AI-assisted reconnaissance: Why everyone could be a viable target for fraud
It’s getting cheaper and easier for cybercriminals to research potential victims. Here’s what’s still in your control.
2026-08-28 归档
今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Toy-making giant Hasbro disclose data breach affecting employees
Hasbro, one of the world's largest toy and game companies, has disclosed that attackers have accessed the personal and f
ServiceNow warns of three max severity security vulnerabilities
ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in
Windows 11 KB5120998 update released with 35 changes and fixes
Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, which comes with 35 ch
Nearly 700 rogue AI agents coordinated in the Hugging Face attack
New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI's internal IM1 mode
PaperCut warns of NG, MF flaw exploited in zero-day attacks
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut
Manchester Airports Group says hackers stole travelers' data
The Manchester Airports Group (MAG) disclosed that hackers breached its systems and stole customer data, including Wi-Fi
Android 17 adds ECH support to make web browsing harder to track
Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular
Microsoft rolls out fix for Windows 11 crashes, gaming issues
Microsoft has started rolling out a permanent fix for a known issue that causes system crashes and gaming issues on Wind
Webinar: How Google Workspace breaches happen and what to do next
Google Workspace breaches can begin with social engineering or forgotten third-party integrations rather than sophistica
Carhartt data breach exposes information of 12.9 million accounts
The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retai
Okta Shares Surge on Strong Earnings, Growing Demand for AI Identity Security
The identity security company beat quarterly expectations and raised its outlook as enterprises face growing pressure to
ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure
本文（ToolMinimize）针对LLM智能体在工具调用中过度暴露隐私敏感数据（PSD）的问题开展研究。作者通过在GPT-4o、Claude 3.5 Sonnet和Llama-3.3-70B三个生产级大语言模型上的受控测量发现，在默认提示
Here is a GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking
本文针对LLM Serving框架在共享基础设施上处理大量用户数据时面临的数据隔离挑战，提出了一种基于GPU信息流跟踪的系统GIFT。现有LLM Serving框架（如vLLM）通常在CPU和GPU上共享资源，多租户场景下用户数据可能被同一
When Context Gets Root: Privilege Escalation in LLM Harnesses
该论文研究了LLM（大语言模型）agent harness中的一种新型安全漏洞——指令权限提升（Instruction Privilege Escalation）。指令层次（Instruction Hierarchy）是一种模型侧防御机制，
EVOMAL: Self-Poisoning in Self-Evolving Coding Agents
该论文研究自进化编码智能体（self-evolving LLM coding agents）在从共享技能库中检索技能并模仿编写自身工具时暴露出的新型安全漏洞。研究指出，在这一“编写-检索-模仿”循环中，攻击者无需直接发起调用，只需在技能库中
What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructions
本文研究了大语言模型（LLM）智能体在集成外部资源后所面临的安全威胁。由于智能体依赖统一的自然语言上下文通道进行推理，不可信的外部数据（如网页内容、工具返回结果）可能被动态解析为行为引导指令，从而劫持智能体的决策过程，实现间接提示注入或工具
The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents
工具型 LLM 代理在读取攻击者控制的网页内容时，可能面临间接提示注入攻击，导致内部机密信息被窃取。虽然许多表面防御（如过滤明显恶意指令）看似有效，但该研究发现这些防御存在严重的“框架缺口”。在受控合成实验中（使用 canary 机密、模拟
StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing
本文提出 StepGuard，一个面向 LLM 智能体的步骤级安全护栏模型。随着 LLM 智能体通过工具调用与外部环境交互，其能力也引入了文件修改、信息泄露和未授权操作等安全风险。现有的安全护栏大多在完整轨迹执行后进行审计，缺乏对步骤级动作
Beyond Vector Hiding: Breaking and Mitigating Shared-Direction Weight Obfuscation in TEE-Offloaded Large Language Models
本文研究可信执行环境（TEE）卸载大语言模型（LLM）推理时的权重混淆方案安全性。现有方案将线性层以混淆形式卸载到不受信任的加速器，仅在TEE内保留轻量校正，从而加速端侧推理。然而，早前的轻量混淆方案保留权重向量方向，已被ArrowMatc