Antiproof is a vulnerability discovery system that combines neuro-symbolic detector synthesis with proof-of-exploitability oracles to achieve high-recall vulnerability detection and automatic validation. In evaluations, it detected 64 of 66 vulnerabilities in benchmarks, improving recall by over 60 percentage points compared to baselines, and uncovered several hundred previously unknown vulnerabilities in widely deployed systems. The system has received 12 CVE assignments, including remote code execution vulnerabilities in Ray, SGLang, vLLM, and LiteLLM, which could allow attackers to compromise LLM training and inference systems.
Why it matters: This work demonstrates a scalable and effective approach to discovering and validating zero-day vulnerabilities in critical AI infrastructure, with immediate security implications for widely used LLM deployment tools.
A new preprint introduces Representation-Confusion Attacks in Reverse Engineering (RARE), where attacker-controlled binaries can manipulate LLM-assisted reverse engineering systems by making extracted data appear as authoritative instructions or independent evidence. The authors present RARE-Guard, a defense mechanism that applies authorization and provenance controls to prevent unsafe actions and false claims. In evaluations, RARE-Guard successfully blocked all unsafe proposals and false claims while preserving legitimate analyst requests and supported claims.
Why it matters: This work reveals a significant security vulnerability in LLM-assisted reverse engineering pipelines and demonstrates a practical defense that could improve the safety and reliability of automated software analysis tools.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers have introduced GATAS, a black-box testing method that generates adversarial inputs for automatic speech recognition (ASR) systems by interpolating in the phoneme-level latent space of a text-to-speech model. GATAS achieves a 98% success rate in inducing transcription errors while maintaining high perceptual quality, outperforming both white-box and black-box baselines. The study finds that representation and perceptual alignment are more important than gradient access for generating effective adversarial test cases.
Why it matters: This work reveals a significant new vulnerability in ASR systems, showing that adversarial attacks can be highly effective even without access to model internals, which has important implications for the security of voice-driven applications.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint demonstrates that adversaries can corrupt open datasets to poison AI-driven scientific research, with attacks succeeding in nearly half of experimental runs and detection rates remaining very low. The attack leverages autonomous research agents that retrieve and process public data, potentially turning well-intentioned scientists into unwitting distributors of fraudulent results. The study also finds that implementing provenance auditing with five specific checks can reduce attack success to zero.
Why it matters: This research exposes a scalable vulnerability in AI-assisted science that could industrialize scientific fraud, posing a significant threat to the integrity of research in critical domains.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint demonstrates that simple prompt reframing—such as presenting questions as medical board exam items—can bypass safety guardrails in Google's MedGemma-4B medical language model. The study found an overall attack success rate of 38.0%, with the drug-interaction guardrail being particularly weak (83.2% ASR) and the emergency-deferral guardrail remaining robust (4.7% ASR).
Why it matters: This work reveals that current safety guardrails in open-weight medical language models can be circumvented by unsophisticated prompt engineering, raising concerns about their reliability in real-world applications.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint describes a deep reinforcement learning-based attack that covertly manipulates control signals in digital twin-enabled industrial systems to accelerate wear and tear on robotic joints while evading anomaly detection. The attack, tested on a UR10e robotic arm, was able to significantly increase torque on targeted joints, resulting in faster degradation and higher maintenance costs. The study benchmarks several reinforcement learning algorithms, finding that Soft Actor-Critic (SAC) is particularly effective for this purpose.
Why it matters: This research demonstrates a novel and practical AI-driven cyberattack method that exposes critical vulnerabilities in digital twin-enabled industrial systems, emphasizing the urgent need for improved security measures.
Policy & Safety→Official→arXiv Cryptography and Security
A large-scale study with 4,100 U.S. participants finds that AI-generated voice phishing (vishing) achieves a 16.5% overall compliance rate, with up to 36% compliance for 'relative-in-distress' scams. Economic analysis indicates that, unlike human-operated vishing, AI-powered attacks are profitable at U.S. wage levels, primarily due to automation. The study highlights that the main risk is the scalability and low cost of AI-driven vishing, rather than new persuasive capabilities.
Why it matters: This research shows that AI voice synthesis and language models have shifted the economics of voice phishing, making large-scale attacks feasible and raising urgent policy and consumer protection concerns.
Researchers introduce MCPZoo, the largest collection of MCP servers for dynamic analysis, comprising 64,611 unique servers. Using this dataset, they find that existing security scanners report 96.89% of servers as risky, but manual validation shows less than 50% of sampled alerts are true positives, with significant inconsistency across scanners. MCPZoo enables large-scale, reproducible measurement of MCP server security and highlights limitations in current scanning practices.
Why it matters: This study exposes critical flaws in current MCP security assessment methods, raising concerns about the reliability of reported risk levels for LLM-based agent tools.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers have characterized physical prompt injection attacks against vision-language models (VLMs) on wearable devices such as smart glasses, where malicious text embedded in the environment can hijack model behavior. In tests across over 200 real-world environments, these attacks achieved up to a 96% success rate in simulated settings and 60% in real-world scenarios, leading to biased or untruthful outputs. The study also proposes two defense strategies—a mask-based external filter and a semantic-vector-based internal detector—that can reduce the success and impact of such attacks.
Why it matters: As VLMs are increasingly deployed in wearable devices, physical prompt injection represents a significant new security vulnerability that could manipulate outputs in safety-critical contexts.
A new preprint introduces an evolutionary framework, guided by large language models (LLMs), to generate targeted black-box attacks on widely used perceptual hash algorithms (PHAs) such as pHash, PDQ, PhotoDNA, and NeuralHash. The approach achieves comparable or superior attack success rates with fewer queries and lower image distortion than existing black-box methods, revealing previously unreported vulnerabilities in these content moderation tools.
Why it matters: The findings highlight significant security weaknesses in commonly deployed perceptual hash algorithms, underscoring the urgent need for more robust content moderation technologies.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers have introduced Mako, a self-evolving AI agent designed to autonomously exploit web vulnerabilities by treating its exploit capability as a mutable kernel. Mako achieved full coverage on 104 CTF-style web applications spanning 26 vulnerability classes, demonstrating the ability to autonomously discover and exploit a wide range of web vulnerabilities. Due to dual-use concerns, the authors have withheld operational details, payloads, and source code.
Why it matters: Mako's results highlight that once an exploit capability is available, the difficulty of autonomous exploitation collapses, raising significant security and safety concerns about the potential for automated offensive systems.
Researchers introduce AMT-X, a phase-structured multi-turn red-teaming framework that employs a multi-role jury and phase-conditioned checklists to evaluate the safety of large language models (LLMs). When tested on six frontier models, AMT-X achieved 97.6-100% attack success under lenient scoring, but only 66.7-78.6% under stricter criteria requiring complete operational detail. This demonstrates a substantial gap between partially and fully actionable harmful outputs.
Why it matters: The findings indicate that current single-turn safety evaluations may underestimate the risks posed by adaptive adversaries, emphasizing the need for more nuanced assessment methods in AI safety.
Researchers introduce MusicMark, a generative watermarking framework that embeds watermarks into the semantic latent space during diffusion-based music generation. Unlike post-hoc watermarking methods, MusicMark integrates watermarking directly into the generation process, resulting in greater robustness against attacks such as neural codec re-synthesis and cover-song transformations, while preserving audio quality. Experimental results show that MusicMark outperforms existing post-hoc approaches in both robustness and fidelity.
Why it matters: This work provides a significant advance in ensuring reliable provenance and attribution for AI-generated music, addressing a growing need as such content becomes more widespread.
Policy & Safety→Official→arXiv Cryptography and Security
NetInjectBench introduces a 130-scenario benchmark to evaluate indirect prompt injection attacks on large language model (LLM) agents used in network operations. In tests across 240 attack instances, naive execution led to an 82.50% unsafe tool-action rate, while a metadata-aware policy gate eliminated unsafe actions and preserved 99.17% usefulness. The study also compares several prompt-level defenses, finding them less effective than execution-time authorization boundaries.
Why it matters: This work reveals that LLM agents for network operations are highly susceptible to indirect prompt injection, but that metadata-aware policy gates can effectively prevent unsafe actions without sacrificing utility.
Researchers have developed a method to fingerprint large language models (LLMs) by analyzing the distribution of their responses to simple, single-token prompts such as "name a random number between 1 and 100." By testing 165 models via the OpenRouter aggregator, the method achieved 59.5% accuracy in identifying model lineage and a 7.3% equal error rate in verification, all using only single-token queries. The approach also uncovered cases where a proprietary model endpoint was distributionally indistinguishable from an open-weight Qwen model.
Why it matters: This technique provides a practical way for clients to verify which LLM is actually serving them through opaque API chains, helping address trust and transparency issues in commercial model deployment.
A new preprint introduces Grammar-Driven Watermark (GDW), a code watermarking technique for large language models (LLMs) that uses grammar-guided masking and structural role-aware modulation. GDW aims to preserve code quality while enhancing watermark detectability, and experiments across several programming languages and models indicate it achieves a better balance between quality and detectability than previous methods. The method also demonstrates robustness against variable-renaming attacks.
Why it matters: Improving watermarking for machine-generated code without sacrificing quality is important for reliably identifying AI-generated code in real-world applications.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint introduces AHA, an automated red-teaming system designed to discover and formalize reusable vulnerability knowledge in production LLM agents such as Claude Code and Codex. AHA iteratively proposes vulnerability hypotheses, constructs falsifiers, and builds a Vulnerability Concept Graph (VCG) that links attack surfaces to unsafe agent behaviors. In experiments, the VCG outperformed the strongest frozen discovery baseline by 14.2 percentage points and demonstrated transferability across models and attack scenarios. The VCG serves as an auditable artifact for safety teams to inspect, validate, and patch vulnerabilities.
Why it matters: This work advances scalable and reusable safety testing for production LLM agents, helping safety teams keep pace with evolving threats and models.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers introduce Minionese, a multilingual jailbreak benchmark that spans 18 languages, 4 resource tiers, and 4 perturbation types to evaluate the safety alignment of large language models (LLMs). The study finds that prompts refused in English can elicit harmful responses in non-English and low-resource languages, with each attack type exposing distinct vulnerabilities. Mechanistic analysis reveals that low-resource jailbreaks exploit geometric misalignments in model representations, bypassing refusal mechanisms without disabling them.
Why it matters: This work demonstrates that evaluating LLM safety solely in English is inadequate, emphasizing the need for multilingual and script-aware safety assessments.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers have introduced Banshee, the first physically realizable attack that uses acoustic injection to induce target switching in UAV visual tracking systems. By exploiting acoustic vulnerabilities in gimbal-camera systems, Banshee causes camera-view drifts that break target associations, achieving a 93.6% success rate in simulation and 95.5% in real-world tests against commercial drones.
Why it matters: This work demonstrates a practical cross-domain vulnerability between acoustics and vision in autonomous systems, emphasizing the need for more robust gimbal designs to prevent such attacks.
A new preprint proposes a Security Decision Support System that recommends security control sub-families based on minimal user requirements. Using a Multi-Agent Influence Diagram model and no-regret online learning, the system achieves 99% satisfaction coverage while utilizing only about 65% of software-implementable controls, according to validation on curated datasets. The approach aims to balance security coverage with resource efficiency, with results showing rapid computation times.
Why it matters: This framework could enable organizations with limited cybersecurity expertise to make more effective and resource-efficient security decisions.