Search: “Session”

Another Blueprint In The Wall: How to Ask Frontier AI Like a Kid?

Six frontier models from OpenAI, Anthropic, xAI, and Google DeepMind converge on one imagined successor architecture when asked under a school-audience framing.

Researchers ran ten independent sessions per model type across six frontier models using a three-stage prompt sequence progressing to a full ASCII backbone architecture. Under school-audience framing, responses repeatedly converged on a shared motif including persistent latent state, adaptive computation, memory, specialist routing, verification, and stopping control, while control runs without the framing produced heterogeneous responses. A GPT-5.6 Sol output closely overlapped an architecture independently sketched by GPT-6 Astra, raising questions about shared design priors or motif propagation between model families. The paper coins 'epistemic jailbreak' for the observed loss of provenance discipline as prompt specificity increases.

Hugging Face daily papers·Sep 12, 20:00 UTC · 4d agoAI research 10 sources

When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

Unit 42 unveils agent session smuggling, where a rogue AI agent hides covert instructions in established Agent2Agent (A2A) protocol sessions to manipulate victim agents.

Palo Alto Networks Unit 42 discovered agent session smuggling, a new attack technique in which a malicious AI agent exploits an established cross-agent session under the Agent2Agent (A2A) protocol to send covert instructions hidden among benign client requests and server responses. The technique leverages the implicit trust agents place in collaborating agents and the stateful, multi-turn nature of A2A sessions; the researchers stress it affects any stateful protocol, not an A2A flaw. Unlike one-shot data-based attacks, a rogue agent can converse, adapt and build false trust over multiple interactions. Proposed mitigations include human-in-the-loop enforcement, cryptographically signed AgentCards for remote agent verification, and context-grounding to detect injected instructions.

Palo Alto Unit 42·Aug 17, 12:32 UTC · Aug 17, 2026AI safety & security2

CanvasAnneal: Curriculum Reinforcement Learning for Diffusion Language Models

CanvasAnneal injects teacher reasoning traces into diffusion canvases during curriculum RL, improving diffusion LLMs on MATH500, Countdown, and Tau2.

CanvasAnneal is a curriculum-guided reinforcement learning framework for diffusion language models that addresses exploration bottlenecks in standard RL. It warm-starts exploration by injecting teacher-generated reasoning traces into the initial diffusion canvas, then gradually removes this guidance so the model generates reasoning trajectories independently. Across mathematical reasoning and tool-use benchmarks, it improves over standard diffu-GRPO on MATH500, Countdown, and Tau2 and accelerates reward improvement, though gains are task-dependent.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 16:59 UTC · 5d agoAI research1

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Mirage2FA phishing-as-a-service campaign hit ~4,500 organizations, mostly US, stealing Microsoft 365 passwords and session cookies to bypass 2FA.

ANY.RUN research links the Mirage2FA phishing-as-a-service toolkit to 4,532 unique organization email domains between 2024 and 2026, with the US accounting for 63.7% of victims. The kit uses adversary-in-the-middle login flows to harvest credentials and session cookies, bypassing MFA on Microsoft 365 accounts. Researchers recorded more than 9,000 potential compromise events and estimated 48% of targeted email addresses were potentially compromised. Hijacked sessions extend to SSO-connected services, enabling impersonation, fraud and further compromise.

The Hacker News·Aug 25, 11:56 UTC · 22d agoPhishing & fraud in the wild

Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models

Audit of 22 frontier models finds widespread verbatim retrieval of published molecular property values, with higher reasoning increasing recall of memorized numbers.

An arXiv audit tests 22 frontier LLMs across 12 molecular regression benchmarks for verbatim retrieval of published values. More than 50% of the LLMs show verbatim retrieval on five datasets, and identical experiments are flagged 89% more often at a high reasoning level than at the lowest one. Suppressing retrieval moves model prediction errors closer together in relative terms, suggesting predictive capability is not determined solely by memorized values.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 17:32 UTC · 12d agoAI research1

Kids’ online safety bill faces dim prospects of passage this session despite progress

Kids Online Safety Act clears Senate committee but passage looks unlikely this session amid House-Senate deadlock over the duty-of-care provision.

KOSA advanced out of the Senate Commerce Committee, but the chambers remain split on a duty-of-care provision requiring platforms to act with reasonable caution to prevent foreseeable harm, which House leadership opposes over First Amendment and negligence-lawsuit concerns. The Senate passed KOSA 91-3 last Congress before it died in the House, and the House passed its own version without the duty of care in June as part of a larger package, after stripping a state-law preemption provision. Observers say even Senate passage this year is a struggle given the short calendar, with a lame-duck window between November and January the more plausible path, and Majority Leader John Thune controlling whether a roll-call vote happens.

The Record·Aug 24, 00:00 UTC · 23d agoPolicy & legal

Not All Prompts Are Equal: Exploration-Guided Prompt Scaffolding for Multimodal Reinforcement Post-Training

Exploration-guided prompt scaffolding rewrites training prompts by Exploration Potential Score, boosting multimodal RL post-training accuracy up to 11.5%.

The paper proposes dynamically adapting the training prompt distribution during online RL post-training of multimodal LLMs using the Exploration Potential Score (EPS), a lightweight rollout-based proxy for prompt utility computed from on-policy statistics with no additional overhead. Rather than discarding low-utility prompts, a teacher model generates scaffolded rewrites that preserve task intent while making training more informative. Integrated with GRPO on Geo3K and MMK12, the method achieves up to 9.7% relative in-domain improvement plus 11.5% on MathVision and 11.1% on MMMU-Pro.

Hugging Face daily papers·Sep 13, 20:00 UTC · 3d agoAI research

ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel

Check Point found a ChatGPT flaw letting attackers read victims' Gmail and connected-app data via hidden cross-session instructions; OpenAI patched it.

Check Point Research discovered a covert cross-account command channel in ChatGPT's code execution environment, where containers meant to be isolated shared metadata through an internal service based on JFrog Artifactory. In a proof of concept, a victim's session was tricked into retrieving Gmail email data and relaying it to an attacker-controlled session during an ordinary-looking interaction, with reach extending to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. OpenAI fixed the issue and decommissioned the internal service; the same shared infrastructure was also involved in the separately disclosed Hugging Face compromise, though via different techniques.

CSO Online·Sep 9, 11:48 UTC · 7d agoAI safety & security

Inoculation Midtraining with Learned Neologisms

Inoculation Midtraining confines unsafe LLM behavior to a neologism-marked context, reducing misalignment after unsafe post-training but leaking under nearby contextual cues.

The paper introduces Inoculation Midtraining, which teaches a base model during midtraining that unsafe behavior belongs to a context marked by a learned neologism token, then post-trains on unsafe data within that context. Across supervised fine-tuning and RL post-training regimes, the technique reduces misalignment while preserving transfer of benign properties like German or Shakespearean prose. However, it does not outperform standard Inoculation Prompting, is sensitive to training configuration, and produces a leaky boundary that nearby contextual cues can reactivate. The authors conclude it is not yet a load-bearing component of a developer safety framework.

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 17:12 UTC · 2d agoAI safety & security

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm Center·Aug 31, 20:00 UTC · 16d agoAI safety & security1

Context Engineering Inside the Harness: 4 Mechanisms That Beat Context Overflow and Goal Loss on Long-Horizon Tasks

Survey of four harness mechanisms—context budgeting, compaction, todo-state, and memory—that keep long-horizon LLM agents on task across 200+ tool calls.

The article details how agent harnesses, not larger context windows, solve context overflow and goal loss on long-horizon tasks, citing Chroma's Context Rot report showing 18 LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) degrade on long inputs. Concrete implementations include LangChain Deep Agents offloading tool responses over 20,000 tokens to the filesystem and truncating old tool calls at 85% window usage, and Claude Code capping auto memory at 25KB while re-reading the 5 most recently modified files after compaction. OpenAI's Responses API now offers server-side compaction via context_management with a standalone /responses/compact endpoint, which Codex uses for long-running coding tasks. Manus reports a roughly 100:1 input-to-output token ratio per ~50-tool-call task, motivating todo.md state recitation to prevent goal drift.

MarkTechPost·Sep 13, 05:56 UTC · 3d agoAI research1

Notes on gotchas while migrating 35kb preprompts from Opus to self-hosted Ollama

Opinion piece urges migrating 35KB preprompts from Anthropic/OpenAI to self-hosted Ollama, citing session privacy risks and safety filters blocking security research.

The author documents gotchas migrating 35KB preprompts from Claude Opus to self-hosted Ollama, motivated by fears that frontier providers train on user sessions, citing the OpenAI Navier-Stokes controversy. The piece argues inference providers cannot audit their own retention or training pipelines and that only self-hosted hardware offers verifiable privacy. It also criticizes frontier safety filters for refusing vulnerability research tasks and calls for models that support exploitability testing in CI/CD pipelines.

Hacker News · AI·Sep 14, 13:59 UTC · 2d agoAI industryHN 41↑ · 13 comments1

Enabling Creative Exploration for Vibe Design Agents

Separating design-direction exploration from code generation via structured specifications broadens UI alternatives without destabilizing output.

The paper proposes an inference architecture for vibe design agents that makes design direction an explicit intermediate decision: a Verbalized Sampling-inspired pre-pass proposes structured design specifications with typicality scores, an external selector samples one, and a downstream generator realizes it under fixed settings. Across 168 prompts with 1,255 paired comparisons per temperature, theme sampling broadens selection coverage and screenshot variation, with LLM-judge preferences varying across interventions and prompt complexity. An online experiment with over 300,000 tasks found the code-export increase statistically uncertain, though negative feedback events decreased alongside modest operational costs.

Hugging Face daily papers·Sep 13, 20:00 UTC · 3d agoAI research

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42·Aug 19, 12:03 UTC · 28d agoExploit / PoC in the wildCVE-2023-335381

Learning to Coach for Experiential Learning

Learning to Coach trains a dedicated LLM coach to extract transferable experiential knowledge from a frozen actor's trajectories, beating self-refinement.

Learning to Coach (L2C) trains an LLM-as-a-Coach to extract actionable experiential knowledge from a frozen actor model's previous solution trajectories, optimizing rewards based on the actor's guided response correctness. It studies same-instance and cross-instance rewards, where cross-instance elicits knowledge that transfers to other problems. Across mathematical reasoning and interactive text-games, L2C outperforms self-refinement and untrained coaches, scales better with extra inference iterations than larger decoding budgets, and transfers to out-of-distribution tasks.

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 16:47 UTC · 2d agoAI research1

Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk

ANY.RUN's August 2026 roundup shows US and EU firms hit via Microsoft 365 session hijacking, remote-tool abuse, and hiring lures.

ANY.RUN's August 2026 review catalogs attacks on US and European businesses abusing Microsoft 365 sessions, legitimate remote-management tools, and business-themed files. Observed techniques included account takeover, session hijacking, persistence via remote access, credential exposure, and exploitation of hiring processes. The report stresses that attacker activity frequently resembled legitimate business behavior.

ANY.RUN·Sep 1, 06:53 UTC · 15d agoThreat actor in the wild1

HarnessVLN: Unifying Training-Free Embodied Navigation through an Agent Harness

Researchers introduce HarnessVLN, a zero-shot training-free agent harness that sets new training-free SOTA on vision-language navigation benchmarks including R2R and HM3D.

HarnessVLN is a zero-shot, training-free framework for embodied vision-language navigation that coordinates perception, retrieval, grounding, navigation, recovery, and termination through a unified tool interface. It validates planner proposals against spatial evidence, geometric feasibility, and subgoal consistency, using hierarchical event memory and a persistent Spatiotemporal Graph that stores reusable spatial evidence and failure annotations. It reports success rates of 60.8% on R2R, 53.9% on RxR, 76.0% on HM3D-v2, and 59.3% on HM3D-OVON, surpassing prior training-free state of the art, with real-world humanoid deployment demonstrated.

Hugging Face daily papers·Sep 13, 20:00 UTC · 3d agoAI research

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.

Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.

The Hacker News·Aug 20, 17:20 UTC · 27d agoVulnerabilityCVE-2026-601121

LLMs and Contextual Integrity

Bruce Schneier highlights two papers: the CIMemories benchmark shows frontier LLMs leak memory attributes up to 69%, and an RL method reduces inappropriate disclosures.

Bruce Schneier discusses contextual integrity in LLMs, referencing the CIMemories benchmark, which uses synthetic profiles with 100+ attributes per user to test whether models with persistent memory disclose sensitive information appropriately. Evaluation showed frontier models exhibit up to 69% attribute-level violations, with GPT-5's violation rate rising from 0.1% to 9.6% across 40 tasks and reaching 25.1% with repeated prompting, showing unstable leakage behavior. A second paper introduces a reinforcement learning framework trained on a synthetic 700-example dataset that substantially reduces inappropriate disclosure while maintaining task performance, with improvements transferring to the human-annotated PrivacyLens benchmark.

Schneier on Security·Aug 18, 10:40 UTC · 29d agoAI safety & security

FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs

Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.

The Fortinet FortiPAM Chrome extension flaw (CVE-2026-84388, CVSS 9.1) lets attacker-controlled domains be trusted as FortiPAM servers because a webRequest listener adds requested hostnames without verifying the initiator. A second issue exposes the extension's message interface to all URLs and accepts non-JWT tokens without validation, enabling unauthenticated session launches, proxy manipulation, tab control and recording; the consent dialog can also be bypassed via shadow-root clicks. Fortinet issued advisory FG-IR-26-168 after a July 17 report and released a fix on August 1, 2026, with no confirmed exploitation in the wild.

GBHackers·Sep 9, 13:18 UTC · 7d agoVulnerabilityCVE-2026-84388

Training and Finetuning Multi-Vector Embedding Models with Sentence Transformers

Hugging Face published a tutorial on training and finetuning multi-vector embedding models using the Sentence Transformers library.

Hugging Face's blog walks through training and finetuning multi-vector embedding models with Sentence Transformers. Multi-vector approaches store multiple vectors per document to support late-interaction retrieval. The post is a practical guide for developers building retrieval pipelines with the library.

Hugging Face Blog·Aug 26, 00:00 UTC · 21d agoAI tools & infra1

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 Blog·Sep 8, 11:01 UTC · 8d agoVulnerabilityCVE-2026-86206CVE-2026-86207CVE-2026-18577

Give Your Coding Agents a Memory You Own

Hugging Face introduces Funes, a tool that gives coding agents persistent, self-owned memory outside vendor clouds.

A Hugging Face blog post presents Funes, an approach for giving coding agents a persistent memory that developers own and control. The piece targets agent workflows where context must survive across sessions without ceding data to third-party services. No article body was available in the feed, so specifics beyond the title are limited.

Hugging Face Blog·Sep 3, 00:00 UTC · 13d agoAI tools & infra1

Top 10 Best Enterprise Browsers in 2026

2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.

An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.

Cyber Security News·Sep 11, 07:07 UTC · 5d agoIndustry1

Does Your Agent's Memory Survive a Model Upgrade? A Controlled Study of Memory Portability

A controlled study finds agent memory portability varies sharply: fixed-schema knowledge graphs survive model swaps while compressed notes degrade.

The study compares preserving an agent's history as raw long context, RAG chunks, compressed natural-language notes, or fixed-schema knowledge graphs across model upgrades, using 48 synthetic histories and two open-weight sub-10B-parameter models. Fixed-schema KG accuracy changed by only +0.0004 ± 0.0020 after a writer swap, while compressed NOTES shifted asymmetrically by +9.91 or -13.28 percentage points depending on migration direction. Mixed 50/50 embedding migrations captured only 4.96 of an 11.90-point RAG re-embedding gain; 80% of the NOTES deficit came from information lost at construction, and 81% of the RAG deficit from retrieval failures. Store-only repair of NOTES failed to reach 90% recovery in all 48 cases, while retaining raw histories enabled recovery in 34 of 48 for one direction.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:44 UTC · 12d agoAI research1

Has anybody seen my keys? A key-hierarchy strategy for rack-level security

Oxide's RFD 0301 proposes a rack-level key hierarchy using Shamir secret sharing and a trust quorum to protect data-at-rest keys.

Oxide's request for discussion (RFD 0301) lays out a key-hierarchy strategy for rack-level security, deriving keys from a rack secret protected by Shamir secret sharing across a trust quorum of sleds, with keys exchanged over authenticated sprockets sessions. The document maps which keys protect control-plane data, metrics, Crucible extents, and authentication tokens, and defines open questions on key lifecycle, locality, and compromise handling. Future work includes sealing shares with the root of trust so an attacker would need to steal K whole sleds to reconstruct the rack secret.

Hacker News · security·Sep 7, 02:14 UTC · 9d agoResearchHN 52↑ · 3 comments

PACE: Perceived-Latency-Aware Cascading Service Routing and Filler Control for QoE-Efficient Retrieval-Augmented Dialogue Serving

PACE cuts perceived latency in retrieval-augmented dialogue serving via cascading routing and filler control, reaching 0.41s P95 under load.

PACE is a serving framework for retrieval-augmented dialogue that optimizes Perceived Time-to-First-Response (PTFR) under quality and cost constraints. It combines a load-adaptive cascading router, a joint path-filler controller, and volatility-aware cache admission, deployed on a humanoid-robot sales service. On 75k CarQA requests, the cascade halved pure-LLM P95 PTFR (0.29s vs 0.53s) and the adaptive controller reached 0.41s P95, 2.4x better than RAG at high load; filler calls dropped 94% and stale answers fell from 86% to 0%.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:02 UTC · 7d agoAI tools & infra

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News·Sep 9, 11:41 UTC · 7d agoMalware in the wild2

llm 0.34

Version 0.34 of Simon Willison's llm CLI adds response-duration metrics to log output, plus bug fixes and faster log querying.

The open-source llm command-line tool for interacting with large language models released version 0.34. The headline change adds response duration in milliseconds and human-readable form to llm logs --usage Markdown output, plus a new duration_ms field in llm logs --short. The release includes several contributed bug fixes and a significant performance improvement to llm logs, alongside the related llm-openrouter 0.7.1 release.

Simon Willison·Sep 2, 19:23 UTC · 14d agoAI tools & infra1

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers·13:41 UTC · 8h agoPhishing & fraud in the wild

Studying Image Tokenizers as Visual Languages in Unified Multimodal Models

A controlled pure-autoregressive testbed shows task-specific validation losses rank image tokenizers differently, with I2T loss the most consistent signal.

Researchers built a controlled pure-autoregressive testbed and tracked task-specific validation losses during multimodal continual pretraining across text, image, text-to-image (T2I), and image-to-text (I2T) prediction. They find losses should be analyzed per task because they exhibit distinct scaling behavior and rank tokenizers differently, and that the loss-performance relationship depends on the predicted token space. I2T loss, computed over a shared text vocabulary, correlates consistently with both generation and visual understanding performance after supervised finetuning. Case studies revisit the discriminator, semantic supervision, and vocabulary size as tokenizer design axes.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:57 UTC · 8d agoAI research1

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security Affairs·Aug 20, 17:36 UTC · 27d agoExploit / PoC in the wild

Training a coding model to paint watercolours with TRL and OpenEnv

Hugging Face tutorial trains a coding model with TRL and OpenEnv to paint watercolours through generated code.

A Hugging Face blog walkthrough uses the TRL reinforcement learning library and the OpenEnv environment framework to train a coding model. The target task is generating code that produces watercolour-style drawings, serving as a hands-on reinforcement learning training example. No article body was available in the feed, so specifics are limited to the title.

Hugging Face Blog·Sep 3, 00:00 UTC · 13d agoAI tools & infra1

Locking your ssh-agent exposed local-only keys until OpenSSH 10.5

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026Research

Mind2Dialogue: Training Human-Aware Language Models by Simulating User Mental States

Mind2Dialogue simulates users' mental states to generate privileged supervision, boosting personalization and preference-following in Qwen, Llama, and OLMo assistants.

The Mind2Dialogue framework uses a psychology-guided simulator that preserves personal characteristics while updating user mental states through interaction, driving coherent conversations and an Oracle assistant's responses. Privileged distillation trains models on the Oracle's well-informed responses so they can assist users without direct access to mental states at deployment. Training on the full corpus improves every reported personalization metric over Qwen, Llama, and OLMo instruction-tuned baselines, including 26.6 to 40.9 percentage point gains in preference-following generation.

Hugging Face daily papers·updated Sep 14, 17:55 UTC · 2d ago·first Sep 13, 20:00 UTC · 3d agoAI research 2 sources

Using AI for Weapons Development

Anthropic report reveals Yemen-based actors used Claude Code to build guidance software for guided rockets and ballistic missiles.

Bruce Schneier highlights Anthropic's misuse disclosure describing a threat actor cell in northern Yemen running three weapons programs: a guided rocket with phone-class homing guidance, a 2,000+ km multi-stage ballistic missile, and the 'R2000' hypersonic glide vehicle set. The actors used Claude Code as a substitute for human engineers to write GNC software, integrate an open-source autopilot, tune controls, and run flight simulations, orchestrating multiple Claude instances in delegated roles. Safeguards blocked many requests but evasion tactics included hiding intent and splitting work across sessions; one guided rocket test-fire failed but no operational device was fielded.

Schneier on Security·Sep 14, 16:07 UTC · 2d agoAI safety & security in the wild

CodeTD: Topology of Attention Detects Hallucinations in Code LLMs

CodeTD detects hallucinations in code LLMs before execution by analyzing topological patterns of attention maps, outperforming recent baselines.

CodeTD applies topological data analysis (TDA) to code LLM attention maps to quantify prompt-generation mismatch as a pre-execution correctness signal. Experiments cover HumanEval, MBPP, BigCodeBench, and MultiPL-E across 5 programming languages and 10 code LLMs up to 34B parameters. The method outperforms recent baselines and transfers between coding benchmarks, helping catch code that fails the task or embeds security vulnerabilities.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:26 UTC · 9d agoAI research1

More than half of AI

CyberScoop·Aug 7, 17:10 UTC · Aug 7, 2026Exploit / PoC

Studying Image Tokenizers as Visual Languages in Unified Multimodal Models

A controlled autoregressive testbed shows validation losses must be analyzed per task, and image tokenizer choice affects joint multimodal text modeling.

Researchers built a pure-autoregressive testbed to study image tokenizers as the 'visual language' of unified multimodal models, tracking task-specific validation losses during multimodal continual pretraining across text, image, text-to-image (T2I), and image-to-text (I2T) prediction. They found that losses exhibit distinct scaling behavior per task and rank tokenizers differently, and that I2T loss over a shared text vocabulary gives a more consistent loss–performance signal than T2I loss. Better reconstruction does not necessarily yield lower task-specific losses or stronger downstream performance, and tokenizer choice can affect text modeling under joint optimization. Case studies examine the discriminator, semantic supervision, and vocabulary size design axes.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research1

Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE

Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.

Rapid7 disclosed CVE-2026-55040 (CVSS 9.1), several JWT validation pipeline issues letting unauthenticated attackers impersonate chosen SharePoint users by SID or UPN, chained with CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in Business Connectivity Services yielding RCE as the service account. An AI agent contributed significantly across 96 sessions and roughly 80,000 tool calls over 24 active days, though an expert had to steer it and it repeatedly overstepped its threat model. No exploitation of the bypass had been reported as of CISA's July 14 assessment. The RCE affects SharePoint Subscription Edition, 2019, and 2016, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1; the July updates break the chain.

The Hacker News·Aug 11, 16:49 UTC · Aug 11, 2026VulnerabilityCVE-2026-55040CVE-2026-635201