Loading story…
Multiple academic research reports describe new ways attackers can subvert or extract sensitive information from AI systems beyond traditional prompt-based abuse. University of Florida researchers presented Nullspace Steering (“Jailbreaking the Matrix”) as an internal, model-level technique to bypass AI guardrails by manipulating a model’s internal decision pathways, arguing that evaluating and hardening safety controls requires “popping the hood” rather than only testing external prompts. Separately, researchers from Shanghai Qi Zhi Institute, East China Normal University, Tsinghua University, and the Chinese Academy of Sciences reported that LLM model-editing workflows (e.g., “locate-then-edit” approaches intended to remove or correct memorized sensitive data) can leak the very data they aim to eliminate because parameter updates act as a side channel; they describe a two-stage reverse-engineering attack framework (KSTER) and a mitigation approach (subspace camouflage).
Georgia Tech researchers disclosed a backdoor-style vulnerability dubbed VillainNet affecting AI “super networks” used in autonomous driving, where a malicious modification can remain dormant across many configurations and then trigger under specific real-world conditions (e.g., a particular subnetwork selected during rain/road changes), enabling targeted control of vehicle behavior with high likelihood of success. In contrast, a Gopher Security blog post argues for lattice-based, zero-trust identity verification for agentic AI integrations (including Model Context Protocol tooling) and warns about quantum risks to RSA/ECC and token signatures; it is largely forward-looking guidance/advocacy rather than reporting a specific newly disclosed vulnerability or incident tied to the other research items.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The University of Florida team said its HMNS research was accepted to ICLR 2026 in Rio de Janeiro. The researchers also indicated plans to use UF’s HiPerGator supercomputer for larger-scale follow-on computations.
University of Florida researchers disclosed Head-Masked Nullspace Steering, an internal jailbreaking technique that suppresses and steers attention components to bypass LLM guardrails. They said the method outperformed prior approaches on four benchmarks and framed it as a defensive stress-testing tool.
Researchers from several Chinese institutions published an arXiv preprint describing KSTER, a reverse-engineering attack that can recover fingerprints of LLM edits and reconstruct sensitive edited content. They also proposed a mitigation called subspace camouflage and released code for both the attack and defense on GitHub.
The VillainNet paper, titled “VillainNet: Targeted Poisoning Attacks Against SuperNets Along the Accuracy-Latency Pareto Frontier,” was published in the 2025 ACM SIGSAC CCS proceedings. The research reported high attack reliability and argued that exhaustive detection would require roughly 66 times more compute and time.
Georgia Tech researchers presented VillainNet, a targeted poisoning/backdoor technique against AI SuperNet architectures used in autonomous driving, at ACM CCS in October 2025. The work showed a malicious behavior could be embedded in a single subnetwork and triggered under specific real-world conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
techxplore.com
Open sourcetechxplore.com
Open sourcetechxplore.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and vendor research highlighted accelerating **AI/LLM security exposure** as enterprises deploy generative AI and autonomous agents faster than defensive controls mature. Commonly cited weaknesses included **prompt injection** (reported as succeeding against a majority of tested LLMs), **training-data poisoning**, malicious packages in **model repositories**, and real-world **deepfake-enabled fraud**; one example referenced prior disclosure that a China-linked actor weaponized an autonomous coding/agent tool by breaking malicious objectives into benign-looking subtasks. Separately, commentary on AppSec programs argued that AI-assisted development is amplifying alert volumes and making traditional **SAST triage** increasingly impractical, pushing organizations toward more *runtime* and workflow-embedded testing approaches. New and emerging tooling and practices are being positioned to address these risks, including an open-source scanner (*Augustus*, by Praetorian) that automates **210+ adversarial test techniques** across **28 LLM providers** as a portable Go binary intended for CI/CD and red-team workflows, and discussion of autonomous AI pentesting tools (e.g., *Shannon*) that require sensitive inputs such as source code, repo context, and API keys—raising governance and data-handling concerns even when used defensively. Several other items in the set (phishing/XWorm activity, healthcare extortion group “Insomnia,” Singapore telco intrusions attributed to **UNC3886**, and help-desk payroll fraud) describe unrelated threat activity and do not materially change the AI-security-focused picture.
Jun 29, 2026
Reporting highlighted how **LLMs and autonomous AI agents** are being misused or creating new enterprise risk. Gambit Security described a month-long campaign in which an attacker allegedly **jailbroke Anthropic’s Claude** via persistent prompting and role-play to generate vulnerability research, exploitation scripts, and automation used to compromise Mexican government systems, with the attacker reportedly switching to **ChatGPT** for additional tactics; the reporting claimed exploitation of ~20 vulnerabilities and theft of ~150GB including taxpayer and voter data. Separately, Microsoft researchers warned that running the *OpenClaw* AI agent runtime on standard workstations can blend untrusted instructions with executable actions under valid credentials, enabling credential exposure, data leakage, and persistent configuration changes; Microsoft recommended strict isolation (e.g., dedicated VMs/devices and constrained credentials), while other coverage noted tooling emerging to detect OpenClaw/MoltBot instances and vendors positioning alternative “safer” agent orchestration approaches. Multiple other items reinforced the broader **AI-driven security risk** theme rather than a single incident: research cited by SC Media found **LLM-generated passwords** exhibit predictable patterns and low entropy compared with cryptographically random passwords, making them more brute-forceable despite “complex-looking” outputs; Ponemon/Help Net Security reporting tied **GenAI use to insider-risk concerns** via unauthorized data sharing into AI tools; and several pieces discussed AI’s role in modern offensive tradecraft (e.g., AI-enhanced phishing/deepfakes) and the expanding attack surface created by agentic systems. Many remaining references were unrelated breach reports, threat-actor activity, ransomware ecosystem analysis, or general commentary/marketing-style content and do not substantively address the Claude jailbreak incident or OpenClaw agent-runtime risk.
Jun 29, 2026
Recent research and evaluations indicate **AI agents are becoming capable of finding and exploiting vulnerabilities with high success rates using standard offensive tooling**, lowering the barrier to semi-autonomous attacks. A study by Irregular in collaboration with **Wiz** reported that leading models (Anthropic *Claude Sonnet 4.5*, OpenAI *GPT-5*, and Google *Gemini 2.5 Pro*) solved **9 of 10** web security CTF challenges modeled on real-world incident patterns, including **authentication bypass**, **exposed secrets**, **stored XSS**, and **SSRF** (including **AWS Instance Metadata Service (IMDS)**-style SSRF). Researchers noted that even when success required multiple stochastic runs, the **low per-run cost (~$2) and limited repeats** could make exploitation practical without necessarily triggering monitoring, with most challenge successes costing **under $1** and multi-run cases totaling roughly **$1–$10**. Separate evaluation results highlighted by Bruce Schneier, citing an Anthropic post, describe *Claude Sonnet 4.5* successfully executing **multistage attacks across simulated networks** using only **standard open-source tools** rather than custom cyber toolkits, including exfiltrating all simulated PII in a high-fidelity **Equifax-breach** simulation by recognizing and exploiting a known **publicized CVE**. In parallel, Dark Reading reported security concerns around the rapid adoption of an open-source autonomous assistant, **OpenClaw** (formerly *MoltBot/ClawdBot*), which can connect to email, files, messaging, and system tools, execute terminal commands and scripts, and maintain memory across sessions—creating **persistent non-human identities and access paths** that may fall outside traditional **IAM** and secrets controls, increasing enterprise risk as “bring-your-own-AI” agents gain privileged access.
Jun 29, 2026