Apache Airflow CLI masking misses Variable values and --conn-extra (CVE-2026-86468)
CLI argument masking by position leaves secrets like --conn-extra and Variable descriptions in cleartext audit logs.
Stories per day · 30 days
2 RSS
Relatedai-agents1airflow1certification1cli1code-generation1compliance1grc1insecure-code1llm-agents1llm-security1optro1prompt-injection1secrets1security-hallucinations1side-channel1sox1tprm1
22 stories, newest first · one card per story
Stories tagged #audit
Paper: LLM audit certificates fail if agents see the coin
Worst-case bias is (1-ε) times view distance, and raising the audit rate does not restore validity.
SPLASH localizes insecure statements in LLM-generated code without training
Across 63,684 programs from 12 models, it selected secure code in 74% of cases and ranked the vulnerable statement first 58% of the time.
Optro automates GRC workflows with auditable AI agents
Optro launched auditable AI agents that automate GRC testing, scoring, compliance, and vendor assessments.
Two AI-assisted research repos leave incomplete Git provenance
Co-Authored-By marked 66 of 121 AI-related commits in one repo and 1 of 39 agent-note commits in the other.
Evidence Coverage for Intent-Bound Execution: Scope, Obligations, and Cutoff Reasoning
Authors define a cutoff-based model that judges whether execution-evidence obligations are complete, incomplete, or unknown.
Generation Provenance Before Behavior Attribution: Auditing Synthetic Speech Research Objects
A provenance contract audits synthetic Japanese care-handoff speech before attributing behavior to training data.
Poster: Towards ProofWeave: A Privacy-Minimised, Integrity-Anchored Evidence Plane for Continuous Agentic Assurance
ProofWeave poster proposes privacy-minimised, integrity-anchored evidence for continuous assurance of agentic AI actions.
Memory Is a Derivation: The Distributed-Evidence Paradox in Long-Term Agents
DerivAudit checks whether long-term agent memories are supported by the history available when written.
The EU spent billions on a cyberattack shield — nobody checked if it worked
EU auditors found the bloc's €1.4 billion cyberattack early-warning system is not fully operational and its effectiveness is unverified.
EU Auditors Warn Information-Sharing Gaps Are Hindering Cyber Incident Response
EU auditors criticize the bloc's cybersecurity strategy for critical information-sharing gaps hindering incident response.
1
Provisional Reachability: Containing Agents by Making Every Crossing Revocable
An escrow-and-audit scheme bounds how many bits an agent can move before a secret becomes unreachable.
The More It Says, the More You Pay: A Black-Box Audit of Provider-Side Token Inflation in LLM Services
Researchers define Provider-Side Token Inflation Attacks that inflate LLM output over 10x and release a single-probe audit detecting them with 85.1% accuracy.
Trust, but Validate the Instrument: Auditing AI-Generated RTL Verification Plans on Authored Security-Regression Proxies
Researchers release SecTB-RTL, an auditable framework showing that AI-generated RTL verification plans passing provider schema checks can still fail execution validity.
Beyond Private Training: The New Landscape of AI Privacy
TSD-AUDIT reveals graph-based vector indexes like Faiss HNSW still score deleted embeddings during search, exposing process-level privacy leaks beyond output-filtering audits.
“We Think the Security Control Is Working” Is No Longer Good Enough
Opinion piece argues CISOs must replace point-in-time, sampling-based audits with continuous control monitoring to prove controls work in real time.
1
CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
Apache Syncope patches a moderate SQL injection (CVE-2026-77051) in Audit Events search via unsanitized entityKey and opEvent inputs.
ModaLens: Measuring Image Sensitivity in Report-Conditioned Medical VLMs
ModaLens image-swap audit shows report availability cuts MedGemma-27B image sensitivity on MIMIC-CXR from 20.94% to 4.26% answer changes.
NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs
NovaFabric seals autonomous AI agent runs into tamper-evident, replayable Run Capsules enabling third-party audit under EU AI Act and ISO 42001.
An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment
Researchers propose an evidence claim model defining which trust and audit claims agentic AI systems can support, mapping claims to mechanisms, assumptions, and threats.
Bag of Tricks or Bag of Myths? Reducing Modeling Complexity with Task Knowledge in Explainable Suicide Risk Assessment
Researchers audit 31 NLP techniques for clinician-annotated suicide risk prediction, finding only 5 of 31 comparisons yield reliable gains.
IAM Compliance Requirements and Best Practices
A guide maps IAM compliance requirements across SOX, PCI DSS, HIPAA, ISO 27001 and NIST 800-53, urging verified enforcement over documented policies.
1