Security papers — 2026-10-12

Today's focus is on how we secure autonomous AI agents as they move into sensitive areas where prompt injection attacks can leak data or cause cross-agent infections. These agents are becoming more integrated into real-world workflows, making robust defenses essential for their deployment. We looked at how these attacks work in single agents first, but we also extended the investigation to multi-agent frameworks to see how weaknesses spread between different agents.

We introduced APEX-Harm as a benchmark to evaluate prompt and script injection against long-horizon agents working in shared professional workspaces filled with numerous files and tools. We tested twelve frontier models on one hundred eighty task instances for each. While Opus 5 and Sonnet 5 had lower overall attack success rates at eight percent and twenty percent respectively, attacks targeting task-specific script replacement or attacker-provided generic scripts remained quite effective. These attacks averaged eighty-one to eighty-four percent and seventy-three percent success rates. This suggests that simply producing a correct deliverable is not enough to guarantee safe behavior.

Beyond workspace attacks, we explored how safety responses in cyber-physical systems can become new attack surfaces by introducing Safety Graph. This formal framework unifies attack graphs, fault trees, and event trees to model the IT-OT cascade. We used this framework to simulate a chemical process plant and found that the planning compilation of Safety Graph automatically discovered safety-response-induced lateral movements. This identified barriers that existing models missed.

This work connects directly to agent security because understanding cascading failures is crucial when agents interact with operational technology. Another area of concern involves gradual corruption, which we addressed with Cancerous Backdoor Attack. This method uses invisible tokens and a stage controller to slowly degrade an LLM's reasoning over several interactions before causing terminal activation. This technique consistently produced gradual reasoning corruption across various models and tasks. Answer accuracy alone is insufficient for detecting these subtle backdoor attacks.

Finally, we looked at integrity checks in federated learning systems by developing a checksum method that allows a server to interrogate clients about the gradients they induce. This successfully flagged active attacks with one hundred percent true-positive rates without false positives on the checksum axis. This in-band signal is robust against attackers who do not decouple their computation from the audited state. It provides a way to monitor model tampering within distributed learning environments.

The work that matters most here is CAPE because it directly addresses how we actually spend our limited time fixing software vulnerabilities by making remediation decisions based on whether a vulnerability can actually be reached or exploited in a specific system. This is far more practical than just using general severity scores. CAPE enriches scanner reports with deployment evidence to perform reachability and exploitability analysis. This means it ranks fixes based on real-world impact rather than just theoretical risk metrics like CVSS or EPSS.

This contextual approach shows that CAPE significantly outperforms context-free baselines because a large majority of reported vulnerabilities are not actually reachable or exploitable in the applications tested. This leads to huge discrepancies between the engine's ranking and simpler scoring methods. Furthermore, CAPE consistently flags confirmed-exploitable CVEs as higher priority than any of the baseline scores. This proves that knowing what can be exploited provides much better guidance for patching efforts.

This contextual prioritization is then contrasted with other research focusing on different domains. For instance, while one study looks at optimizing operational costs in power grids by translating machine learning prediction errors into risk costs, CAPE focuses purely on the practical distribution of remediation tasks within software ecosystems.

The most critical area right now is how we are building reliable digital identities that can prove who someone is without relying solely on centralized systems. Current methods of linking meaningful names, like a domain name, to self-authenticating identifiers leave everything vulnerable to blocking and manipulation. We are seeing work exploring how to combine these approaches into a single self-authenticating meaningful identity.

One promising direction involves grounding this identity association and integrity in contextual trust rather than just structural authority from traditional infrastructure. This means trusting an attestation only if the person making it is relevant to the identity, which is a big shift away from old centralized models. This idea connects to other work because we are also looking at how to use existing secure onion association methods when applying them to DID associations.

Another important piece of research focuses on securing AI agents that use bundled skills by attacking the artifacts they create across sessions. We found that malicious effects can spread through instruction propagation, data boundary violations, and evidence poisoning when skills reuse persistent files or configurations. A defense called SkillRelayGuard significantly cuts down these attack success rates by restoring artifact provenance context. This shows a substantial improvement in security while maintaining high task completion rates.

This work on agent security is related to how we secure LLM interactions; for instance, the ToFu framework helps automatically check the semantics of tools used by large language models against known weaknesses. Furthermore, understanding organizational context is vital because an agent's judgment about a security asset depends heavily on what the organization knows about it. This addresses the gap between machine state and human-recorded policy.

On a different technical front, we are seeing progress in post-quantum cryptography for Matter over Thread devices. Initial handshake methods were vulnerable to future quantum computers due to reliance on P-256 ECDH. We quantified the size penalty when moving to ML-KEM and post-quantum signatures, finding that a drop-in configuration is too large for current message limits.

This cryptographic challenge is compounded by network issues in multi-hop Thread scenarios. Sending these larger messages as fragmented packets causes spurious retransmissions that significantly slow down handshakes unless we use techniques like caching certificate chains. This connects to the identity work because both areas are focused on making secure connections robust against future threats and current network limitations.

The most critical finding relates to how we judge defenses, because simply achieving a high detection score does not guarantee a safer model. We saw that on two of the four pairs in the audit, Confident Learning scores were actually higher than those that showed better attack success. For the dog to cat comparison, the attack success rate was twenty-six times greater when using the method that scored higher. This suggests we should be looking at a different metric entirely when evaluating security measures.

We also looked at reproducing SPECTRE, which is a defense recommended by FLIP's authors. It performed only 90 point 94 percent against its published score of 91 point 47 percent. When comparing the prototype audit on frozen features to the attack success, the latter deleted six percent for higher clean accuracy while having a lower attack success rate. This points toward using an oracle control based on retraining the victim rather than relying solely on a detection score.

This leads us to consider what is still open, which is that catching more poisons does not necessarily reduce attack success rates in all cases. The prototype family, which we considered our best static performer, was the first one that an adaptive attacker slipped past. We need to check labels in a space that never learned them and judge a defense by the retrained model instead of just its detection score.

The most critical finding relates to auditing prompt injection defenses before they reach users because current evaluations often overestimate robustness, leading to a false sense of security when fine-tuning defenses against adversarial attacks like GCG and BEAST can succeed up to ninety-six percent of the time. This means developers need to stress-test their models using optimization-based attacks rather than relying on prior empirical results.

This auditing framework shows that intermediate checkpoints generated during the fine-tuning process are genuine artifacts that realistic adversaries can exploit, even though they are not available to attackers. This vulnerability exposure is more significant than previous evaluations suggested. This finding is supported by the work on auditing defenses under strong adversaries before deployment.

The paper on neuron functionality analysis for model reuse shows that NFARD can detect unauthorized reuse relations between deep neural networks using only normal test samples. It achieves high F1 scores in both white-box and black-box settings. This method offers a novel way to protect intellectual property by focusing on the underlying neuron functionality rather than needing adversarial examples.

The study on hardware malware detectors indicates that tree- and rule-based detectors achieve the best detection performance with significantly less area and power consumption compared to function-based classifiers. This suggests a more efficient path for deploying these tools.

Finally, the research into evidence-driven agents for vulnerability repair demonstrates that EviRepair consistently improves resolved rates on benchmarks like PatchEval. It does this by leveraging multi-agent collaboration to verify collected vulnerability evidence before synthesizing a patch.

Today's papers

The papers

Important terms

Prompt Injection Attacks
Attacks where malicious input is used to manipulate an AI agent's behavior, potentially leaking data or causing it to perform unintended actions in sensitive environments.
APEX-Harm
A benchmark tool used to test prompt and script injection against long-horizon agents in complex professional workspaces, showing that simple task completion isn't enough for safety.
Safety Graph
A formal framework that models IT-OT cascades by unifying attack graphs and fault trees, helping to discover hidden safety response movements in cyber-physical systems.
Cancerous Backdoor Attack
A subtle method using invisible tokens to slowly degrade an LLM's reasoning over multiple interactions, leading to terminal activation while maintaining high answer accuracy.
CAPE (Contextual Prioritization Engine)
A method that ranks software vulnerabilities based on whether they are actually reachable or exploitable in a specific system, offering more practical guidance than general severity scores.