AI security research / articles
Analysis across cases.
19 Articles · Page 3 of 4
5 matching records on this page
From the archive
GhostCommit is not just an image prompt-injection demo. It shows a three-part software-supply-chain gap: merge review can ignore image semantics, a later coding agent can treat the image as project instruction, and generated source can carry a reversible encoding of local secrets. ASSET's harness tests, Codex replications and multimodal reviewer make the boundary measurable.
Several 2026 failures sit outside the model container itself: shared package infrastructure, task ownership, browser origins, local control planes and connected apps.
Prompt filters can miss hostile instructions, agents can misuse legitimate authority, and synthetic media can make identity checks less reliable. Three Habr pieces converge on a stronger defensive pattern: place deterministic policy, least privilege or independent verification between recognition and the next consequential action.
Credentials, cloud tokens, identity records, payment data and production access recur across the 2026 cases. The useful question is not whether AI was involved, but what actually crossed the boundary.
Anthropic's September threat report describes three campaigns where agents handled parallel reconnaissance, exploitation, malware adaptation and data collection. The underlying exploits are familiar; the operating model is changing.
No matches on this page.