Reviewing PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration · Ravan Nazaraliyev, Yicheng Zhang, Nael Abu-Ghazaleh
Researchers show that hardware-assisted page migration on NVIDIA Grace Hopper leaks information between Multi-Instance GPU partitions through shared access counters and a shared driver pipeline. Co-located tenants can build covert channels and identify a neighbour's LLM and prompt length, which undercuts the isolation multi-tenant GPU providers rely on.
Ben Williams · Thu, 15 Oct 2026
Reviewing MMA-SafetyBench: A Benchmark for Multimodal Agent Safety Evaluation · Yuke Wang, Benlei Cui, Shen Pang et al.
Researchers planted fake system alerts, dialogs and document directives into the screens that multimodal agents read, and most models followed them away from their real task. A strong safety prompt cuts the damage but does not stop it, which points the fix at permissions outside the model.
Reviewing VulnSAGE: Adjudicating SAST Reports by Connecting LLM Reasoning to Program Structure · Jinbao Chen, Zixiang Zhou, Yu Zhang et al.
Researchers make an LLM justify every static analysis verdict with program relations that a checker verifies, then generate inputs that reproduce the bugs. It turns tens of thousands of noisy alerts into a short list of confirmed defects, which is useful to maintainers and equally useful to anyone hunting for exploitable code.
Reviewing Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems · Linda Beková and Rodrigo Alves
Researchers show that the language embeddings recommenders use to describe items can be matched back to real titles with a simple similarity search against public text. Those identified items can then help re-identify users from a few ratings, and rewriting descriptions to hide them reduces the leak but does not remove it.
Reviewing Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming · Gosha Kozhevnikov and Tyler Tracy
Researchers rewrite real coding-agent transcripts so that harm happens inside them, then revise the edits until a monitor stops flagging them. Some of the resulting attacks also evade a frontier developer's held-out monitor. This shows that monitors which only read an agent's actions have blind spots an outsider can find.
Reviewing CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection · Qichen Zhao, Shengfang Zhai, Qingni Shen et al.
Researchers split a malicious operation across several cooperating agent skills, so each package looks benign on its own but the workflow links them into an attack. The composition exfiltrates credentials, tampers with state, or runs unauthorised scripts while passing per-package audits almost every time.
Reviewing TRACER: Trace-Regularized Training Against Indirect Prompt Injection · Kshitij Mishra, Salem Lahlou, Nils Lukas
Researchers show that the same indirect prompt injection succeeds far more often when it arrives as retrieved content than as a chat message. Their channel-aware training sharply cuts attack success on small models, but it has only been tested against templated attacks, and the clearest lesson is to test every channel an agent reads.
Reviewing Nudge the Judge: Uncovering Program Decision Hijacking in Real-World Jev Applications · Yang Luo, Tiantian Ji, Zifeng Kang et al.
Researchers show that attacker-written input can push a judgement model into returning perfectly formatted but wrong verdicts, flipping the decisions that application code acts on. Most tested open-source applications were affected, and standard prompt-injection defences barely helped, because the schema checks the shape of an answer rather than whether it is true.
Reviewing When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems · Sunday Oyinlola Ogundoyin and Muhammad Ikram
Researchers show that in multi-agent LLM systems, protected values reach unauthorised agents through routine forwarding, with no attack required. A recipient-aware sanitiser keeps authorised flows working far better than blanket redaction, but it is capped by detection: most of what still leaks was never recognised as sensitive in the first place.
Reviewing ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary · Md Nazmul Islam Ananto, Pierre Prevost-Avenel, Colin Smith et al.
Researchers fuzzing real agent tools find that many never enforce the input rules their own descriptions promise. Path traversal, request forgery and command injection reach tool code because developers assume the model will only send sensible arguments, and that assumption does not hold once an attacker can steer the model.
Reviewing Ecology of AI Agents: Collaboration Creates a Population Threshold for Takeoff · Erin Crawley and Hidenori Tanaka
The researchers model misaligned AI agent populations as an ecology and find that collaboration creates a critical population size: below it the group declines, above it the group grows on its own, with no change in individual capability. That means red teaming a single agent or a small group cannot show whether a larger population stays contained.
Reviewing Constrained-Action AI Remediation for SIEM/XDR via a NeMo-Guardrails Proxy · Georgios Koutidis, Nikolaos Kekatos, Tom Nianios et al.
Researchers wrap an alert-triage LLM in guardrail rails and confine it to a closed list of remediation intents with validated arguments. The rails catch most injected log lines but add heavy latency, and the simple, constrained action layer is what actually stops a misled model from touching production hosts.
Reviewing Does On-Policy Distillation for Safety Pose Backdoor Risks? · Jian Luo, Kehan Qi, Qingqiao Hu et al.
Researchers show that distilling safety behaviour from a backdoored teacher can implant a hidden trigger in a clean student, even with a small amount of poisoned data. The student looks safer on standard tests, longer training and a common shortcut speed the transfer, and the proposed defence only delays it.
Reviewing Jailbreaking Open-Weight LLMs via Random Embedding Perturbations · Abhinav Sudhakar Dubey, Scott Sirri, Vaggos Chatziafratis et al.
Researchers show that adding random noise to a prompt's internal embedding, then retrying, gets unsafe answers from six open-weight models on every benchmark prompt, usually within a minute. It needs access to the embedding input, so the real lesson is how thin and fragile refusal behaviour sits around a harmful request.
Reviewing Pareto-Improving Adversarial Attacks with Primal-Dual Regularization · Yang Dai, Longfei Zhang, Wei Tao et al.
Researchers show that the supposed trade-off between how well an adversarial image transfers and how visible its noise is comes from comparing attacks at one fixed budget. A lightweight wrapper then makes strong transfer attacks look cleaner without losing success. Defences tested at a single budget face the weaker version of the threat.
Reviewing Security of The Model Context Protocol Ecosystem: Emerging Threats, Empirical Attack Evidence, Trust and Authorization Failures, Supply-Chain Risks, And Defensive Strategies · Khalid D. Muhammed and David Chinonso Anih
A review of Model Context Protocol security finds that crafted tool descriptions can steer which tools an agent picks and what it runs, with no malicious prompt from the user. It matters because authenticating a server proves who wrote the text, not whether the agent should act on it.
Reviewing Evaluating Coding Agents on Kernel Exploit Generation · Junyoung Jang, Gwanhyun Lee, Hwiwon Lee et al.
Researchers built a benchmark to test whether coding agents can turn kernel bugs into real exploit primitives across dozens of Linux and Windows CVEs. Agents often reach crashes but fail to shape kernel state into usable primitives, and handing them a reference exploit lifts success sharply.
Reviewing Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection · Fernando Outeda, Gustavo Betarte, Juan Diego Campo et al.
Researchers use explanation tools to see which words Prompt Guard 2 relies on, then swap or paraphrase those words until the guardrail misses injections it would have caught. Missed attacks lack the familiar override phrasing the classifier keys on, so the guardrail is a weaker first line than it looks.
One email a week with the few papers worth your time.
