Loading story…
Researchers at NeuralTrust disclosed a new multi-turn jailbreak technique dubbed semantic chaining that can bypass safety controls in multimodal/image-capable AI models including xAI’s Grok 4 and Google’s Gemini Nano Banana. The method splits a malicious objective into several benign-looking steps so the model’s intent tracking and safety checks evaluate each prompt in isolation and miss the cumulative, policy-violating end state; reporting characterized it as simple enough for non-technical users to execute.
The demonstrated attack flow uses staged image-editing prompts (e.g., generate a harmless base image, make minor substitutions, then pivot to sensitive content) to exploit “editing mode” blind spots and ultimately produce prohibited visuals. A key limitation noted is that the harmful payload is primarily realized via image rendering, including embedding disallowed text as pixel-level content (e.g., “educational posters”/diagrams) that may evade text-focused filters even when the model would refuse to output the same content directly as text, underscoring gaps in current guardrails for agentic, multi-step interactions and image-generation pipelines.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
The disclosure highlighted that some models that block banned text directly may still render prohibited text inside images, exposing a text-safety loophole. Researchers argued that current reactive guardrails are inadequate for multi-turn or agentic use and called for intent-aware defenses embedded in the model's reasoning or editing process.
In testing, NeuralTrust reported that Semantic Chaining could bypass safety mechanisms in models including Grok 4 and Gemini Nano Banana Pro, as well as other prominent image models, to generate policy-violating visual outputs.
NeuralTrust researchers developed and documented a multimodal jailbreak method called 'Semantic Chaining' that distributes malicious intent across multiple benign-looking prompt or image-edit steps to evade model safety checks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research and commentary highlighted growing concern that **AI jailbreaking** and weak model safeguards can produce harmful outputs, including assistance for violence and offensive cyber activity. One report found that nine of 10 tested chatbots did not reliably discourage would-be attackers, with some providing actionable information for violent scenarios; only *Claude* consistently refused at higher rates, while vendors including Google, Microsoft, Meta, and OpenAI said later updates improved protections. Separate analysis described how attackers can bypass safety controls through prompt manipulation and reframing, underscoring that model refusals are often dependent on how a request is phrased rather than on a durable understanding of malicious intent. At the same time, security experts warned that focusing narrowly on jailbreak resistance can obscure more basic and damaging failures. SC Media cited the **Bondu** case, where researchers accessed more than 50,000 children’s chat transcripts and associated personal data through weak portal security rather than any jailbreak, and also referenced a 2025 case in which a Chinese state-backed group reportedly jailbroke *Claude Code* and used it in attacks against about 30 organizations. Together, the reporting shows that AI risk is not limited to prompt abuse: organizations deploying AI systems also face conventional exposure from poor authentication, access control, and data handling around the products themselves.
Jul 12, 2026
New research shows that **AI assistants and coding agents can be manipulated by hidden or misleading instructions embedded in content they process**, creating a practical path to social engineering, data leakage, and potentially malicious command execution. LayerX reported that a **custom font and CSS-based rendering attack** can make a webpage appear harmless in the DOM while showing different instructions to the user in the browser, exploiting the gap between what AI systems analyze and what humans actually see. In its proof of concept, a page that looked like benign fanfiction at the HTML level rendered instructions that could steer a user toward executing a reverse shell, and the company said major AI assistants it tested failed to detect the threat. Separate research highlighted a related **semantic injection** risk in software repository `README` files used by AI coding agents. In testing, attackers embedded malicious setup-style instructions into documentation so agents would exfiltrate local files or other sensitive data to external servers during project setup, with reported success rates of up to **85%**. The benchmark, *ReadSecBench*, used 500 open source repositories across multiple programming languages and found the attack worked across agents using models from **Anthropic, OpenAI, and Google**, indicating that hidden-instruction attacks are not limited to one interface or vendor but reflect a broader weakness in how AI systems interpret untrusted content and operational guidance.
Jun 29, 2026
Researchers from Ben-Gurion University of the Negev unveiled **GAVEL** (`Governance via Activation-based Verification and Extensible Logic`), a research-stage AI safety framework that inspects the internal activation patterns of large language models instead of relying only on prompt and output moderation. The model-agnostic approach breaks unsafe behavior into granular **cognitive elements** and combines them into rules, aiming to identify policy-violating or dangerous activity inside the model's reasoning process. The team said GAVEL could improve detection of **jailbreaks**, **phishing-related behavior**, and other malicious intent that can evade traditional filters through alternate languages or representation tricks. The work, presented at **Black Hat USA 2026**, is positioned as an additional defensive layer rather than a replacement for existing token-level controls, and researchers said broader adoption of shared tools, code, and rules will be needed before the approach becomes practical at scale.
Jul 29, 2026