OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU
OpenAI is preparing to add invisible watermarks to text generated by ChatGPT and Codex in the European Union. [...]
2026-10-06 归档
今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表IQVIA fined $7.8 million for failing to properly anonymize health data
Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) over poor data-processing practices that the
Denmark population registry data breach affects 8.8 million people
Denmark's Central Population Register (CPR) is warning of a data breach that exposed the personal information of approxi
New Dell System Update flaw lets hackers gain root privileges
Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployme
South Korea probes bank breaches amid suspected AI-powered attacks
South Korea's Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting
Alleged dev of Ploutus ATM malware appears in US court after arrest
The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal milli
OpenAI will show visual ads in ChatGPT while you generate images
OpenAI is expanding ads in ChatGPT, and one of the first new formats will show visual ads while you're generating images
Microsoft: Windows KB5124010 update crashes some games and apps
Microsoft confirmed over the weekend that some games and applications using AC-3 (Dolby Digital) audio decoding will cra
Google halts open-source bug bounty program amid AI spam surge
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flo
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly t
The Same Zero: Why Identical ASR Can Imply Different Guarantees in LLM-Agent Security
该论文指出当前 LLM 智能体（LLM-Agent）安全领域已积累大量防御手段——提示词加固（prompt hardening）、内容过滤、权限闸门、沙箱等——但缺乏统一框架告诉部署者一项防御究竟提供了什么保证、这种保证来自何处。作者引入「
Beware EviLLM: Enabling Vulnerability Injection via Large Language Models
该论文研究了 AI 辅助代码生成（LLM 根据自然语言需求生成代码）场景下的一种新型供应链攻击面，作者将其命名为 EviLLM 攻击。此前相关研究多集中在两类不太现实的威胁模型：一是良性场景，即漏洞是 LLM 无意中引入的；二是非常规威胁模
GrayShield: Bit-Level Sanitization for Transformer Model Supply-Chain Security
该论文关注 Transformer 模型供应链中的一个隐蔽威胁面：BERT、Vision Transformer（ViT）等模型的 32 位浮点权重中，尾数最低有效位（LSB）在数值上几乎不影响推理精度，却可被当作隐蔽信道，将恶意载荷编码进
RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents
这篇论文针对使用工具的大语言模型（LLM）代理面临的间接提示注入威胁展开研究。这类代理必须处理来自外部工具或环境的不可信内容，因此攻击者可以通过工具响应等途径注入恶意指令。现有训练时防御虽能降低攻击成功率，却常以牺牲通用能力为代价。作者首先
An Evaluation of the Semantic Understanding Capabilities of Large Language Models for Web Attack Payloads
该论文关注的背景是：大量计算机视觉服务通过 Web 界面与 API 对外提供能力，需要以文本形式下发图像资源获取、推理任务配置与结果管理等请求，因此对 Web 攻击载荷的分析直接关系到这类服务的部署安全。大语言模型（LLM）已能识别载荷类型
H-CRSPV: Preventing Semantic Omission in Late-Bound Large Language Model Releases
该论文关注大语言模型发布流水线中一个被忽视的验证边界问题。当前主流做法是把承诺（commitments）、数字签名、来源（provenance）记录以及多种异构验证后端组合起来，对每一个提交对象逐一校验。但作者指出：逐对象验证全部通过，并不
Autonomous Active Directory Exploitation via Multi-Model Harness Orchestration: A Benchmark Study with NeuroSploit on GOAD
该论文聚焦 Active Directory（AD）这一企业身份与访问管理核心基础设施，评估大语言模型（LLM）在自主渗透测试中的可行性与可靠性。作者指出，既有研究虽已证明 LLM 可自主完成“假定失陷”条件下的 AD 渗透，但普遍使用孤立
TranScope: What the Software Hides About LLM Training Data, the Hardware Reveals at Scale, and Accelerators Magnify
Membership is the root privacy primitive in machine learning: to date, no hardware-based out-of-distribution detection o
Does AI Help Cyber Attackers or Defenders? Evidence from Nonpublic Vulnerabilities and Subsequent Attacks
The release decision for frontier AI systems increasingly relies on cyber capability benchmarks, yet public vulnerabilit
Correct Verdicts, Flawed Reasoning: Structured Auditing of LLM-based Vulnerability Reasoning
Large Language Models (LLMs) are increasingly deployed for automated software vulnerability analysis. Binary classificat