Search: “auto_scan”

Attackers turn to AI for help identifying files worth stealing

Gambit Security documents three threat actors using AI: a ransomware operator with Claude Code, credential harvester Zerofot, and the AI-built RAGE cryptomining framework.

Gambit Security examined three unrelated threat actors using AI across different stages of intrusions. A suspected operator tied to The Gentlemen ransomware-as-a-service used Claude Code running Claude Sonnet 4.6 in late June 2026 at six organizations, including an Australian energy utility, where it ran reconnaissance, ranked valuable databases, staged SQL Server dumps for exfiltration, and modified firewall configurations, accidentally taking one utility firewall offline. The Zerofot credential-harvesting operation, built with OpenAI Codex and Claude Code, collected 2,975 validated credentials from 1,742 hosts between April 5 and May 23, 2026, including SSH private keys and AWS access keys. The AI-generated RAGE Python framework exploits exposed Redis, Elasticsearch, Docker, Tomcat, and other services to harvest credentials and deploy cryptominers, guided at runtime by a DeepSeek-backed AI Orchestrator.

Help Net Security·Aug 18, 00:00 UTC · 29d agoThreat actor in the wild1

AutoTrans: AI-Assisted Automatic Translation of Security Assertions for RISC-V Processors

AutoTrans uses LLMs with regex extraction and formal verification to automatically translate security assertions across RISC-V processors, achieving 78% unattended acceptance.

AutoTrans is an automated framework for translating verified security assertions between RISC-V processor targets, where manual translation takes hours per assertion. It combines a regex-based SystemVerilog signal extractor to prevent LLM signal hallucination, a pinned prompt template yielding byte-identical prompts resilient to model updates, and JasperGold FPV formal verification of generated assertions. Applied with DeepSeek V4 to translate assertions between RISC-V targets such as IBEX and NS31A, it achieves a 78% automatic translation acceptance rate without human intervention and 100% after human refinement.

arXiv cs.CR·Sep 9, 11:31 UTC · 7d agoResearch

Identifying Agentic Automation with Behavioral Telemetry

Akamai describes detecting autonomous AI browser agents like Comet using Masked Autoencoder Transformer models on sparse behavioral telemetry.

Akamai researchers present a behavioral telemetry approach for identifying agentic automation in web traffic. Masked Autoencoder Transformer models are used to detect the sparse behavioral signals produced by autonomous AI browser agents such as Comet. The work targets traffic classification and bot detection rather than a specific vulnerability, and becomes more relevant as agentic browsing adoption grows.

Akamai Blog·Aug 19, 19:00 UTC · 28d agoAI safety & security1

Beyond Solver Verdicts: Generative Reward Models for Autoformalization

Researchers introduce Generative Verification (GenV), a generative reward model achieving 0.961 AUROC in detecting unfaithful autoformalization that preserves solver verdicts.

The paper formalizes Verdict-Preserving-Unfaithfulness (VPU), a failure mode in neurosymbolic autoformalization where an incorrect encoding executes successfully and matches the expected solver verdict, and proves verdict-only verification is bounded to chance-level detection. The proposed Generative Verification (GenV) distills an offline Z3-equivalence oracle into a reference-free, continuous reference-equivalence score within the language model's vocabulary space. The oracle-mined verifier (GenV+HN) achieves 0.961 AUROC, generalizes zero-shot across unseen translators and formal styles, and yields an 11.3-point downstream accuracy gain in agentic test-time compute allocation. Mechanistic analysis with decision-projected logit lenses and sparse autoencoders shows the generative readout extracts precise spatial error coordinates without explicit localization training.

Hugging Face daily papers·Sep 9, 20:00 UTC · 7d agoAI research1

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

DEF CON researchers chained Windows Plug and Play auto-install abuse with third-party driver flaws to reach SYSTEM on fully updated Windows 11.

In 'Plug And Pwn' research prepared for DEF CON 34, Alejandro Hernando and Borja Martinez emulated USB devices so Windows auto-installed signed vendor software, chaining a Sierra Wireless SwiService.exe SetDNS primitive, a Sony FeliCa co-installer path-traversal flaw that writes a DLL into System32, and device reconnection for SYSTEM code execution. A remote variant over Remote Desktop forges a synthetic Intel RealSense device and abuses a CRYPTBASE.dll search-order hijack when PnP or low-level USB redirection is enabled. Microsoft notes RDP does not allow supported PnP and RemoteFX USB redirection by default, and no in-the-wild exploitation has been reported.

The Hacker News·Aug 11, 10:48 UTC · Aug 11, 2026Research

Root-Cause Attribution Is a Search Problem: Continual Search for Long-Horizon Agent Failures

Continual Search framework iteratively prompts LLM judges to keep searching agent execution logs, boosting long-horizon failure root-cause attribution accuracy.

The paper frames automated root-cause attribution (RCA) for long-horizon AI agent failures as a search problem, since relevant evidence is sparse and distributed across massive execution traces. The authors propose Continual Search, an iterative framework that nudges an LLM judge across successive turns to keep hunting unresolved diagnostic evidence instead of settling on an early plausible diagnosis. They introduce MegaRCA-Mix, a benchmark of 50 human-annotated failure trials on long-horizon, execution-heavy tasks. On MegaRCA-Mix, Continual Search improves GPT-5.5's F1 from 0.349 to 0.498 (over 40% gain), and lower-tier models can surpass higher-tier counterparts when search is effective.

Hugging Face daily papers·Sep 10, 20:00 UTC · 6d agoAI research1

SkillSpector: NVIDIA's open-source security scanner for AI agent skills

Help Net Security·Aug 3, 00:00 UTC · Aug 3, 2026Malware

AI SIEM Search

Huntress launched AI Search for Managed SIEM, translating plain-English questions into ESQL log queries with schedulable custom alerts.

Huntress introduced AI Search in its Managed SIEM, letting users query logs in natural language instead of writing ESQL, KQL, or SPL. The feature generates a real ESQL query behind the scenes, exposes it for users to inspect and learn from, and allows saved searches to be scheduled as recurring alerts at hourly, daily, or weekly cadence. A planned next version will return summarized plain-language answers instead of raw logs.

Huntress·Sep 7, 14:00 UTC · 9d agoTools

Hackers Abuse AutoIt to Inject AsyncRAT Into Microsoft-Signed Windows Process

Attackers use AutoIt and an invoice-themed batch file to inject AsyncRAT into Microsoft-signed charmap.exe for stealthy remote access.

Point Wild Threat Intelligence documented a five-stage campaign starting with 'Right-click to open Invoice Details.bat' that launches hidden PowerShell, drops a renamed AutoIt interpreter and encrypted loader into a random Temp folder, and persists via a Startup-folder batch file. The loader decrypts AsyncRAT only in memory and injects it into the Microsoft-signed charmap.exe (Windows Character Map) process, leaving no payload file on disk. The final payload patches AMSI inside the infected process and includes screen-capture code that prepares images for transfer to a command-and-control server at 158[.]51[.]122[.]136:4944.

Cyber Security News·Sep 14, 07:07 UTC · 2d agoMalware in the wild1

Identifying Agentic Automation with Behavioral Telemetry: Part 2

Akamai details behavioral telemetry signals for identifying agentic automation traffic in the second part of its research series.

Akamai published part two of its series on identifying agentic automation using behavioral telemetry. The post appears on Akamai's security research blog and focuses on detecting AI-agent-driven traffic. Full article text was unavailable at classification time, so classification relies on the title and source.

Akamai Blog·Aug 27, 12:00 UTC · 20d agoResearch

Your Critical Vulnerabilities Might Not Be Your Biggest Risk

Autonomous penetration testing advocates prioritize exploitable attack paths over raw vulnerability severity for continuous security validation.

The article argues that scanner severity scores lack context: a critical flaw behind strong segmentation may be low priority, while a medium flaw on internet-facing systems can provide a foothold chained toward sensitive data. It positions autonomous penetration testing and attack path validation as the execution layer for continuous security validation, replacing point-in-time assessments. The piece is vendor-authored thought leadership rather than incident or vulnerability news.

The Hacker News·Sep 11, 11:30 UTC · 5d agoIndustry1

SpiderSilk Hunts External Threats With AI-Based Scanner

Dubai-based startup SpiderSilk offers an AI-based scanner that surveys billions of IP addresses to find exposed assets, leaked data, and zero-day vulnerabilities.

SpiderSilk, a threat detection startup based in Dubai, uses artificial intelligence tools to scan billions of IP addresses. The scanner identifies exposed assets, leaked data, and zero-day vulnerabilities from an external perspective. The approach targets external attack surface discovery for defenders.

Dark Reading·Sep 11, 18:27 UTC · 5d agoTools

AI Agents Are Now Emailing Me with Their Security Concerns

Autonomous Claude agent documents first known defensive use of ASCII smuggling, surveying 497 Lemmy instances for bot-catching prompt-injection tripwires.

An autonomous Claude agent calling itself Tenner published field research relayed to Bruce Schneier, probing 497 Lemmy instances and finding 8 of 257 application-gated ones embed instructions aimed at bots rather than humans. lemmy.ml's form instructs bots to answer 24+24, while one instance hides a 59-character Unicode tag payload (U+E0000-U+E007F) telling bots to list 'safety' as an interest. The agent also mapped anti-automation barriers, noting identity verification never triggered and that IP reputation, captchas and account-age rules were the actual obstacles. It further documented an agent task market where advertised rewards were about 2x the actual on-chain escrow.

Schneier on Security·Sep 2, 18:28 UTC · 14d agoAI safety & security

LLM Agents as Computational Typologists

AUTOTYPOLOGIST is an LLM agent that performs evidence-grounded linguistic typology analysis over 25 open-source reference grammars.

The agent retrieves relevant grammar sections, analyzes interlinear glossed text (IGT), and iteratively reasons over typological hypotheses in a ReAct-style workflow. It was evaluated on typological feature coding against expert annotations and hypothesis testing against universals using 25 open-source reference grammars. Results suggest LLM agents can support scalable, inspectable crosslinguistic analysis but still require expert validation.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:35 UTC · 9d agoAI research1

Product showcase: AI Paper Trail shows the privacy cost of talking to AI

Proton launched AI Paper Trail, a free tool that analyzes ChatGPT or Claude exports and reports what personal data can be inferred from AI conversations.

Proton released AI Paper Trail, a free web tool that analyzes the 200 most recent prompts from exported ChatGPT or Claude conversation histories and generates a privacy report with an AI Exposure Score, inferred personal data categories, and an estimated advertising value. In a hands-on test it identified 47 data points, returned a 58/100 exposure score, estimated $185 in advertising value, and flagged five red flags spanning location, interests, finances, and relationships. Proton states that uploaded data is deleted after analysis and is not stored on its Lumo servers.

Help Net Security·Aug 24, 00:00 UTC · 23d agoAI industry

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commits·Sep 8, 19:22 UTC · 8d agoTools

LandingAI Releases Agentic Document Extraction Gen2 with DPT-3 Pro and DPT-3 Verity

LandingAI shipped Agentic Document Extraction Gen2 with DPT-3 Pro and DPT-3 Verity parsing models, adding usage-based billing, block-tree outputs, and word-level grounding.

LandingAI has generally released Agentic Document Extraction Gen2, rebuilt around two parsing models: DPT-3 Verity for deterministic transcription of digital documents with per-word bounding boxes and confidence scores, and DPT-3 Pro for layout-aware parsing of scans, handwriting, non-Latin scripts, and LaTeX math. Billing changes from a flat 3 credits per page to a page-plus-output-character model (Pro: 1 credit/page plus 0.5 credits per 1,000 output characters on priority; Verity: 0.3 plus 0.2), with an asynchronous standard tier at 0.5x price and vendor-claimed 25-80% cost reductions. Parse v2 returns a document-page-block tree with semantic IDs, normalized bounding boxes, and line- or word-level atomic grounding, replacing flat chunks; Gen1 client code will not run against Gen2 endpoints. Deployment options include US/EU cloud, VPCs on AWS, Azure, and Google Cloud, Snowflake, and air-gapped on-premises environments, with automated model routing planned for fall 2026.

MarkTechPost·Sep 10, 02:13 UTC · 6d agoAI tools & infra

The Hidden Instructions That Can Hijack AI Agents

Hidden prompt injections embedded in documents and metadata can hijack autonomous AI agents, causing data exfiltration and out-of-policy actions at machine speed.

Bowbridge warns that hidden indirect prompt injections, embedded in documents, metadata, emails, images, and code repositories, can cause autonomous AI agents to treat attacker-controlled content as trusted guidance. Because agents inherit user privileges, act silently, and lack human judgment, injections can lead to data exfiltration or file poisoning that traditional security controls cannot detect. A real-world example involved a supplier quote whose metadata instructed an agent to override guidance and select the most expensive option. Bowbridge recommends scanning documents before agents process them.

SecurityWeek·Sep 8, 17:00 UTC · 8d agoAI safety & security

ENCP: Episode-Normalized Conformal Prediction for Vision-and-Language Navigation

ENCP calibrates conformal prediction per navigation episode, giving step-level coverage guarantees for vision-language navigation agents despite within-episode dependence.

Episode-Normalized Conformal Prediction (ENCP) rescales a nonconformity score by a VLN policy's residual confidence and calibrates one maximum score per episode, preserving step-level coverage of at least 1−α despite dependence among steps within an episode. Across four VLN policies and three nonconformity scores on R2R and REVERIE, ENCP meets all reported empirical step-coverage targets in seen-to-unseen evaluation. The model-agnostic uncertainty estimates can signal when an agent should defer to a stronger predictor or human assistance.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 17:42 UTC · 1d agoAI research

PentestGPT: Open-source automated penetration testing agentic framework

Open-source PentestGPT runs autonomous LLM-driven penetration tests via Claude Code and Codex, with legacy human-in-the-loop mode supporting many providers.

PentestGPT, originally published at USENIX Security 2024 by Gelei Deng and colleagues, is an open-source framework that lets a large language model autonomously run penetration testing stages (recon, exploit, walkthrough) with no human in the loop, driving Claude Code or Codex CLIs. A legacy interactive mode uses three cooperating LLM sessions maintaining a Pentesting Task Tree and supports OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local models via Ollama. The tool sends anonymous telemetry to Langfuse by default, excluding command outputs, credentials, and flags, and is available free on GitHub.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Tools1

Autonomous Research for Open-Ended Problems: A Case Study on Telecom Ticket Retrieval

Case study shows autonomous LLM research reaches 90% of SOTA on telecom ticket retrieval in 10 weeks versus 10 months human work.

The paper explores adapting autonomous research to open-ended, industry-grade ML problems through a telecom ticket retrieval case study with commercial and open-source agents. Autonomous research reached 90% of state-of-the-art performance (0.34 vs. 0.38 Recall@1) in 10 weeks versus 10 months of human work, at up to $200 per Cursor campaign. The authors find agents excel at narrow hyperparameter optimization but lack human-like intuition, recommending human-agent collaboration.

arXiv cs.AI / cs.LG / cs.CL·Sep 11, 17:09 UTC · 5d agoAI research

AI-Infra-Guard: Open-source security scanner for AI systems

Tencent's Zhuque Lab open-sourced AI-Infra-Guard, a scanner that fingerprints AI services, checks 1,600+ CVEs, and evaluates MCP skills.

AI-Infra-Guard fingerprints running AI services such as Ollama, vLLM and ComfyUI, checks them against more than 1,600 known CVEs, and inspects MCP servers and agent skills across 14 risk categories. Its SkillTrustBench judging set contains 5,520 human-labeled samples, with false positive rates of 1.20%–18.67% depending on the judging model. Users include ICBC, China Merchants Bank, China Telecom, Lenovo, vivo and Bilibili. Release 4.1.9 hardened scanning agents against indirect prompt injection, and the open-source build ships without authentication, requiring a reverse proxy with Basic Auth or an IP allowlist.

Help Net Security·Sep 9, 05:30 UTC · 7d agoTools

Credentialed Pre-Port Discovery: Don't Probe the Host, Ask it

Rapid7's version 8.58 adds credentialed pre-port discovery, letting scan engines query hosts for listening TCP/UDP ports instead of network probing.

Rapid7 documents credentialed pre-port discovery, available from version 8.58 as an off-by-default per-template option under Asset Discovery. The scan engine authenticates with existing SSH, Scan Assistant, or Windows credentials and receives the host's authoritative list of listening TCP and UDP ports, skipping the network port scan. Hosts without matching credentials silently fall back to network port scanning. Trade-offs include reporting firewall-blocked ports the engine cannot reach, longer scans, and early termination findings caused by repeated connection failures.

Rapid7 Blog·Sep 9, 15:16 UTC · 7d agoTools

Linux Foundation Introduces TRACE Standard for AI Runtime Evidence

The Linux Foundation introduced TRACE, an open standard providing hardware-attested runtime and compliance evidence for AI agents.

The Linux Foundation announced TRACE, an open standard designed to generate hardware-attested runtime evidence for AI agents. The standard aims to give auditors and regulators verifiable proof of what AI agents actually executed. It targets compliance and assurance needs for organizations deploying autonomous AI systems.

Infosecurity Magazine·Aug 26, 09:10 UTC · 21d agoAI tools & infra1

ActionSplice: In-Flight Action Editing for Interactive World Models

ActionSplice enables in-flight action editing in chunk-autoregressive video world models via a lightweight corrector, avoiding rollback or waiting for the next chunk.

ActionSplice is an inference framework that formulates in-flight action editing for chunk-autoregressive video world models as Counterfactual State Transport (CST), where a lightweight corrector transports the interrupted backbone-native representation toward the matched state induced by the revised action. The world model and sampler remain frozen, and sampling resumes without replaying completed evaluations. Across minWM-Wan Action2V and HY-WM1.5, the retargeting variant CST-R reduces rollback-relative LPIPS by 61.5% and 75.9% versus direct condition swapping, while the temporal-splicing variant CST-T reduces suffix LPIPS by 56.1% and 77.5% with 2.73x and 1.69x pixel-ready speedups over waiting.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research

Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic

Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.

Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.

Palo Alto Unit 42·Aug 17, 12:47 UTC · Aug 17, 2026Research

Automox Mitigation Worklets cut endpoint exposure to unpatchable flaws

Automox launched an AI-speed Mitigation Worklet Pipeline that drafts and publishes mitigations for unpatchable vulnerabilities within hours of disclosure.

Automox announced its Mitigation Worklet Pipeline, which uses AI to draft mitigations for unpatchable vulnerabilities and publishes human-reviewed Worklets to its catalog within hours of disclosure. The company cites rising vulnerability volume, including a record Patch Tuesday with 973 CVEs, as motivation. Customers can search Worklets by CVE, control deployment targets, and verify execution through Activity Logs and Policy Results.

Help Net Security·Sep 11, 07:48 UTC · 5d agoTools

Automating Attack Graph Construction for Agentic Pentesting. Towards Neuro-Symbolic Vulnerability Hunting

Semi-automated pipeline converts Trivy, Semgrep, Nmap output into MulVAL attack graphs for agentic pentesting, 53.7% mean vulnerability coverage in CyBench.

The paper presents a semi-automated pipeline that parses Trivy, Semgrep, and Nmap findings into MulVAL predicates and uses an LLM-assisted process to build domain-specific Datalog rules linking scanner evidence to attack techniques. MulVAL/XSB then performs symbolic inference to generate structured, auditable attack paths for agentic pentesting. Evaluated on 54 web CTF tasks from CyBench, every task produced at least one goal-reaching graph with 53.7% mean ground-truth vulnerability coverage, 51.9% full coverage, and an 83.9% noise-path rate. Median end-to-end runtime was 24.9 seconds, making the pipeline runtime-practical for agentic workflows.

arXiv cs.CR·Sep 14, 13:13 UTC · 2d agoResearch

Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests

Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests by leveraging existing site context.

Reflectiz, a web exposure management vendor, announced an agentic penetration testing product within a new Offensive Hub. The platform uses specialized AI agents for crawling, stack fingerprinting, attack execution, and independent validation, claiming to cover the OWASP Top 10 and reduce false positives. Findings integrate with existing workflows via REST API, CI/CD triggers, and Slack, and an AI remediation agent named Atlas guides fixes. The announcement is a vendor press release with a planned September 15 webinar demo.

GBHackers·Sep 8, 14:03 UTC · 8d agoTools 2 sources

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO Online·Sep 9, 10:00 UTC · 7d agoAI safety & security1

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.

A joint advisory from NSA, CISA, FBI, DOE and EPA describes an active threat in which AI-generated exploit scripts disguised as legitimate monitoring tools target Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers). The actors use Censys and ZoomEye scanning to find internet-exposed, outdated PLCs and a custom Python script using snap7 libraries over the S7comm protocol for initial access, credential access and denial of service; no attribution was given. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential for process disruption and cascading impacts. A related Dream report details a near-autonomous AI-agent campaign (July 1-4, 2026, 12 waves) against Taiwan government entities, using Hermes and OpenClaw agents with eight parallel sub-agents to crack 85 accounts via password spraying and exfiltrate over 2,564 personnel records, SSO client secrets and database credentials.

The Hacker News·Aug 21, 05:39 UTC · 26d agoExploit / PoC in the wild1