AI security research / sources
Primary reports, advisories, papers and original records behind the Claims. Each record supports specific evidence rather than a whole Case by default.
378 Evidence · Page 8 of 13
30 matching records on this page
SlowMist technical analysis of the May 4 Bankr/Grok incident on Base. It reconstructs the untrusted-text → Grok output → Bankr execution path, distinguishes the Bankr-provisioned wallet from official xAI custody, and frames the failure as an AI-agent permission-chain problem rather than private-key theft.
Original Microsoft figure from the Semantic Kernel CVE-2026-26030 research article.
Microsoft's technical write-up of Semantic Kernel vulnerabilities, including the CVE-2026-26030 prompt-injection-to-RCE path and affected configuration.
This Habr interview with BI.ZONE AntiFraud and Digital Risk Protection staff is useful for the defensive problem that remains after generative AI improves impersonation. The interview describes more personalized phishing, synthetic voice and video, multi-stage social engineering, TOAD and phishing-as-a-service, then recommends verification through independent communication channels, two-factor authentication using authenticator applications, protected communications, deepfake-detection tooling, employee training and second-person approval for critical operations. Its quantitative statements need separate denominators: it attributes a 64% share of targeted attacks beginning with phishing email to Threat Zone 2026, reports 12,500 fraudulent sites detected in Q1 2026 versus 17,500 a year earlier, and gives a BI.ZONE estimate of more than RUB 18 billion stolen through phishing schemes in 2025. Those figures describe different populations and should not be combined into one trend or victim count. The controls also block different prerequisites: independent verification and second-person approval can interrupt a single-channel impersonation path, while two-factor authentication mainly hardens account access and does not by itself stop a victim from approving a fraudulent transfer. The interview provides no controlled effectiveness or false-positive data for deepfake detectors.
OpenAI describes a provider-side safety pipeline in which automated systems identify potentially concerning activity, trained personnel review flagged accounts or conversations, and a limited subset receives deeper risk assessment. OpenAI says it notifies law enforcement when conversations indicate an imminent and credible risk of harm to others.
April 3, 2026 Ecuadorian fact-check describing a fabricated TV-branded video alleging Ecuadorian mercenary recruitment for Ukraine. Checks the news outlet's real records, misused photographs, the nonexistent company number and manipulated audio. This corroborates a public fake but cannot attribute its production to the Dark Clark actors.
GitHub-hosted first-party retraction dated April 1 states the notice was withdrawn for all repositories except one originally named mirror and 96 individually listed forks; asks GitHub to restore repositories affected by network-wide processing. Copyright enforcement record, not evidence of a newly exploited software vulnerability.
April 1 reporting and a spokesperson confirm that network-wide takedown processing unintentionally affected roughly 8,100 GitHub repositories and was narrowed after a retraction. This figure measures removals, not leaked files, compromised accounts, victims or exposed credentials.
Axios March 31 reporting based partly on an Anthropic spokesperson. A routine Claude Code release exposed a debugging/source-map artifact and reference to original code. The company acknowledged human packaging error, said no customer data or credentials were exposed, and denied an intrusion. Scope is Claude Code client/harness source, not model weights.
Original social-media disclosure URL linked from the contemporaneous Reddit thread and Axios. Direct X content could not be retrieved through the browser; exact payload was not separately authenticated. Included for discovery provenance rather than as independently checked code evidence.
Community thread links Chaofan Shou's originating X post and contains responses distinguishing Claude Code client-side tooling from model weights. Reddit comments include speculation about future models, internal features and tooling; such interpretations were not independently verified and are not used as factual Claims.
OpenAI's March 25, 2026 first-party statement differentiates the Safety Bug Bounty from the existing Security Bug Bounty and directs findings granting unauthorized access to features, data or functionality to the security program. This is general program policy context only; it neither confirms Oliver Fish's reported October sandbox escape and $300 award nor establishes the severity, disposition or terms of that particular report.
DryRun Security's announcement of its Agentic Coding Security Report. It describes sequential development of two applications, reports findings across pull requests and final scans, and identifies inconsistent authentication coverage. This is the research vendor's own account, not independent reporting or reproduction.
Endor Labs research tracking 88 additional packages across PhantomRaven Waves 2-4 from November 2025 through February 2026. It reports more than 50 disposable npm accounts, correlated infrastructure and payload continuity, later removal of the data-harvesting payload from the studied packages, and the package author's claim that the activity was security research for responsible disclosure or bug-bounty evidence.
Aikido defines slopsquatting as registering package names that models tend to hallucinate and waiting for developers or agents to install them. It connects the Lasso huggingface-cli and react-codeshift precursor cases to the threat model, and discusses the malicious npm package unused-imports. Crucially, Aikido says packages such as unused-imports are consistent with slopsquatting patterns but that attacker intent behind the names cannot be proved.
GitHub-reviewed advisory for CVE-2026-26030, identifying affected Semantic Kernel Python versions and the patched release.
Directly inspected source-code review study, arXiv:2602.16741v1, by Scott Thornton. Eight models were tested on 100 vulnerable Python, JavaScript and Java samples under eight comment variants, producing 9,366 primary analyses. Adversarial comments changed detection only modestly without statistical significance (McNemar exact p > 0.21), while cross-referenced static-analysis signals helped in a separate defense experiment. This is a contrasting task and representation, not independent replication or refutation of Schefold's synthetic EVM bytecode benchmark.
Snyk scan of 3,984 Agent Skills from ClawHub and skills.sh, distinguishing general security flaws from a HITL-confirmed subset of intentionally malicious payloads used for credential theft, backdoors and exfiltration.
Aikido researcher Charlie Eriksen reports that the nonexistent npm name react-codeshift appeared in LLM-generated Agent Skills, spread to 237 GitHub repositories, and instructed agents to invoke it through npx. After Eriksen defensively registered an empty package under the name, he observed a persistent 1 to 4 downloads per day and attributed the pattern to agents following the copied skill instructions. Aikido explicitly states that the package was harmless and that no breach occurred.
Endor Labs analysis of malicious n8n community-node packages, including a Google Ads-themed package that retrieved n8n-managed OAuth credentials during workflow execution and exfiltrated them to attacker-controlled infrastructure.
Trust Wallet's announcement confirms an in-wallet integration with a TRON energy provider called Tronify and explains that the wallet can automatically rent energy during TRON transfers. The page does not identify tronify.rent as the provider's official domain.
Sonatype Security Research analysis that added 83 packages to the known PhantomRaven set, bringing the reported total above 200, and documented install-time remote dependency behavior, credential-oriented data collection, and exposure of developer, CI/CD, and container build environments.
Primary researcher disclosure of the hidden-HTML Opera Neon PoC and follow-up testing. Read alongside Opera’s response to distinguish researcher observations, vendor reproduction and the bounded fix. Neither source establishes ordinary-user victim prevalence.
Escape describes a one-time scan of more than 5,600 public applications built with several vibe-coding platforms, reporting more than 2,000 vulnerabilities, more than 400 exposed secrets and 175 PII exposures while documenting sampling, temporal and platform-imbalance limitations.
Koi Security's original PhantomRaven disclosure. It reports that the campaign began in August 2025, identified 126 malicious npm packages with more than 86,000 downloads, and describes Remote Dynamic Dependencies and slopsquatting as central delivery and lure mechanisms. At the October 8, 2026 review, the original URL redirected to a Palo Alto Networks product page rather than the disclosure. The original article could not be rechecked at that address.
Affected-vendor response documenting its own reproduction and the production-fix/retest chronology. The reported success rate belongs to the vendor’s test setup and is not a population-level risk estimate.
Anthropic's consumer terms state that materials flagged for safety review can be used for model training even after a training opt-out. The terms also reserve Anthropic's right, at its sole discretion, to report information from or about a user, including Inputs or Outputs, to law enforcement.
Primary disclosure of a controlled Comet attack chain, including a mitigation/retesting timeline. Brave is the reporting researcher and a browser vendor; its report is not independent replication of its own experiment. Use the Case to separate the historical result from current-version uncertainty.
Anthropic August 15, 2025 announcement describing a last-resort conversational termination feature for persistent harmful or abusive interactions, initially in consumer chat interfaces with Claude Opus 4 and 4.1. This predates the 2026 update.
A peer-reviewed USENIX Security 2025 study of 576,000 Python and JavaScript code samples from 16 models. It reports average hallucinated-package rates of at least 5.2% for commercial models and 21.7% for open-source models, identifies 205,474 unique nonexistent package names, and analyzes persistence across repeated prompts. The paper frames repeated hallucinated names as a package-confusion attack surface because an attacker can register a name before a later user follows the same recommendation.
No matches on this page.