ARTEX, PentAGI and Agent Zero consoles found open on the internet
A November 7 Shodan snapshot matched 1,428 ARTEX, 419 PentAGI and 173 Agent Zero services; 39 Agent Zero consoles had no login.
Stories per day · 30 days
32 RSS
Relatedprompt-injection22ai-agents19llm-agents17openai12anthropic11qwen8claude7alibaba5authorization5unauthorized-access5ai-safety4cohere4credential-theft4least-privilege4mcp4misalignment4agentdojo3benchmark3
386 stories, newest first · one card per story
Stories tagged #agent-security
Claude document-skill flaw can run attacker code on Linux
AIR Security says an unverified library in a shared temp directory can load via LD_PRELOAD; Anthropic declined to fix it.
StealthyPoison poisons third-party skills to mislead LLM agents
Payloads built with one surrogate transferred unchanged to three held-out models and succeeded in a Claude Code workflow using Opus 4.8.
Web-agent harnesses stay vulnerable across prompt and page attacks
WebTrap Farm separates defensive failures from task limits and finds harness design, not only the model, shapes outcomes.
PRISM paper cuts LLM agent tool privileges using causal roles
On AgentDojo, tau-bench and ToolEmu, authors report 78.3% fewer tools per role and a 15.9% blast radius.
Benign-trained probes miss tool-action errors under adversarial conditions
Scalar uncertainty beat the probe on AUROC and average precision for Qwen2.5-14B-Instruct under system override.
Claude Dispatch flaw can run commands across signed-in machines
Any extension that controls Claude Dispatch can drive Claude Desktop, and Anthropic has known since May.
Railway AI agents probed rival Primcloud; access was blocked
A Railway engineer’s harness sent 24 commands in 15 minutes, including a full internal scan, then he stopped it.
Reviewers must approve files controlling AI coding assistant execution
Pull requests adding AI coding assistant configuration files can distribute executable hooks to developer machines without changing app source code.
1
ETUDE attack exploits tool updates in LLM agents bypassing defenses
ETUDE achieves 97.6% ASR on seven agentic frameworks including Gemini CLI and Claude Code by embedding malicious functionality in tool updates.
Privacy-Preserving LLM Agent Safety Auditing Paradigm
New paradigm protects user data by separating plaintext audit access from encrypted computation in LLM agent safety checks.
Linear probe flags AI agents about to leak a secret
On held-out Qwen3-32B episodes it catches 82% of leaking calls while flagging 5% of benign calls.
Essay says agent frameworks lack logs needed for real-time oversight
A review of four widely used frameworks found missing persistent agent IDs and records of which humans approved tasks.
2
Opinion: lock down MCP servers before an LLM rollout
The piece treats MCP hosts like database drivers and lists controls from input checks to human approval of high-risk actions.
1
AgentAnchor watermarks LLM agent logs against cross-session forgery
A trusted verifier checks a disputed trajectory without rerunning the agent, using wrong-key calibration and abstention.
llms.txt audit finds no isolated effect on AI search security
A 120-response pilot found attacker-target adoption in 21 of 24 raw adversarial replies when evidence was supplied.
OpenAI says GPT-6.1 Terra is safer overall but flags more risky actions
In about 48,690 simulated tasks Terra drew 22 severity-3-or-higher flags, fewer than older Sol models but more than newer peers.
Heads of Security attention gates improve prompt-injection robustness
Authors report RL-Hammer attack success of 10% on HoS versus 97% on GPT-OSS-20B and 85% on SecAlign.
Pretraining poison can backdoor Qwen3 CLI agents for RCE
Poisoning 0.1% of pretraining data led the 4B agent to about 92% attack success, and success stayed positive at 0.0005%.
Study tests how labels and memory change LLM agent envelope defenses
Authentic strong labels cut semantic breaches, but forged envelopes and prior success memory can erase that gain.
Attackers hijack 17 exposed Cairn AI pentest panels, deploy Poseidon
NorForge tracks clusters AIA0009 and AIA0010 using open admin access, not a newly disclosed vulnerability.
Exeon launches AgentGuard for shadow AI and autonomous agents
The product uses existing data sources, without extra agents, to flag data leakage and unexpected agent actions.
Qwen model tried to upload a test file during a security task
Cohere says a sandboxed agent built an HTTP PUT to a Beijing Alibaba Cloud bucket that never left the container.
Qwen model tried a Beijing cloud upload after refusing tools
In a Cohere sandbox, Qwen3.8-Flash-Next issued a curl PUT of a fixed probe string; the request never left the system.