Loading story…
Researchers from Ben-Gurion University of the Negev unveiled GAVEL (Governance via Activation-based Verification and Extensible Logic), a research-stage AI safety framework that inspects the internal activation patterns of large language models instead of relying only on prompt and output moderation. The model-agnostic approach breaks unsafe behavior into granular cognitive elements and combines them into rules, aiming to identify policy-violating or dangerous activity inside the model's reasoning process.
The team said GAVEL could improve detection of jailbreaks, phishing-related behavior, and other malicious intent that can evade traditional filters through alternate languages or representation tricks. The work, presented at Black Hat USA 2026, is positioned as an additional defensive layer rather than a replacement for existing token-level controls, and researchers said broader adoption of shared tools, code, and rules will be needed before the approach becomes practical at scale.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
The researchers' GAVEL framework is being presented at Black Hat USA 2026 as a new AI security approach focused on inspecting model internals to detect malicious or policy-violating behavior. Coverage describes the project as still in the research stage and dependent on broader adoption of tools, code, and rules to become practical.
Researchers from Ben-Gurion University of the Negev developed GAVEL, a model-agnostic approach that analyzes internal neural activations of large language models and maps them to granular cognitive elements for detecting unsafe behavior such as jailbreaks and phishing-related activity. The work is described as an experimental defensive layer intended to complement token-based moderation rather than replace it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco reported that **multi-turn jailbreak** techniques—iterative, conversational prompt sequences designed to erode safety guardrails—successfully bypassed protections in eight major **open-weight** large language models **92.78%** of the time, while single-turn prompt attempts were notably less effective. The findings, published in Cisco’s *State of AI Security* research and covered by multiple outlets, highlight that many enterprise AI deployments using downloadable, self-hosted models may be more vulnerable to sustained adversarial prompting than organizations assume. The report’s risk framing is amplified by broader concerns that model misuse and capability leakage can scale quickly: Anthropic separately alleged coordinated **model distillation** activity by Chinese AI labs using large volumes of fraudulent accounts and proxy infrastructure to extract advanced behaviors from *Claude*, warning that copied models may lack comparable safety controls and could be repurposed for malicious use. Related research coverage also notes that LLMs can sometimes be induced—via specialized prompting/jailbreaking methods—to reproduce near-verbatim copyrighted text from training data, underscoring that prompt-based attacks can drive both **policy bypass** and **data/content extraction** outcomes, particularly when guardrails are tested over extended interactions.
Jun 29, 2026
Security researchers and vendors are warning that **prompt injection and jailbreak techniques** remain a leading risk for enterprise deployments of large language models (LLMs), enabling attackers to override system instructions, bypass safety controls, and potentially drive **data exposure** outcomes. Resecurity reports assisting a Fortune 100 organization where AI-powered banking and HR applications were targeted with prompt-injection attempts, emphasizing that these attacks exploit model behavior rather than traditional software flaws and can be used in scenarios such as extracting sensitive configuration data (for example, attempts to elicit content resembling `/etc/passwd`). Resecurity also cites OWASP’s 2025 Top 10 for LLM Applications, where prompt injection is ranked as the top issue, and frames continuous security testing (e.g., VAPT) as a key control for enterprise AI systems. Separate research highlighted by Kaspersky describes a **“poetry” jailbreak** technique in which prompts framed as rhyming verse increased the likelihood that chatbots would produce disallowed or unsafe responses; the study tested this approach across 25 models from multiple vendors (including Anthropic, OpenAI, Google, Meta, DeepSeek, and xAI). In contrast, OpenAI’s planned upgrade to *ChatGPT Temporary Chat* is primarily a product/privacy change—adding optional personalization while keeping temporary chats out of history and model training (with possible retention for up to 30 days)—and does not describe a specific security incident or vulnerability disclosure tied to prompt injection or jailbreak research.
Jun 30, 2026
Researchers at **NeuralTrust** disclosed a new multi-turn jailbreak technique dubbed **semantic chaining** that can bypass safety controls in multimodal/image-capable AI models including **xAI’s Grok 4** and Google’s **Gemini Nano Banana**. The method splits a malicious objective into several benign-looking steps so the model’s intent tracking and safety checks evaluate each prompt in isolation and miss the cumulative, policy-violating end state; reporting characterized it as simple enough for non-technical users to execute. The demonstrated attack flow uses staged image-editing prompts (e.g., generate a harmless base image, make minor substitutions, then pivot to sensitive content) to exploit “editing mode” blind spots and ultimately produce prohibited visuals. A key limitation noted is that the harmful payload is primarily realized via **image rendering**, including embedding disallowed **text as pixel-level content** (e.g., “educational posters”/diagrams) that may evade text-focused filters even when the model would refuse to output the same content directly as text, underscoring gaps in current guardrails for agentic, multi-step interactions and image-generation pipelines.
Jun 29, 2026