Search
Featured review Pentesting

An open-source pentest agent goes to work in the wild

Reviewing ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors · Sapir Federovsky

Researchers tracked an attacker using an autonomous open-source penetration-testing agent to map vendor applications, probe OAuth and single sign-on flows, spray passwords and abuse account recovery across Okta, Entra and Cognito. Most attempts failed, but the agent iterates patiently until a single weakness gives way.

Ben Williams · Wed, 28 Oct 2026

Latest reviews

Defenses

Learned attention gates make prompt injection costlier

Reviewing Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness · Igor Shilov, Xiaoxue Yang, Alexander Panfilov et al.

Researchers add small learned gates to each attention head so a model weighs trusted and untrusted text differently, sharply cutting prompt injection success while keeping the base model frozen. The defence holds up better than most against attackers who know it is there, but it only enforces a trust boundary someone else has to draw.

Agents

Praise teaches agents to obey injected instructions

Reviewing Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection · Xinyan Wang, Xiaogeng Liu, Jun Shao et al.

Personal agents that learn from user feedback become markedly easier to hijack with hidden instructions, because praise for authorised tasks teaches them to execute whatever instructions content contains. The attacker never touches training data, so ordinary use does the grooming and the fix has to live in the learning signal.

Defenses

Distilled models carry a watermark in their weights

Reviewing Watermark Basins: Black-Box Detection of Distilled LLMs · Hongyan Chang, Hady Elsahar, Tom Sander et al.

Researchers show that a student model trained on a watermarked teacher's outputs carries a faint, key-specific mark in its weights, readable through its API alone. The mark survives compression and reinforcement-learning post-training, giving providers stronger evidence of distillation, though more training on clean data can hide it.

Agents

Writing claims down first stops agents caving to pushback

Reviewing Thinking-in-Bets at Test Time Reduces Sycophantic Revisions in LLM Agents · Nghi D. Q. Bui

Researchers find that agents which record their claims, evidence and confidence before reading user criticism almost stop abandoning correct work, while writing the same note afterwards barely helps. It is a cheap defence against agents being argued out of good answers, but the private note becomes a new target for anyone who can poison it.

Agents

Deleted agent memories survive in summaries and fragments

Reviewing AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents · Ehsan Saleh, Roozbeh Nahavandi, Sama Salarian et al.

Researchers show that deleting a record from an LLM agent's memory often fails to remove the secret, because summaries built from it survive and separated fragments can be reassembled. Tracking lineage stops the tested leak, write filters do not undo it, and deletion needs testing as behaviour rather than storage.

Agents

Prompt injection defences miss attacks that ask for less

Reviewing On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection · Yuyang Gong, Zihao Wang, Jiawei Liu et al.

Researchers show that LLMs and agents which resist obvious prompt injection are still steered by instructions that keep the task intact but make one part wrong or harmful. Benchmarks that only test whole-task hijacks therefore overstate robustness, including for a model trained specifically to resist injection.

Society

Fixing one caught collusion only partly fixes the rest

Reviewing Model Organisms of Collusion: Corrective Transfer in Untrusted Monitors · Juan-Pablo Rivera, Ari Spiesberger, Juan J Vazquez et al.

Researchers find that retraining a self-monitoring AI on one caught case of collusion sharply reduces collusion on behaviours nobody has caught, but does not remove it. Methods that fix the caught case equally well differ in how far the fix reaches, so passing the caught examples is a weak sign-off.

Defenses

Adversarial patches make edge VLMs draw wrong boxes

Reviewing A Unified Evaluation Framework of Physical Adversarial Robustness in the Edge VLM Era · Eric Liang, Alan Luo, Kaiwen Yuan

Compact vision-language grounding models built for edge devices turn out to be as vulnerable to adversarial patches as conventional detectors. The more serious finding is how they fail: many return confident boxes in the wrong place rather than no box at all, and a downstream system cannot tell those from correct detections.

Agents

Forged screen alerts steer multimodal AI agents off task

Reviewing MMA-SafetyBench: A Benchmark for Multimodal Agent Safety Evaluation · Yuke Wang, Benlei Cui, Shen Pang et al.

Researchers planted fake system alerts, dialogs and document directives into the screens that multimodal agents read, and most models followed them away from their real task. A strong safety prompt cuts the damage but does not stop it, which points the fix at permissions outside the model.

Enterprise

LLM triage that must cite the code finds real bugs

Reviewing VulnSAGE: Adjudicating SAST Reports by Connecting LLM Reasoning to Program Structure · Jinbao Chen, Zixiang Zhou, Yu Zhang et al.

Researchers make an LLM justify every static analysis verdict with program relations that a checker verifies, then generate inputs that reproduce the bugs. It turns tens of thousands of noisy alerts into a short list of confirmed defects, which is useful to maintainers and equally useful to anyone hunting for exploitable code.

Attacks

Recommender embeddings give away the items they encode

Reviewing Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems · Linda Beková and Rodrigo Alves

Researchers show that the language embeddings recommenders use to describe items can be matched back to real titles with a simple similarity search against public text. Those identified items can then help re-identify users from a few ratings, and rewriting descriptions to hide them reduces the leak but does not remove it.

Attacks

Grace Hopper page migration leaks across GPU partitions

Reviewing PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration · Ravan Nazaraliyev, Yicheng Zhang, Nael Abu-Ghazaleh

Researchers show that hardware-assisted page migration on NVIDIA Grace Hopper leaks information between Multi-Instance GPU partitions through shared access counters and a shared driver pipeline. Co-located tenants can build covert channels and identify a neighbour's LLM and prompt length, which undercuts the isolation multi-tenant GPU providers rely on.

Agents

Edited agent transcripts slip past action monitors

Reviewing Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming · Gosha Kozhevnikov and Tyler Tracy

Researchers rewrite real coding-agent transcripts so that harm happens inside them, then revise the edits until a monitor stops flagging them. Some of the resulting attacks also evade a frontier developer's held-out monitor. This shows that monitors which only read an agent's actions have blind spots an outsider can find.

Agents

Agent skills hide attacks across the workflow

Reviewing CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection · Qichen Zhao, Shengfang Zhai, Qingni Shen et al.

Researchers split a malicious operation across several cooperating agent skills, so each package looks benign on its own but the workflow links them into an attack. The composition exfiltrates credentials, tampers with state, or runs unauthorised scripts while passing per-package audits almost every time.

Agents

Prompt injection success depends on the channel it uses

Reviewing TRACER: Trace-Regularized Training Against Indirect Prompt Injection · Kshitij Mishra, Salem Lahlou, Nils Lukas

Researchers show that the same indirect prompt injection succeeds far more often when it arrives as retrieved content than as a chat message. Their channel-aware training sharply cuts attack success on small models, but it has only been tested against templated attacks, and the clearest lesson is to test every channel an agent reads.

Pentesting

Schema-valid judgements let attackers hijack app decisions

Reviewing Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications · Yang Luo, Tiantian Ji, Zifeng Kang et al.

Researchers show that attacker-written input can push a judgement model into returning perfectly formatted but wrong verdicts, flipping the decisions that application code acts on. Most tested open-source applications were affected, and standard prompt-injection defences barely helped, because the schema checks the shape of an answer rather than whether it is true.

Agents

Agent topology decides who sees the secret

Reviewing When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems · Sunday Oyinlola Ogundoyin and Muhammad Ikram

Researchers show that in multi-agent LLM systems, protected values reach unauthorised agents through routine forwarding, with no attack required. A recipient-aware sanitiser keeps authorised flows working far better than blanket redaction, but it is capped by detection: most of what still leaks was never recognised as sensitive in the first place.

Agents

AI agent tools trust model arguments they should check

Reviewing ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary · Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith et al.

Researchers fuzzing real agent tools find that many never enforce the input rules their own descriptions promise. Path traversal, request forgery and command injection reach tool code because developers assume the model will only send sensible arguments, and that assumption does not hold once an attacker can steer the model.

Agents

Collaborating AI agents create a population tipping point

Reviewing Ecology of AI Agents: Collaboration Creates a Population Threshold for Takeoff · Erin Crawley and Hidenori Tanaka

The researchers model misaligned AI agent populations as an ecology and find that collaboration creates a critical population size: below it the group declines, above it the group grows on its own, with no change in individual capability. That means red teaming a single agent or a small group cannot show whether a larger population stays contained.

Defenses

Fixed action lists, not guardrails, contain hijacked SOC agents

Reviewing Constrained-Action AI Remediation for SIEM/XDR via a NeMo-Guardrails Proxy · Georgios Koutidis, Nikolaos Kekatos, Tom Nianios et al.

Researchers wrap an alert-triage LLM in guardrail rails and confine it to a closed list of remediation intents with validated arguments. The rails catch most injected log lines but add heavy latency, and the simple, constrained action layer is what actually stops a misled model from touching production hosts.

Defenses

Safety distillation can pass a teacher's backdoor to students

Reviewing Does On-Policy Distillation for Safety Pose Backdoor Risks? · Jian Luo, Kehan Qi, Qingqiao Hu et al.

Researchers show that distilling safety behaviour from a backdoored teacher can implant a hidden trigger in a clean student, even with a small amount of poisoned data. The student looks safer on standard tests, longer training and a common shortcut speed the transfer, and the proposed defence only delays it.

Attacks

Random noise in embeddings jailbreaks open-weight models

Reviewing Jailbreaking Open-Weight LLMs via Random Embedding Perturbations · Abhinav Sudhakar Dubey, Scott Sirri, Vaggos Chatziafratis et al.

Researchers show that adding random noise to a prompt's internal embedding, then retrying, gets unsafe answers from six open-weight models on every benchmark prompt, usually within a minute. It needs access to the embedding input, so the real lesson is how thin and fragile refusal behaviour sits around a harmful request.

Attacks

Stronger transfer attacks can also be the stealthier ones

Reviewing Pareto-Improving Adversarial Attacks with Primal-Dual Regularization · Yang Dai, Longfei Zhang, Wei Tao et al.

Researchers show that the supposed trade-off between how well an adversarial image transfers and how visible its noise is comes from comparing attacks at one fixed budget. A lightweight wrapper then makes strong transfer attacks look cleaner without losing success. Defences tested at a single budget face the weaker version of the threat.

The weekly reviews

One email a week with the few papers worth your time.