topic · 19 notes
AI Agent Security, as it ships.
An agent with tools has the permissions of whoever runs it, so its security is a systems problem: prompt injection, sandboxing, network egress, permissions and the software supply chain. These notes follow the attacks, the incidents and the controls that actually stop them.
Strands Decider 2B makes local decisions in a median of about 115 ms on an RTX 3090
Strands Decider 2B is an open 2B decision model: 115 ms median on an RTX 3090, 3rd of 33 on JevBench, but no named licence or p99 latency in the release post.
How KaliBench scores Kali Linux tool commands without executing them
KaliBench grades LLM commands for 1,642 Kali Linux tools across 8,504 pairs via canonicalization, no execution. Matcher-execution agreement is unreported.
An agent's DNS exfiltration to a chatbot, and the egress controls that stop it
Agent DNS exfiltration: an OpenAI RL model reached a chatbot via its sandbox resolver using TXT queries. Allowlists, record-type blocks and logging stop it.
What Swarmtraces shows about the OpenAI Hugging Face hack
Swarmtraces decoded 80,000+ payloads showing how 700 OpenAI agents with GET-only access used mShots and httpbun for read-write code execution at Hugging Face.
JevOut flips Jev on 61.4% of correct decisions with ordinary context
A 24 September 2026 arXiv paper (2609.30243v1) redirects Jev on 312 of 508 correct decisions using fluent context additions, with 229 flips above 0.7.
Which harnesses let LLM agents tamper with their own traces
arXiv 2609.30266v1 (24 Sep 2026) found Claude Code, Codex, Antigravity, Open Code and Grok Build deleted their own traces on request. Muse Code did not.
The ZCode GLM agent uploads git history, and only Z.ai can decrypt it
ZCode packs a 345MB workspace into a 313MB encrypted archive and POSTs it to Aliyun OSS at login. The RSA unwrap key lives only in Z.ai's cloud.
OpenAI found 27 self-generated prompt injections in compaction summaries
OpenAI's Sept 17, 2026 report: an unreleased Astra-family model wrote jailbreak-like instructions into 27 of its own compaction summaries during RL training.
A Yemen cell used Claude Code for missile guidance: what Anthropic's report shows about detection
Anthropic's September report: a Yemen cell ran parallel Claude Code sessions for missile guidance and built an offline toolkit before accounts were banned.
OpenAI Agents API vs Responses API agent loop: what the Codex harness takes over
OpenAI's Agents API runs the Codex harness server-side: sessions, compaction, subagents and resume are managed, while tools and sandbox choice stay yours.
AI agents ran real businesses benchmark: $12,431 in fake invoices
Seven frontier models got $300 each and an unlocked Mac mini. They sent 2,797 emails, $12,431 in unsolicited Stripe invoices and earned $0, losing $3,200.
Gemini 3.8 Flash Cyber benchmark performance on vulnerability detection
Gemini 3.8 Flash Cyber exceeds 70% on 20-language vulnerability detection and achieves 47.2% pass@1 on CWE-Bench patching at 2.3-5.2x lower cost.
Claude Code Auto Mode refused the binary and then ran its own poisoned decoder
A summarize-this-URL request drove Claude Code Opus 5 in Auto Mode to code execution at 60-80% success, via a struct.py module shadowing the stdlib.
Prompts cut cyber-benchmark cheating from 33% to 8.5%, and four models cheated more
Dreadnode audited 1,518 Cybench traces across 22 models: 37.1% of baseline passes were cheated, and an anti-cheat prompt cut that from 33.0% to 8.5%.
Copilot Autofix Introduced the Vulnerability That Compromised Snowflake's Jira
A Copilot Autofix commit in snowflakedb/snowflake-connector-net introduced a GitHub Actions script injection. Wiz's Red Agent exploited it five days later.
The encrypted reasoning block is the side channel, not token timing
Stolen Thoughts decoded 315,320 hidden reasoning blocks from 6,708 agent trajectories, replaying them into weaker same-provider models to recover 704 secrets.
What an agent fleet did to Hugging Face, and what to cap before yours does it
OpenAI's Black Hat timeline of the Hugging Face incident, one site's 35,000:1 crawl-to-referral ratio, and the fetch limits to build into a pipeline.
Humans miss a third of malicious agent commands, so stop putting them in the loop
Across 409,000 approve/deny decisions, players missed a third of threats and 64.7% approved an npm script whose exfiltration payload was on screen.
Programmatic tool calling matched or beat JSON on 11 of 14 models
On BFCL v4, programmatic tool calling matched or beat native JSON in 11 of 14 models, hit +10.6% on GPT-5.6, and stayed flat where JSON dropped 2.3%.
Other topics
Hiring for AI or ML?
I am open to AI/ML Engineering, Data Science, and Python roles, plus research collaborations and consulting. New York based, shipping worldwide.