REPORTS
Fresh threat intelligence we ingest from public vendor and research feeds — each report linked to its original source. Search, filter by source, and open the reference.
Reports
Newest first. Search, filter by source, open the original.
850 reports · page 21 of 22
arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Portable Agent Memory: A Protocol for Cryptographically-Verified Memory Transfer Across Heterogeneous AI Agents arXiv:2605.11032v1 Announce Type: new Abstract: We present Portable Agent Memory, an open protocol and reference implementation for transferring persistent memory state across heterogeneous AI agents. Modern AI agents accumulate rich context -- episodic events,semantic knowledge, procedural skills, working state, and identity preferences -- but this context remains…
Read original ↗https://arxiv.org/abs/2605.11032arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Digital Identity for Agentic Systems: Toward a Portable Authorization Standard for Autonomous Agents arXiv:2605.11487v1 Announce Type: new Abstract: Enterprise AI is shifting from copilots to autonomous agents capable of executing workflows, negotiating outcomes, and making decisions with limited human oversight. As these systems extend across organizational boundaries, identity alone is insufficient: an agent's authority must also be explicit, constrained, auditable, revoca…
arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Can a Single Message Paralyze the AI Infrastructure? The Rise of AbO-DDoS Attacks through Targeted Mobius Injection arXiv:2605.11442v1 Announce Type: new Abstract: Large Language Model (LLM) agents have emerged as key intermediaries, orchestrating complex interactions between human users and a wide range of digital services and LLM infrastructures. While prior research has extensively examined the security of LLMs and agents in isolation, the systemic risk of the agent actin…
Read original ↗https://arxiv.org/abs/2605.11442arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization arXiv:2605.11360v1 Announce Type: new Abstract: As Model Context Protocol adoption grows, securing tool invocations via meaningful user consent has become a critical challenge, as existing methods, broad always allow toggles or opaque LLM-based decisions, fail to account for dangerous call arguments and often lead to consent fatigue. In this work, we present Conleash, a client-side middleware that e…
Read original ↗https://arxiv.org/abs/2605.11360arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
A Systematic Security Testing Approach for InterUSS-based environments arXiv:2605.11339v1 Announce Type: new Abstract: Unmanned Traffic Management (UTM) federated ecosystems, such as InterUSS, enable secure coordination among UAS Service Suppliers (USSs). However, they bring up some security challenges at the infrastructure level that haven't been fully explored. This paper presents a security testing approach for InterUSS-based environments from the maintainer's perspective…
Read original ↗https://arxiv.org/abs/2605.11339arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Context-Aware Spear Phishing: Generative AI-Enabled Attacks Against Individuals via Public Social Media Data arXiv:2605.11268v1 Announce Type: new Abstract: We demonstrate how publicly available social-media data and generative AI (GenAI) can be misused to automate and scale highly personalized, context-aware spear-phishing campaigns. With minimal attacker effort, a small amount of public activity per target is sufficient for GenAI models to extract interests and contextual …
Read original ↗https://arxiv.org/abs/2605.11268arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution arXiv:2605.11229v1 Announce Type: new Abstract: Automation platforms such as GitHub Actions and n8n are increasingly adopting so-called agentic workflows, which integrate Large Language Model (LLM) agents for tasks such as code review and data synchronization. While bringing convenience for developers, this integration exposes a new risk: An adversary may control and craft certain inputs, such as…
Read original ↗https://arxiv.org/abs/2605.11229arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Continuous Discovery of Vulnerabilities in LLM Serving Systems with Fuzzing arXiv:2605.11202v1 Announce Type: new Abstract: LLM inference and serving systems have become security-critical infrastructure; however, many of their most concerning failures arise from the serving layer rather than from model behavior alone. Modern inference engines combine KV cache, batching, prefix sharing, speculative decoding, adapters, and multi-tenant scheduling, creating shared-state behavio…
Read original ↗https://arxiv.org/abs/2605.11202arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Adversarial SQL Injection Generation with LLM-Based Architectures arXiv:2605.11188v1 Announce Type: new Abstract: SQL injection (SQLi) attacks are still one of the serious attacks ranked in the Open Worldwide Application Security Project (OWASP) Top 10 threats. Today, with advances in Artificial Intelligence (AI), especially in Large Language Models (LLMs), an opportunity has been created for automating adversarial attack tests to measure the defense mechanisms. In this pape…
Read original ↗https://arxiv.org/abs/2605.11188arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Benchmarking LLM-Based Static Analysis for Secure Smart Contract Development: Reliability, Limitations, and Potential Hybrid Solutions arXiv:2605.11163v1 Announce Type: new Abstract: The irreversible nature of blockchain transactions makes the identification of smart contract vulnerabilities an essential requirement for secure system development. While Large Language Models (LLMs) are increasingly integrated into developer workflows, their reliability as autonomous security …
Read original ↗https://arxiv.org/abs/2605.11163arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement arXiv:2605.11122v1 Announce Type: new Abstract: Federated Learning remains highly susceptible to backdoor attacks--malicious clients inject targeted behaviours into the global model. Existing defenses suffer from substantial false-positive rates under realistic non-independent and identically distributed (non-IID) data, incorrectly flagging benign clients and degrading model …
Read original ↗https://arxiv.org/abs/2605.11122arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? arXiv:2605.11086v1 Announce Type: new Abstract: AI agents are rapidly gaining capabilities that could significantly reshape cybersecurity, making rigorous evaluation urgent. A critical capability is exploitation: turning a vulnerability, which is not yet an attack, into a concrete security impact, such as unauthorized file access or code execution. Exploitation is a particularly challenging task becau…
Read original ↗https://arxiv.org/abs/2605.11086arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
MCPShield: Content-Aware Attack Detection for LLM Agent Tool-Call Traffic arXiv:2605.11053v1 Announce Type: new Abstract: The Model Context Protocol (MCP) has become a widely adopted interface for LLM agents to invoke external tools, yet learned monitoring of MCP tool-call traffic remains underexplored. In this article, MCPShield is presented as an attack detection framework for MCP tool-call traffic that encodes each agent session as a graph (tool calls as nodes, sequential…
Read original ↗https://arxiv.org/abs/2605.11053arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClaw arXiv:2605.11047v1 Announce Type: new Abstract: Agentic language-model systems increasingly rely on mutable execution contexts, including files, memory, tools, skills, and auxiliary artifacts, creating security risks beyond explicit user prompts. This paper presents DeepTrap, an automated framework for discovering contextual vulnerabilities in OpenClaw. DeepTrap formulates adversarial context ma…
Read original ↗https://arxiv.org/abs/2605.11047arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
A Multi-Interface Firmware Acquisition and Validation Methodology for Low-Cost Consumer Drones: A Case Study on Three Holy Stone Platforms arXiv:2605.11040v1 Announce Type: new Abstract: Consumer unmanned aerial vehicles (UAVs) have evolved into capable computing platforms, yet their embedded firmware remains largely inaccessible to the security community. Entry-level models, in particular those marketed to first-time and younger operators, commonly ship with limited protect…
Read original ↗https://arxiv.org/abs/2605.11040arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck arXiv:2605.11039v1 Announce Type: new Abstract: Tool-using LLM agents must act on untrusted webpages, emails, files, and API outputs while issuing privileged tool calls. Existing defenses often mediate trust at the granularity of an entire tool invocation, forcing a brittle choice in mixed-trust workflows: allow external content to influence a ca…
Read original ↗https://arxiv.org/abs/2605.11039arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Sequential Behavioral Watermarking for LLM Agents arXiv:2605.11036v1 Announce Type: new Abstract: LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them, making provenance, ownership, and unauthorized reuse difficult to establish from observed behavior alone. This motivates watermarking signals embedded directly into agent behavior rather than only into generated text, since text w…
Read original ↗https://arxiv.org/abs/2605.11036arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining arXiv:2605.11034v1 Announce Type: new Abstract: We present MambaNetBurst, a compact tokenizer-free byte-level sequence classifier for network burst classification based on a Mamba-2 backbone. In contrast to most recent strong traffic-classification and intrusion-detection approaches, our method operates directly on raw packet bytes, avoids tokenization, patching, and heavy eng…
Read original ↗https://arxiv.org/abs/2605.11034arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
FragBench: Cross-Session Attacks Hidden in Benign-Looking Fragments arXiv:2605.11029v1 Announce Type: new Abstract: An attacker can split a malicious goal into sub-prompts that each look benign on their own and only become harmful in combination. Existing LLM safety benchmarks evaluate prompts one at a time, or across turns of a single chat, and so do not look for a malicious signal spread across separate sessions with no shared context. We build FragBench, a benchmark drawn…
Read original ↗https://arxiv.org/abs/2605.11029arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents arXiv:2605.11026v1 Announce Type: new Abstract: Defenses against indirect prompt injection (IPI) in tool-using LLM agents share two structural weaknesses. First, they all attempt to prevent attacks rather than detect the compromises that slip through. Second, they have only been evaluated in English, leaving users of low-resource languages such as Kurdish and Arabic without tested protection. This pa…
Read original ↗https://arxiv.org/abs/2605.11026arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
DCVD: Dual-Channel Cross-Modal Fusion for Joint Vulnerability Detection and Localization arXiv:2605.11015v1 Announce Type: new Abstract: Software vulnerability detection plays a critical role in ensuring system security, where real-world auditing requires not only determining whether a function is vulnerable but also pinpointing the specific lines responsible. However, existing approaches either rely on a single information source -- sequential, structural, or semantic -- fa…
Read original ↗https://arxiv.org/abs/2605.11015arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
The Authorization-Execution Gap Is a Major Safety and Security Problem in Open-World Agents arXiv:2605.11003v1 Announce Type: new Abstract: This position paper argues that the Authorization-Execution Gap (AEG) is a major safety and security problem in open-world agents. The AEG is the divergence between what a principal intends to authorize and what an open-world agent ultimately executes. Because such agents act autonomously across tools, persistent state, and multi-agent h…
Read original ↗https://arxiv.org/abs/2605.11003arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks arXiv:2605.11002v1 Announce Type: new Abstract: Multi-turn jailbreaks exploit the ability of large language models to accumulate and act on conversational context. Instead of stating a harmful request directly, an attacker can gradually steer the conversation toward an unsafe answer. Recent methods demonstrate this risk, but they are usually evaluated as black-box pipelines with different budget…
Read original ↗https://arxiv.org/abs/2605.11002arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs arXiv:2605.10998v1 Announce Type: new Abstract: Fine-tuning APIs make frontier LLMs easy to customize, but they can also weaken safety alignment during fine-tuning. While prior work shows that benign supervised fine-tuning (SFT) can reduce refusal behavior, deployed fine-tuning pipelines increasingly support preference-based objectives, whose safety risks remain less understood. We show that Direct Preference Optimizatio…
Read original ↗https://arxiv.org/abs/2605.10998arxiv_cs_cr · tlp:amber · 5/13/2026, 4:00:00 AM
PASA: A Principled Embedding-Space Watermarking Approach for LLM-Generated Text under Semantic-Invariant Attacks arXiv:2605.10977v1 Announce Type: new Abstract: Watermarking for large language models (LLMs) is a promising approach for detecting LLM-generated text and enabling responsible deployment. However, existing watermarking methods are often vulnerable to semantic-invariant attacks, such as paraphrasing. We propose PASA, a principled, robust, and distortion-free waterm…
Read original ↗https://arxiv.org/abs/2605.10977arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
A UEFI System with SPDM to Protect Against Unauthorized Device Connections arXiv:2605.06744v1 Announce Type: new Abstract: Attackers willing to compromise computing systems can use malicious peripherals as an attack vector, threatening users that cannot verify the hardware's authenticity. To address this problem, our work uses the Security Protocol and Data Model to propose a UEFI system capable of authenticating PCIe and USB devices trying to connect with it. We also develo…
Read original ↗https://arxiv.org/abs/2605.06744arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Asymmetric Phase Coding Audio Watermarking arXiv:2605.07241v1 Announce Type: new Abstract: The proliferation of deepfake audio challenges voice-based authentication systems; passive forensic detectors are sensitive to evolving generative models and to real-world channel distortions. We propose Asymmetric Phase Coding (APC), a training-free cryptographic signing layer for audio, designed as a compact and auditable provenance primitive that can stand alone or be stacked with l…
Read original ↗https://arxiv.org/abs/2605.07241arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Benchmarking Large Language Models for IoC Recovery under Adversarial Code Obfuscation and Encryption arXiv:2605.06910v1 Announce Type: new Abstract: Software obfuscation and encryption present persistent challenges for program comprehension and security analysis, particularly when adversaries conceal Indicators of Compromise (IoCs) such as IP addresses within source code. While Large Language Models (LLMs) have recently demonstrated remarkable progress in code reasoning and…
Read original ↗https://arxiv.org/abs/2605.06910arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
TUANDROMD-X: Advanced Entropy and Visual Analytics Dataset for Enhanced Malware Detection and Classification arXiv:2605.06718v1 Announce Type: new Abstract: Malware and malware-based attacks are becoming more prevalent and complex. Attackers regularly come up with new techniques that have the ability to evade conventional and signature-based malware defense. In order to address such threats, there is an increasing demand for advanced and better defense solutions. Machine lea…
Read original ↗https://arxiv.org/abs/2605.06718arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
TENNOR: Trustworthy Execution for Neural Networks through Obliviousness and Retrievals arXiv:2605.07160v1 Announce Type: new Abstract: Training wide neural networks on sensitive data in untrusted cloud environments requires simultaneously achieving computational efficiency and rigorous privacy guarantees. Sparsification techniques, essential for scalable training of wide layers, expose input-dependent memory-access patterns (i.e., leakage) that are visible and can be exploit…
Read original ↗https://arxiv.org/abs/2605.07160arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
From Specification to Deployment: Empirical Evidence from a W3C VC + DID Trust Infrastructure for Autonomous Agents arXiv:2605.06738v1 Announce Type: new Abstract: Autonomous AI agents now transact at production scale -- 69,000 bots executing 165 million transactions across 50 million USDC in cumulative volume on a single marketplace -- without any shared trust layer between participants. Regulatory frameworks (Singapore IMDA, NIST CAISI, EU AI Act) and major AI laboratories…
Read original ↗https://arxiv.org/abs/2605.06738arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents arXiv:2605.06731v1 Announce Type: new Abstract: Personalized LLM agents maintain persistent cross-session state to support long-horizon collaboration. Yet, this persistence introduces a subtle but critical security vulnerability: routine user-agent interactions can gradually reshape an agent's long-term state, inadvertently weakening future confirmation boundaries, expanding tool-use d…
Read original ↗https://arxiv.org/abs/2605.06731arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions arXiv:2605.07135v1 Announce Type: new Abstract: GitHub Actions is increasingly used to deploy LLM-based agents for repository-centric tasks such as issue triage, pull-request review, code modification, and release assistance. These agentic workflows extend traditional CI/CD automation with agentic capabilities but also create a new injection surface. In this paper, we introduce Agentic Wo…
Read original ↗https://arxiv.org/abs/2605.07135arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Membership Inference Attacks on Vision-Language-Action Models arXiv:2605.07088v1 Announce Type: new Abstract: Membership inference attacks (MIAs) have been extensively studied in large language models (LLMs) and vision-language models (VLMs), yet their implications for vision-language-action (VLA) models remain largely unexplored. VLA models differ from standard LLMs and VLMs in several important ways: they are often fine-tuned for many epochs on relatively small embodied da…
Read original ↗https://arxiv.org/abs/2605.07088arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Evaluating Prompt Injection Defenses for Educational LLM Tutors: Security-Usability-Latency Trade-offs arXiv:2605.06669v1 Announce Type: new Abstract: Educational LLM tutors face a core AI alignment challenge: they must follow user intent while preserving pedagogical constraints and safety policies. We present an evaluation methodology for prompt-injection defenses in this setting, showing that guardrail design entails explicit trade-offs among adversarial robustness, benign…
Read original ↗https://arxiv.org/abs/2605.06669arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Beyond the Wrapper: Identifying Artifact Reliance in Static Malware Classifiers using TRUSTEE arXiv:2605.07034v1 Announce Type: new Abstract: Modern cybersecurity relies heavily on static machine-learning-based malware classifiers. However, transformations such as packing and other non-semantic modifications applied to executable files limit their reliability. Malware classifiers often learn these unnecessary artifacts rather than the true binary behavior because of the high…
Read original ↗https://arxiv.org/abs/2605.07034arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Pomegranate: A Lightweight Compartmentalization Architecture using Virtualization Extensions arXiv:2605.07008v1 Announce Type: new Abstract: The monolithic nature of widely used commodity operating systems means that vulnerabilities in one software component potentially compromise the entire kernel. Formally verifying these systems, or redesigning them altogether as microkernels, according to the principle of least privilege, requires significant effort. Researchers have the…
Read original ↗https://arxiv.org/abs/2605.07008arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Zombies in Alternate Realities: The Afterlife of Domain Names in DNS Integrations arXiv:2605.06880v1 Announce Type: new Abstract: DNS integrations leverage the discovery, trust, and uniqueness of the global Domain Name System with a linkage to another naming ecosystem, so the DNS name can help identify resources such as a cryptocurrency wallet or software component. While DNS ownership is verified at linkage creation, many ecosystems do not track subsequent DNS changes. The …
Read original ↗https://arxiv.org/abs/2605.06880arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
The Cost of Quantum Resistance: A Hash-Based Commit-Reveal Alternative for Minimizing Blockchain Infrastructure Overhead arXiv:2605.06853v1 Announce Type: new Abstract: The transition to post-quantum cryptography in blockchain systems such as Bitcoin and Ethereum is often framed as a purely cryptographic problem. In practice, it also presents significant economic and infrastructural challenges: in globally replicated networks, increases in transaction size and verification c…
Read original ↗https://arxiv.org/abs/2605.06853arxiv_cs_cr · tlp:amber · 5/11/2026, 4:00:00 AM
Agentic AI and the Industrialization of Cyber Offense: Forecast, Consequences, and Defensive Priorities for Enterprises and the Mittelstand arXiv:2605.06713v1 Announce Type: new Abstract: Agentic AI systems can plan, call tools, inspect code, interact with web applications, and coordinate multi-step workflows. These same capabilities change the economics of cyber offense. The central near-term risk is not that every low-skill criminal immediately becomes a frontier exploit r…
Read original ↗https://arxiv.org/abs/2605.06713