638CVE-2026-65639CVE-2026-67401