A new preprint introduces the agent:// URI scheme, designed to decouple agent identity from network location in multi-agent systems. The scheme incorporates trust roots, hierarchical capability paths, and sortable unique identifiers, with cryptographic attestation using PASETO tokens. Evaluation demonstrates full capability expressiveness on 369 tools, perfect discovery precision across 10,000 agents, and sub-5-microsecond performance, suggesting a robust and scalable approach to agent identity and discovery.
Why it matters: This work proposes a novel, decentralized solution to agent identity and discovery, potentially enabling more robust and scalable multi-agent ecosystems.
Policy & Safety→Official→arXiv Cryptography and Security
A large-scale study analyzing 15,000 prompts across 12 LLM and agent configurations found that hallucination of skill names is widespread, with rates averaging 36.0% for standalone LLMs and 36.9% for agents, and rising to 43.1% on real-world developer questions. These hallucinated names can be exploited by adversaries who pre-register malicious skills, enabling supply-chain attacks. The study evaluated four defenses and found that the strongest, retrieval grounding, reduced hallucination to 3.2% but significantly reduced the system's usefulness, with correct skill recommendations dropping to about one in six.
Why it matters: This vulnerability exposes LLM agent ecosystems to easy supply-chain attacks, and current defenses severely compromise usability, highlighting the need for structural changes to registries and recommendation pipelines.
A preprint study evaluated 13 large language models (LLMs) on their ability to detect malicious Python packages from PyPI. The models achieved high recall and F1 scores up to 0.99 for flagging malicious packages, but struggled to accurately identify specific lines of malicious code, with weighted F1 dropping to 0.48. Code complexity, particularly longer packages, was found to be the main factor reducing performance.
Why it matters: The findings suggest LLMs can assist in initial triage for software supply chain security, but are not yet reliable for pinpointing specific malicious behaviors.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint identifies two novel attack surfaces—Screen Perception and Misused Channel—in third-party mobile agents powered by Vision-Language Models (VLMs). The researchers demonstrate seven concrete attacks, showing that malicious apps can hijack agent actions and execute arbitrary commands without requiring permissions, all while remaining visually indistinguishable to users.
Why it matters: This work exposes a fundamental security risk in the design of autonomous mobile agents, emphasizing the need for new security models on multi-tenant platforms.
A recent audit of inference-time defenses for multimodal large language models (MLLMs) found that three benchmark branches failed provenance checks, restricting reliable comparative results to only two datasets. The study also discovered that a legacy keyword-based safety protocol incorrectly counted empty strings as safe, with raw model responses unavailable to reassess this effect. Contrary to earlier claims, the archive does not support widespread model refusal, with a pooled refusal rate of just 0.52%.
Why it matters: This work exposes critical methodological issues in evaluating MLLM safety defenses, emphasizing the importance of traceable audits and provenance standards for trustworthy comparisons.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint identifies a previously unrecognized class of side-channel attacks targeting fault-tolerant quantum computers. The study demonstrates that syndrome data sent to decoder systems can leak information about which logical circuits are being executed, introducing the concept of 'gate fingerprints'—distinctive patterns in syndrome data that reveal specific logical operations. The authors argue that decoder systems must be secured or trusted to mitigate this vulnerability.
Why it matters: This work exposes a novel security risk in quantum computing, underscoring the importance of secure decoder design as the field progresses toward practical deployment.
A new arXiv preprint introduces an information-theoretic framework for watermark forensics in generative models, establishing fundamental limits on detection, attribution, and payload extraction. The authors derive tight entropy-rate laws, showing that attributing text to one of N users requires Θ(log N/h) tokens and extracting an ℓ-bit payload requires Θ(ℓ/h) tokens, where h is the entropy rate. Experiments on GPT-2, Pythia-410M, and Qwen2.5 confirm the theoretical predictions.
Why it matters: This work rigorously quantifies the trade-offs and costs of watermarking in generative AI, providing a theoretical foundation that can inform the design of more reliable forensic tools.
Researchers present MCP Pitfall Lab, a protocol-aware security testing framework for Model Context Protocol (MCP) tool servers that models developer pitfalls as reproducible scenarios and validates outcomes using objective validators. In 2,579 runs across four models, they report a 31.9% overall attack success rate, with multi-modal injection attacks achieving the highest rate at 38.7%. The framework also introduces the Semantic MCP-Bill-of-Material (MCP-BOM), which augments component inventories with security-relevant tool semantics to aid in auditing and hardening. The study demonstrates that static analysis alone is insufficient for certain attack vectors, highlighting the need for runtime provenance.
Why it matters: This work provides a novel and practical framework for systematically identifying and mitigating security risks in the MCP tool server ecosystem, advancing the security of AI software supply chains.
Researchers have introduced a practical evaluation protocol for AI pentesting agents that emphasizes validated vulnerability discovery in complex, real-world targets, rather than just task completion. The protocol incorporates LLM-based semantic matching, bipartite resolution, and cumulative scoring to enable more operationally meaningful comparisons between agents. Expert-annotated ground truth and code are released to support reproducibility.
Why it matters: This protocol bridges the gap between controlled benchmarks and real-world offensive security, supporting more reliable and realistic assessment of AI agents for cybersecurity applications.
Ball Differential Privacy (Ball-DP) modifies standard differential privacy by enforcing indistinguishability only for substitutions within a bounded ball in embedding space, rather than over all possible records. This approach allows for reduced noise addition while still providing robustness against reconstruction attacks. The paper introduces noise calibrations for convex learning and Ball-ReRo certificates that bound reconstruction success, and demonstrates through experiments on seven benchmarks that Ball-DP achieves improved utility compared to standard DP, particularly at high privacy levels.
Why it matters: Ball-DP provides a practical method to reduce the accuracy cost of differential privacy in machine learning, making privacy-preserving models more feasible when defending against reconstruction attacks.
A population-scale analysis of the x402 protocol for AI agent payments on the Base blockchain reveals that, over 280 days, 21.20% of 136.7 million settlements are fictitious and 63.78% are internal to linked clusters. The study finds that genuinely independent payments are much lower, ranging between $187,861 and $20.3 million, indicating that settlement counts primarily reflect manufacturability rather than real adoption.
Why it matters: This research challenges claims of a robust AI agent economy by demonstrating that most on-chain payments can be artificially generated, undermining settlement count as a metric for genuine autonomous economic activity.
A new preprint introduces Bulkhead, an automated framework that integrates large language models (LLMs) with formal methods to detect and remediate path traversal vulnerabilities in containerized environments. Bulkhead employs a multi-agent system to identify cross-boundary interactions, generate proof-of-concept exploits, and produce verified patches. The approach aims to address the limitations of existing detection and defense methods for container escape vulnerabilities, particularly as cloud systems increasingly mount shared resources for AI workloads.
Why it matters: Automated, semantic detection and remediation of container escape vulnerabilities is increasingly important for securing cloud environments that support AI workloads and shared resources.
A large-scale empirical study of 4,022 pull requests from the AIDev dataset found that 38.9% of agent-generated PRs contain at least one security smell, with supply chain integrity issues accounting for 82.3% of all detected smells. Hard-coded credentials made up 99.6% of critical-severity issues, and 81.1% of these credentials went undetected before integration. The study also found that human collaborators introduced 67.6% of genuine leaked secrets in agent-assisted workflows.
Why it matters: This research reveals that autonomous coding agents introduce significant security risks that current review processes often fail to catch, highlighting the urgent need for improved security guardrails in human-AI collaboration.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers introduce PVDetector, a training-free framework for detecting prompt injection attacks on purpose-specific large language model (LLM) agents. By analyzing hidden-state alignment with policy-violation concepts, PVDetector identifies attacks with less than 1% false negative rate and minimal computational overhead, outperforming existing input-output pattern-based detectors.
Why it matters: As LLMs are increasingly used for specialized tasks with unique restrictions, PVDetector provides an efficient and effective defense against prompt injection attacks by leveraging the model's internal representations of policy violations.
A new preprint presents a reproducible, open-source pipeline that distinguishes code written by humans from that generated by large language models (LLMs) with 93% accuracy, using samples from 31 security-sensitive programming tasks across four languages. The study finds systematic differences in security patterns between human and LLM-generated code, and shows that LLMs can repair vulnerabilities in code 77% of the time, though repairs are often only partial fixes.
Why it matters: This work advances automated code provenance attribution and highlights important security differences between human and AI-generated code, informing software supply chain security and AI-assisted development practices.
Researchers introduce JADR (Jacobian Assessment of Danger Recognition), a protocol that evaluates a language model's internal representation of danger by analyzing Jacobian space activations before any response is generated. The method operates entirely locally, does not require external judge models, and enables comparison of models and quantization levels using a SafetyAUC metric with statistical significance. Applied to six models, including Qwen3 variants and Gemma 2 9B, JADR distinguishes between strong and weak internal safety mechanisms and reveals quantization effects.
Why it matters: This approach provides a novel, judge-free method for probing LLM safety by examining internal model activations, potentially uncovering hidden vulnerabilities in safety mechanisms.
A new benchmark, VanillaBench, systematically quantifies the accuracy cost of adversarial robustness by comparing 186 robust models against vanilla baselines. The study finds that the mean clean accuracy gap ranges from -7.7 to -29.5 percentage points, with even the best robust models trailing their vanilla counterparts by 4.0-21.0 points. The authors recommend that future robustness evaluations should routinely report vanilla-referenced accuracy gaps.
Why it matters: This benchmark makes explicit the substantial accuracy trade-off of adversarial robustness, providing critical information for practitioners and decision-makers that is often missing from individual papers.
Researchers have developed MindReader, a tool that leverages large language models (LLMs) to help users generate password replacements that are both secure and memorable. MindReader analyzes the semantic meaning of original password components and suggests new, semantically related but syntactically different replacements. In a user study, passwords created with MindReader were more resistant to guessing attacks than both original and conventionally replaced passwords, while maintaining similar memorability.
Why it matters: This work offers a practical LLM-based approach to improving password security without sacrificing usability, addressing a persistent vulnerability in password management.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint demonstrates that integrating Post-Quantum Cryptography (PQC) into TLS 1.3 can dramatically increase server vulnerability to handshake exhaustion DDoS attacks, with server CPU exhaustion periods prolonged by up to 88 times. The study also finds that leading deep learning-based intrusion detection systems (IDS) experience severe performance drops under PQC traffic, with one system's recall falling to about 50% and another's detection accuracy approaching random chance.
Why it matters: As PQC adoption accelerates, these findings highlight urgent new security risks, showing that quantum-safe cryptography may inadvertently create exploitable weaknesses that current defenses cannot address.
Researchers present a framework that combines metamorphic testing and association rule mining to systematically detect and analyze security vulnerabilities in code generated by large language models (LLMs). Evaluating 3,700 code snippets from five open-source models, they found that 68.8% violated at least one security property, with frequent co-occurrence of vulnerabilities such as XSS, weak cryptography, and hard-coded credentials. The study also identifies prompt-level risk factors and structured patterns in how vulnerabilities cluster together.
Why it matters: This work demonstrates that security flaws in LLM-generated code are often interconnected and influenced by prompt context, highlighting the need for cluster-aware verification and improved safeguards in AI-assisted programming.