Current AI security news, vulnerabilities and research
The disruption of the Tycoon2FA phishing platform in mid-2026 has significantly altered attack vectors, forcing threat actors to pivot toward Teams-based social engineering while employing more automated multi-stage chains.
A recent collaboration between OpenAI and Hugging Face highlights the critical need for robust defensive measures when evaluating large language models, revealing advanced cyber capabilities that can compromise AI systems.
The Microsoft Security Blog introduces Project Perception, marking a paradigm shift from traditional perimeter-based security to dynamic trust frameworks designed specifically for complex agentic systems and Large Language Models (LLMs). The article emphasizes the necessity of redefining Trust Boundaries within intricate Tool Call chains.
10 results
The Microsoft Security Blog introduces Project Perception, marking a paradigm shift from traditional perimeter-based security to dynamic trust frameworks designed specifically for complex agentic systems and Large Language Models (LLMs). The article emphasizes the necessity of redefining Trust Boundaries within intricate Tool Call chains.
This paper identifies a new attack vector scenario called 'Denial of Deadline', where targeted workload bursts push the latency limit for the slow, high-accuracy inference path beyond its deadline. This causes high-quality predictions to be discarded and drastically reduces overall system utility.
This edition summarizes key developments in AI security. The focus is on a shift in phishing tactics toward Teams-based social engineering and a new partnership between OpenAI and Hugging Face to improve safety standards during model evaluation.
The disruption of the Tycoon2FA phishing platform in mid-2026 has significantly altered attack vectors, forcing threat actors to pivot toward Teams-based social engineering while employing more automated multi-stage chains.
A recent collaboration between OpenAI and Hugging Face highlights the critical need for robust defensive measures when evaluating large language models, revealing advanced cyber capabilities that can compromise AI systems.
This edition focuses on the evolution of red teaming methodologies and new definitions for threats in AI-enabled systems.
Security agent evaluations are often incomplete because they only measure peak offensive capability under generous inference budgets. In operational security, every reasoning step, tool call, or telemetry query consumes budget that limits actual success rates.
A vulnerability in Drupal AI (versions before 1.0.5) allows OS Command Injection due to improper neutralization of special elements.
This paper argues that traditional penetration testing is insufficient for AI systems, as adversaries can alter system behavior through prompt injection or data poisoning without compromising the underlying infrastructure. It proposes a new framework focused on violations of operational behavioral objectives.
OpenAI has introduced GPT-Red, an automated red teaming system designed to enhance AI safety through self-play mechanisms.