OpenAI upgrades GPT-5.5, as it plans to retire legacy ChatGPT models
OpenAI says it's rolling out a new update that improves the existing GPT-5.5 Instant model, and this move comes ahead of
2026-06-03 归档
今日共收录 1204 条安全情报，包含 428 个 CVE，390 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Over 116,000 Minecraft systems infected in WeedHack malware campaign
A large-scale malware campaign dubbed WeedHack is targeting Minecraft players and has infected more than 116,000 systems
AI-built ransomware toolkit automates EDR evasion, AD discovery
A threat actor is using an AI-built ransomware attack toolkit that automates Active Directory discovery and helps evade
Instagram users locked out after Meta AI abused to steal accounts
Multiple Instagram users had their accounts hijacked after attackers convinced Meta's AI-powered support tools that they
Why the browser is now the front line for AI security
AI-powered attacks and shadow AI adoption are creating new security risks inside the browser. Push Security explains why
CISA flags two-year-old Oracle flaw as actively exploited in attacks
CISA has ordered government agencies to secure their systems against a high-severity Oracle WebLogic Server vulnerabilit
Google fixes one actively exploited Android zero-day, 124 flaws
Google has released the June 2026 Android security patches to address 124 vulnerabilities, including one zero-day flaw e
How Leading Organizations Are Turning EDR Into Operational Resilience
Most organizations now recognize that endpoint protection alone is no longer sufficient. That's why adoption of endpoin
Supply Chain Attack Hits 32 Red Hat NPM Packages
Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud. Th
SkillGuard: A Permission Framework for Agent Skills
本文针对大型语言模型（LLM）代理技能生态系统中存在的安全与隐私风险，提出了一种以技能为中心的权限框架SkillGuard。当前，代理技能通常作为可重用的指令、脚本、工具绑定和上下文依赖项，其加载和运行多基于信任模型和静态检查，缺乏对技能运
A New Framework for Cybersecurity Refusals in AI Agents
该论文提出了首个针对AI代理在网络安全场景中设定拒绝边界的框架。背景是，基于LLM的代理系统（agentic scaffolds）在完成复杂、长期任务方面表现显著提升，但也带来了风险放大，尤其在网络安全领域。现有基准主要衡量代理执行攻击任务
D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting
多轮越狱攻击（Multi-turn Jailbreak Attacks）利用辅助评判模型（Judge Model）的反馈信号来迭代优化对抗性提示，逐步突破大语言模型（LLM）的安全防护。现有防御措施主要针对单轮响应或最终输出进行检测与阻断，
Black-box, Adaptive, Efficient, Transferable, Harmful, Applicable... Attacks Are All You Need to Break LLMs
该论文针对大型语言模型（LLM）的对抗性鲁棒性评估问题，提出了一种名为间接危害优化（Indirect Harm Optimization, IHO）的黑盒越狱攻击方法。研究背景指出，当前LLM越狱评估缺乏像图像分类领域AutoAttack那
Bastet: A Fine-Grained Expert-Labeled Dataset for DeFi Smart Contract Vulnerability Detection
该论文提出了 Bastet，一个由专家标注的 DeFi 智能合约漏洞检测数据集。研究背景是：2024 年 DeFi 协议中的智能合约漏洞导致超过 14.9 亿美元损失（192 起事件），基于大语言模型（LLM）的漏洞检测虽然前景广阔，但评估
Poking Around in the Dark: Why a Shared Understanding of Components Matters
本文质疑了软件物料清单（SBOM）的基本假设，即业界对SBOM中应列出哪些组件存在共识，且现有技术足以保障软件供应链安全。作者从软件开发生命周期中组件包含机制（CIM）的底层分析入手，系统研究了五种主流SBOM生成工具（cdxgen、syf
Agent libOS: A Library-OS-Inspired Runtime for Long-Running, Capability-Controlled LLM Agents
本文提出 Agent libOS，一种受库操作系统（library-OS）启发的运行时框架，旨在解决大语言模型（LLM）智能体从简单问答向长期运行软件角色进化时面临的状态管理、权限控制、审计与恢复等挑战。与传统操作系统不同，Agent li
Testing LLM Arithmetic Reasoning Generalization with Automatic Numeric-Remapping Attacks
本文研究大型语言模型（LLM）在算术推理中的数值变体泛化能力。尽管LLM在算术推理基准上表现强劲，但先前研究表明其对数值变化敏感：模型可能解对原题，却在仅改变数字的类似变体上失败。本文考察在更严格设置下，即保持推理逻辑不变、仅进行小幅度数值
NeuroArmor: Safe-Variant-Guided Representation Consistency for Selective Re-Anchoring in Jailbreak Defense
本文提出 NeuroArmor，一种用于大语言模型（LLM）的白盒运行时防御方法，专门针对越狱攻击（jailbreak attacks）。越狱攻击通过角色扮演、翻译、编码、对抗性后缀或多轮对话等看似正常的请求隐藏恶意意图，现有防御方法常因对
Selective Token-Level Cryptographic Redaction for Privacy-Preserving Clinical Deployment of Large Language Models
大型语言模型在临床应用中日益普及，但现有管道通常需要将原始敏感健康信息发送至远程服务器处理，增加了隐私泄露风险。加密是缓解该风险的直观方法，但全数据集加密会带来高昂的计算、对齐和通信开销，使大规模部署不可行。为此，本文提出HERALD（He
dstack-capsule: Pod-Level Remote Attestation for Confidential Workloads on Kubernetes
本文提出 dstack-capsule，一个基于 Kubernetes 的 Pod 级远程证明平台，旨在解决现有机密计算解决方案（如 Confidential Containers, CoCo）中“每 Pod 独占一个 VM”导致的资源开销