Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 153 (153.0.7993.0) for Android. It's now available on Google Play.You can se
2026-08-08 归档
今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。
← 返回归档列表PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents
智能家居助手日益采用多模态大语言模型（MLLM）直接感知视频和音频，这带来了新的安全挑战：代理需要区分真实的用户指令与环境或外部来源的内容（如电视语音、屏幕文字、旁听到的对话），这些内容可能无意间被当作指令执行。针对这一问题，本文提出了Pr
When Does Latent Communication Pay? A Causal Audit of Relayed KV Caches in Multi-Agent LLMs
该论文对多智能体LLM系统中中继键值缓存（KV cache）的效果进行了因果审计，质疑了系统声称通过交换"潜在思考"（latent thoughts）获得性能提升的说法。作者指出，这种归因取决于具体中继的是哪个样本的缓存，而不仅仅是中继了某
Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions
本文是一篇关于区块链赋能的可信代理网络的综述与教程性文章。研究背景是AI代理正从孤立的任务执行器演化为网络化的自主实体，能够通信、委派任务、调用工具、访问外部知识，并参与跨平台的服务与经济流程。这种演化催生了开放代理网络，其中不同利益相关者
Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework
本文针对检索增强生成（RAG）系统在大型语言模型（LLM）应用中面临的知识污染攻击问题，提出了一种名为 SecureCollaRAG 的拜占庭容错协作式 RAG 框架。研究背景是：虽然 RAG 能够缓解 LLM 的幻觉问题，但攻击者可通过投
PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration
本文提出 PriDyG，一个面向动态图推断的隐私保护框架，旨在解决关系型数据上的图推断可能泄露敏感边信息的问题。在动态图中，模型反复更新会导致隐私损失累积，使得问题更加严重。作者形式化了边级差分隐私动态图推断（EDG）问题，并设计了一种结合
An Inline Control Architecture for Language Models in Intelligent Transportation Systems
本文针对智能交通系统（ITS）中车联万物（V2X）环境下大语言模型（LLM）应用的安全问题，提出了一种名为 Guarded-V2X 的内联语义护栏架构。随着 V2X 系统在路侧单元和边缘节点上越来越多地集成 LLM 用于消息摘要、操作员辅助
ReputationChain: Robust Trust Updating for Blockchain-Enabled Supply Chains
本文提出 ReputationChain，一个面向区块链供应链的参与者信任更新框架。研究背景是：区块链虽然能保证供应链记录的完整性，但仅凭账本完整性无法判断参与者在未来风险敏感交易中是否值得信任。现有声誉系统主要关注产品证据、全局反馈聚合或
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP A...
CVE-2026-46409
OpenYak 是一款本地优先的智能体运行时，专门用于可靠地调用工具的模型，并在此基础上提供桌面工作区。在 1.1.3 版本之前，OpenYak 的桌面后端存在一个严重安全缺陷：其 HTTP API 被绑定在 127.0.0.1 的随机端口
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like ...
CVE-2026-48170
CVE-2026-48170 影响 scim-patch 库（用于执行 SCIM PATCH 操作的 Node.js 库），其 0.9.1 之前的版本在应用包含形如 "__proto__.someProp" 键的 value 对象时，会触发
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey