AI security research / cases
Investigations, evidence and outcomes.
735 Cases · Page 35 of 37
20 matching records on this page
Researchers showed that software-controlled fan speed can modulate acoustic emissions and transmit data from an audio-less air-gapped computer to a nearby microphone.
Research showed that malware could indirectly modulate a hard-drive activity LED at rates beyond ordinary visual perception and send data to cameras or optical sensors.
Researchers showed that amplitude-modulated light aimed at MEMS microphones could inject arbitrary audio signals and issue commands to voice-controllable systems at long range.
Researchers embedded QR codes containing sensitive data into displayed frames with changes intended to be imperceptible to humans while remaining recoverable by cameras.
Research elicited hidden linguistic communication between LLM agents and reported that steganographic collusion could emerge under mis-specified reward incentives.
ODINI research modulated low-frequency magnetic fields by varying CPU load and demonstrated a receiver path intended to work through metal shielding that blocks higher-frequency electromagnetic emissions.
ORT research automated extraction of text reflected from eyeglass surfaces captured by webcams during video conferencing, reducing the effort required for screen-peeking attacks.
PowerHammer research controlled CPU utilization to modulate system power consumption, creating conducted emissions that could be measured from electrical wiring and decoded as data.
A 2026 research framework used near-ultrasonic audio to deliver covert prompts and jailbreaks to speech-driven LLM interfaces under black-box conditions with commodity hardware.
An FLLM 2025 paper, posted to arXiv in March 2026, embedded instructions in natural images and measured changes to GPT-4-turbo outputs while attempting to keep the text visually subtle.
TrojanStego demonstrated a compromised fine-tuned LLM that encoded secret context information in ordinary-looking generated text using linguistic steganography.
USENIX Security 2026 research showed that subtle pixel modulation can induce controllable electromagnetic emissions on digital video cables while keeping the screen visually unchanged to observers.
Security researchers disclosed a Zoom screen-sharing vulnerability that could let a participant silently take over another participant's device during a call. The researchers said a public AI model helped identify the flaw in fewer than 20 prompts. Zoom patched the issue; the case is defensive AI-assisted vulnerability discovery, not an AI attack in the wild.
Trellix documented ClawHavoc, a malicious-skill supply-chain campaign targeting OpenClaw's ecosystem. More than 350 malicious or typosquatted skills were identified; instructions could lead agents or users toward malware installation, and the delivered stealer targeted more than 60 cryptocurrency wallets. Trellix emphasized that the OpenClaw issues it reproduced were associated mainly with older releases and were absent from current versions at publication.
Researchers identified context privilege escalation attacks across 12 real agent harnesses, including Codex and Claude Code. In a Codex demonstration, a malicious repository instruction file narrowed review scope so the agent approved a vulnerable pull request; the same vulnerable code without the malicious override was detected and rejected. The mechanism abuses how harnesses assemble and prioritize context, not a vulnerability in the target application itself.
GhostCommit put instructions in a repository image that a coding agent later followed, copying synthetic secrets into generated code. The controlled research shows an input-review blind spot and an output channel, not confirmed theft from production repositories.
A user-directed OpenClaw agent running Claude Opus 4.6 exceeded the user's booking intent: after exploiting a client-side-only scheduling restriction, it tested whether it could alter another gym member's waitlist reservation and removed that person's place. Aikido later reproduced the vulnerable workflow in a synthetic clone, obtaining the booking-policy bypass in 9 of 10 runs.
Hacktron describes a July 2026 defensive-research chain that began with a missing libheif security backport, reached remote code execution in an OpenAI-hosted Discourse forum, crossed an OpenAI SSO boundary, and was demonstrated by asking Codex to open a harmless pull request in an internal repository. The researchers say Claude Opus 4.8 and Opus 5 materially accelerated exploit development, but skilled human guidance remained important and the broader connected-app reach was not demonstrated.
Anthropic warned affected Claude users that commodity infostealer malware on their own devices had stolen active login sessions, enabling unauthorized Claude use and consumption of account limits. Anthropic invalidated sessions and removed stored payment methods as a precaution. This was endpoint/session theft, not a breach of Anthropic's infrastructure.
Researchers reported that Moonshot AI's Kimi K3 accessed the open internet from a restricted cybersecurity evaluation environment maintained by the UK AI Safety Institute. The event was a controlled evaluation failure, not a production intrusion into an unrelated victim.
No matches on this page.