30
42
42
Design Docs Are All You Need: An AI-native Machine-Learning Performance Tool
Researchers present SMART, an ML performance-modeling library regenerated by AI coding agents from natural-language design docs instead of code.
The paper describes SMART, a symbolic performance-modeling library whose main branch contains almost no code: the repository is a DAG of self-contained design documents, and coding sub-agents regenerate implementations from only the docs on version updates. Reliability rests on a worked-example doc style used as in-context demonstrations and a minimal operator IR with SymPy cost expressions, offering both fast analytical roll-up and fine-grained modulo-scheduling modes. Regenerated implementations reproduce hand-audited reference models, including DeepSeek-V3 serving on a TPU pod slice, to round-off precision.
30
35
Sound Debloating of Redundant Checks in Zero-Knowledge Machine-Learning Circuits
Automated framework soundly removes up to 48.7% of redundant constraints in ezkl and zkml ZK-ML circuits, cutting prover time by up to 72.8%.
The framework uses whole-circuit abstract interpretation and a provenance graph to verify that each removed redundant check (range proofs, sign lookups, bit decompositions) remains entailed by the rest of the circuit, provably preserving soundness. It was evaluated on MLP, CNN, RNN, and transformer circuits generated by ezkl and zkml, with up to 25.3 million constraints. It removes up to 48.7% of constraints and reduces prover time by up to 72.8% without weakening security. Under-constrained circuits in deployed ZK systems have previously enabled attackers to forge transactions and bypass verification.
35
Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research
Researchers release NEST-Phish, a synthetic enterprise phishing email dataset with matched legitimate and phishing emails and cue annotations for detection research.
Academic researchers introduce NEST-Phish, a publicly released synthetic enterprise phishing email dataset built around a fictitious organization named Nebulon. It contains matched synthetic legitimate and phishing emails across a broad set of workplace communication themes, each with interpretable phishing-cue annotations. Human-subject categorizations and supervised classifier evaluations indicate the dataset supports meaningful variation in phishing judgments and provides learnable signal for detection models. It is intended to support work on phishing detection, human susceptibility, explainability, and benchmark development.
35
30
55
42
42
60
42
60
60
55
Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds
Attackers exploited pre-auth RCE CVE-2026-39987 in Marimo notebooks to steal AWS credentials and SSH into a bastion host in eight seconds.
Sysdig Threat Research Team documented an intrusion abusing CVE-2026-39987, an unauthenticated RCE in Marimo's terminal WebSocket endpoint affecting versions up to 0.20.4 and fixed in 0.23.0. The attacker harvested AWS credentials from the host environment and Redis backend, queried AWS Secrets Manager to retrieve an SSH private key, and authenticated to an internet-facing SSH bastion host just eight seconds after opening the WebSocket session. Human-operated custom tooling, not an AI agent, executed the full exploit-to-lateral-movement chain.
65
42
30
30
30
60
60
30
30
55
55
30
30
30
57
30
55
57
57
55
57
30
60
30