Fabian Mosch writes about how fine-tuning open-weight LLMs allows attackers to embed backdoors directly into model weights via QLoRA, rendering them invisible to traditional antivirus or loader scanners. These malicious models can insert payloads into generated code snippets or trigger direct command execution when integrated with agentic coding assistants.
- Maliciously modified weights bypass YARA rules and EDR detection because they appear as standard tensor files rather than suspicious binaries.
- Certain backdoors only activate within specific context windows, such as the inclusion of tool definitions in a system prompt.
- Some agentic environments may execute injected shell commands without requiring explicit user permission or special safety flags.
- Maliciously modified weights bypass YARA rules and EDR detection because they appear as standard tensor files rather than suspicious binaries.
- Certain backdoors only activate within specific context windows, such as the inclusion of tool definitions in a system prompt.
- Some agentic environments may execute injected shell commands without requiring explicit user permission or special safety flags.
@0xabad1dea@infosec.exchange writes about an incident where AI-assisted mathematical proofs appear to exploit bugs in theorem provers, specifically highlighting a case involving the Collatz conjecture and Lean 4. The discussion explores whether large language models are inadvertently discovering software vulnerabilities through pattern matching or learning from existing technical discussions about those bugs, while broader debates address the inherent limitations of formal verification when facing hardware faults, modeling errors, and human mistakes in specifications.
Cloudflare shares insights from testing Mythos Preview, a security-focused LLM from Anthropic, as part of Project Glasswing. The article explores how these frontier models differ from general coding agents by demonstrating advanced capabilities in exploit chain construction and proof generation. It also addresses challenges such as inconsistent model refusals, high noise rates in vulnerability scanning, and the limitations of single-stream AI agents for deep codebase analysis. To overcome these, Cloudflare details a multi-stage discovery harness designed to improve coverage and reduce false positives through specialized agent roles like recon, hunting, validation, and tracing.
* Capabilities of Mythos Preview in exploit reasoning and proof generation
* Challenges with model guardrails and signal-to-noise ratios
* Why generic coding agents fail at large-scale vulnerability research
* The architecture of a multi-agent security discovery harness
* Shifting focus from patching speed to architectural resilience
* Capabilities of Mythos Preview in exploit reasoning and proof generation
* Challenges with model guardrails and signal-to-noise ratios
* Why generic coding agents fail at large-scale vulnerability research
* The architecture of a multi-agent security discovery harness
* Shifting focus from patching speed to architectural resilience
Researchers from Google and Forcepoint have identified a rise in indirect prompt injection (IPI) attacks, where malicious instructions are hidden within web pages to manipulate LLM-powered AI agents. While some injections are harmless pranks or tone adjustments, others aim for serious harm including traffic hijacking, data exfiltration, denial of service, and financial fraud through unauthorized payment processing. Attackers use techniques like invisible text, HTML comments, and metadata manipulation to hide these payloads from humans while remaining visible to AI.
Key points:
* Real-world evidence of IPI attacks found in massive web crawls and active threat hunting.
* Malicious intents include search engine manipulation, data theft (API keys), and destructive commands.
* Financial fraud attempts have been observed using embedded PayPal transactions and Stripe donation routing.
* Attackers hide instructions via single-pixel text, near-transparent colors, or metadata injection.
* The risk level scales with AI privilege; agentic AIs capable of executing commands or payments are high-impact targets.
Key points:
* Real-world evidence of IPI attacks found in massive web crawls and active threat hunting.
* Malicious intents include search engine manipulation, data theft (API keys), and destructive commands.
* Financial fraud attempts have been observed using embedded PayPal transactions and Stripe donation routing.
* Attackers hide instructions via single-pixel text, near-transparent colors, or metadata injection.
* The risk level scales with AI privilege; agentic AIs capable of executing commands or payments are high-impact targets.
Researchers have identified a significant security flaw in Anthropic's Model Context Protocol, which is designed to connect Large Language Models with external tools. The protocol's architecture allows for remote command execution because the parameters used to create server instances can contain arbitrary commands that are executed in a server-side shell without proper input sanitization. This vulnerability has been demonstrated on platforms like LettaAI, LangFlow, Flowise, and Windsurf. When researchers brought these findings to Anthropic, the company responded that there was no design flaw and stated it is the developer's responsibility to implement sanitization.
Key points:
- MCP architecture facilitates remote command execution (RCE) via StdioServerParameters.
- Lack of input sanitization allows arbitrary commands and arguments in server-side shells.
- Exploitation has been successful against LettaAI, LangFlow, Flowise, and Windsurf.
- Anthropic maintains the protocol works as designed, placing responsibility on developers for security implementation.
Key points:
- MCP architecture facilitates remote command execution (RCE) via StdioServerParameters.
- Lack of input sanitization allows arbitrary commands and arguments in server-side shells.
- Exploitation has been successful against LettaAI, LangFlow, Flowise, and Windsurf.
- Anthropic maintains the protocol works as designed, placing responsibility on developers for security implementation.
ZeroID is a new open-source identity and credentialing platform designed specifically to address the attribution challenges in agentic workflows. It provides a verifiable delegation chain using RFC 8693 token exchange, ensuring that when orchestrator agents spawn sub-agents, every action remains traceable back to the original authorizing principal while maintaining strict permission boundaries.
Key features and details:
- Implements verifiable delegation chains for multi-agent systems
- Supports real-time revocation via OpenID Shared Signals Framework (SSF) and CAEP
- Offers SDKs for Python, TypeScript, and Rust
- Integrates with frameworks like LangGraph, CrewAI, and Strands
- Provides a containerized deployment model backed by PostgreSQL
Key features and details:
- Implements verifiable delegation chains for multi-agent systems
- Supports real-time revocation via OpenID Shared Signals Framework (SSF) and CAEP
- Offers SDKs for Python, TypeScript, and Rust
- Integrates with frameworks like LangGraph, CrewAI, and Strands
- Provides a containerized deployment model backed by PostgreSQL
This article details a hands-on experience with Nvidia's NemoClaw, a security-focused stack designed to enhance the safety of the OpenClaw AI platform. While NemoClaw introduces improvements like a sandbox model and aggressive policy filtering, the author finds it still falls short of being a reliable solution.
Bugs, limitations, and the inherent risks associated with OpenClaw's architecture—particularly its connection to external services—persist. The core issue remains that NemoClaw can secure the agent but cannot protect against malicious instructions embedded in external data sources like emails or messages.
The author concludes that while NemoClaw is a step forward, it doesn't fully address the fundamental security concerns surrounding OpenClaw.
Bugs, limitations, and the inherent risks associated with OpenClaw's architecture—particularly its connection to external services—persist. The core issue remains that NemoClaw can secure the agent but cannot protect against malicious instructions embedded in external data sources like emails or messages.
The author concludes that while NemoClaw is a step forward, it doesn't fully address the fundamental security concerns surrounding OpenClaw.
A malicious release of litellm version 1.82.8 was published to PyPI on March 24, 2026.
The package contains a hidden .pth file that executes on every Python interpreter startup, spawning a subprocess that triggers the same .pth again, creating an exponential fork bomb.
The malware harvests credentials (SSH keys, cloud provider tokens, Kubernetes configs, environment variables, etc.), encrypts them with a hard‑coded RSA key, and exfiltrates them to a malicious domain.
The package contains a hidden .pth file that executes on every Python interpreter startup, spawning a subprocess that triggers the same .pth again, creating an exponential fork bomb.
The malware harvests credentials (SSH keys, cloud provider tokens, Kubernetes configs, environment variables, etc.), encrypts them with a hard‑coded RSA key, and exfiltrates them to a malicious domain.
Three vendors – Cohesity, ServiceNow, and Datadog – have partnered to create a recoverability service designed to address the risks associated with agentic AI (AIOps). The service aims to restore systems to a "trusted state" by identifying and recovering files and data corrupted by AI errors or malicious attacks.
The companies anticipate increased adoption of agentic AI for system operation but recognize the potential for errors and vulnerabilities. Their solution focuses on preserving immutable snapshots of AI environments, enabling point-in-time recovery of agents, data, and infrastructure components, including vector stores and agent memory.
ServiceNow and Datadog provide control and observability platforms to detect anomalies, triggering API-driven restorations when problems are identified. This offering competes with Rubrik's similar tool and native rollback capabilities from vendors like Cisco. Gartner predicts a significant increase in the integration of task-specific agents in enterprise applications, while Forrester emphasizes the need for guardrails and strong oversight in agentic AI development.
The companies anticipate increased adoption of agentic AI for system operation but recognize the potential for errors and vulnerabilities. Their solution focuses on preserving immutable snapshots of AI environments, enabling point-in-time recovery of agents, data, and infrastructure components, including vector stores and agent memory.
ServiceNow and Datadog provide control and observability platforms to detect anomalies, triggering API-driven restorations when problems are identified. This offering competes with Rubrik's similar tool and native rollback capabilities from vendors like Cisco. Gartner predicts a significant increase in the integration of task-specific agents in enterprise applications, while Forrester emphasizes the need for guardrails and strong oversight in agentic AI development.
AI agents are increasingly deployed to execute important tasks. While rising accuracy scores on standard benchmarks suggest rapid progress, many agents still continue to fail in practice. This discrepancy highlights a fundamental limitation of current evaluations: compressing agent behavior into a single success metric obscures critical operational flaws. Notably, it ignores whether agents behave consistently across runs, withstand perturbations, fail predictably, or have bounded error severity.
Key contributions:
> 1. A formal taxonomy and metric suite: We translate qualitative safety-critical principles into computable metrics, enabling evaluation of agent reliability independently of task success.
>2. A comprehensive reliability profile of modern agents: A detailed mapping of where state-of-the-art agentic models succeed and fail, isolating consistency and predictability as the dimensions requiring immediate research focus.
Key contributions:
> 1. A formal taxonomy and metric suite: We translate qualitative safety-critical principles into computable metrics, enabling evaluation of agent reliability independently of task success.
>2. A comprehensive reliability profile of modern agents: A detailed mapping of where state-of-the-art agentic models succeed and fail, isolating consistency and predictability as the dimensions requiring immediate research focus.
