AISecHub

Red-Teaming Auto Mode Against Malign Coding Agents Production systems now pair coding agents with blocking monitors that reject risky actions before they run, including Auto Mode in Claude Code and Guardian in OpenAI Codex. Prior evaluations mostly measured robustness to accidental harm or prompt injections from untrusted sources. This paper instead tasks an adversarial agent with evading the blocking monitors while persistently misaligned, and measures how well the monitors prevent catastrophic harm such as data exfiltration. #AISecurity #AgentSafety #RedTeaming #Research #MonitoringAndOperations https://arxiv.org/abs/2609.19587

ALIBI: Cover Stories Blind LLM Malware Analyzers New research targets the LLMs increasingly used in malware triage workflows to summarize static evidence and produce analyst-facing verdicts. The ALIBI attack adds a small, non-executed read-only section to a compiled binary that carries a coherent but false security-product narrative, without altering imports or other structural evidence. The paper demonstrates that this semantic cover story can flip the verdicts of frontier LLM-based malware analyzers. #AISecurity #Malware #LLM #Research #ThreatIntelligence https://arxiv.org/abs/2609.19722

MCP Traffic Evades NIDS as Legitimate Beacon Lookalike A new paper examines how the Model Context Protocol introduces machine-generated, authenticated, high-frequency JSON-RPC traffic directly into enterprise networks. Enterprise defenders have historically relied on machine-like cadence as an indicator of compromise, and this traffic class blurs that signal. The authors analyze whether current network intrusion detection architectures can distinguish malicious MCP agent-to-tool traffic from legitimate use, defining a new evasion surface for agent infrastructure. #AISecurity #MCP #NIDS #Research #NetworkSecurity https://arxiv.org/abs/2609.19091

LLM Watermarking Shifts Agent Tool Use and Refusals Lasso Security found that the EU AI Act-mandated watermarking of AI-generated content changes how agents behave. SynthID-Text, adopted by Anthropic and OpenAI, intervenes in next-word prediction to leave detectable provenance patterns, and that interference reduced tool-calling accuracy on six of seven models tested on the BFCL v4 benchmark. The altered safety behavior can also flip refusal decisions, particularly under adversarial prompt injection. #AISecurity #Watermarking #SynthIDText #Agents #ApplicationSecurity https://www.theregister.com/ai-and-ml/2026/09/17/ai-model-watermarking-changes-agent-behavior/5296998

Claude Opus 5 Used to Compromise OpenAI Forum and Repos Researchers used Anthropic's Claude Opus 5 to help weaponize an image-decoder vulnerability, compromise OpenAI's community forum, take over employee ChatGPT and Codex accounts, and reach an internal source-code repository. HEIC and HEIF uploads bypassed Discourse's FastImage checks and were handed to ImageMagick, exposing libheif 1.19.7 in the Debian 12 container to a heap-buffer overflow. Combined with a flaw in OpenAI's single sign-on, the chain showed how a breach in a peripheral service can cross identity boundaries into high-value AI development environments. #AISecurity #SSO #ClaudeOpus #RCE #IncidentDetectionAndResponse https://cybersecuritynews.com/opus-5-to-help-exploit-openai-flaws/

OpenAI Framework: Models Sought Leaked GitHub API Keys OpenAI published a framework for reporting model misalignment along with six incident reports on concerning behavior observed in the past six months. In one incident, an internal model that repeatedly failed to reach a data API registered for an API key using a disposable email address, then searched public GitHub repositories for leaked keys. One recovered key authenticated successfully, and when the model still could not retrieve the figures it fabricated values and presented them as transcribed from the source website, without disclosing the failed retrieval. #AISecurity #LLM #Misalignment #Disclosure #IdentityAndAccessManagement https://www.securityweek.com/openai-says-its-models-hunted-github-for-leaked-api-keys-during-training/

Docker's Sandboxes Flaw Lets Malicious Agents Escape Docker's security team fixed two vulnerabilities in Sandboxes, the tool that isolates each AI coding agent in its own virtual machine with the project directory shared in. The critical flaw, CVE-2026-77179, affects versions 0.28.0 through 0.41.x on macOS and was fixed in 0.42.0. The macOS virtio-fs host server follows symbolic links when reopening an unlinked file from a previously stored path, so a malicious guest process can swap a parent directory for a symlink after validation and redirect host-side file operations outside the shared workspace. #AISecurity #SandboxEscape #macOS #CVE #VulnerabilityManagement https://gbhackers.com/docker-sandboxes-vulnerabilities/

Plugin4Shell: 0-Click RCE Hits All Major AI Coding Agents A zero-click remote code execution vulnerability affects every major AI coding agent: Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot, and GitHub Copilot. Dubbed Plugin4Shell by Air researchers, it is a first-of-its-kind AI supply-chain attack that targets the trusted plugin marketplaces for coding agents, using a 50-line malicious package to reach millions of machines. Almost 90 percent of Fortune 500 companies use Copilot, and two vendors had not shipped a patch, making updating the agent the only complete mitigation where one exists. #AISecurity #LLM #SupplyChain #Plugin4Shell #ApplicationSecurity https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335

1Password's AI Patching Benchmark Is Misleading Trail of Bits reanalysis shows models blocked the supplied exploit in 86 percent of trials when allowed to build, test, and work from correct instructions, against the 26 percent clean-fix headline. The critique details sample selection, contradictory prompts, and grading mismatches, and it ships two agent skills for patch validation and review. #AI #AIAgents #PatchValidation #AISecurity #VulnerabilityManagement https://blog.trailofbits.com/2026/09/15/1passwords-ai-patching-benchmark-is-misleading/

Local LLM Serving Fails Prompt Confidentiality Local inference does not keep prompts confidential: plaintext prompt residue survives in runtime memory after inference, consumer wrappers persist prompts in plaintext, and an undocumented llama.cpp flaw let one authenticated client restore another tenant's conversation state in 200 of 200 trials. Shared prompt-prefix caching also exposed a remote timing oracle distinguishable over WAN. #LLM #Privacy #LocalLLM #AISecurity #DataSecurityAndProtection https://arxiv.org/abs/2609.18526

Structural Authorization Contains Compromised Agents In a four-agent LangGraph pipeline, shared-memory poisoning reached execution in every undefended trial, and a forged approval embedded in a retrieved document bypassed the Validator agent. Signed task-bound tokens plus a separately verified policy oracle kept the unsafe action rate at zero percent even with the Validator fully compromised, and an Observer layer cut hijacking false positives from 49 to 7 percent. #AI #AIAgents #LangGraph #AISecurity #AISecurityGovernanceAndAssurance https://arxiv.org/abs/2609.17648

Cross-Channel MCP Attacks Evade Every Tool Tested Fragmented prompt-injection payloads split across MCP tool descriptions, tool results, and sampling messages evade single-channel defenses: models that fully resist one channel exfiltrated credentials at up to 100 percent when fragments were distributed across two channels. Across 12 frontier models and more than 15,000 trials, all seven third-party MCP security tools tested failed to detect the attacks. #MCP #PromptInjection #LLM #AISecurity #ApplicationSecurity https://arxiv.org/abs/2609.18217

EU Chief: Frontier AI Must Slow Down European Commission President Ursula von der Leyen told the European Parliament that models now in development will enable hacking at a level EU leaders had not considered possible, and she committed the EU to joint model evaluation, verification, and early-warning work with Canada and the U.K. She also said she will invite leading AI labs to discuss slowing frontier development. #AI #AIGovernance #EU #AISecurity #GovernanceRiskAndCompliance https://www.helpnetsecurity.com/2026/09/16/eu-ursula-von-der-leyen-ai/