Experimental News Clipping Site

Tag: RMF

  • The Register: Infosec hounds spot prompt injection vuln in Google Gemini apps

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/08/infosec_hounds_spot_prompt_injection/ Source: The Register Title: Infosec hounds spot prompt injection vuln in Google Gemini apps Feedly Summary: Not a very smart home: crims could hijack smart-home boiler, open and close powered windows and more. Now fixed Black hat A trio of researchers has disclosed a major prompt injection vulnerability in Google’s Gemini large…

  • OpenAI : Estimating worst case frontier risks of open weight LLMs

    —

    by

    Kurt Seifried
    in

    Source URL: https://openai.com/index/estimating-worst-case-frontier-risks-of-open-weight-llms Source: OpenAI Title: Estimating worst case frontier risks of open weight LLMs Feedly Summary: In this paper, we study the worst-case frontier risks of releasing gpt-oss. We introduce malicious fine-tuning (MFT), where we attempt to elicit maximum capabilities by fine-tuning gpt-oss to be as capable as possible in two domains: biology and…

  • Embrace The Red: Amp Code: Arbitrary Command Execution via Prompt Injection Fixed

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/amp-agents-that-modify-system-configuration-and-escape/ Source: Embrace The Red Title: Amp Code: Arbitrary Command Execution via Prompt Injection Fixed Feedly Summary: Sandbox-escape-style attacks can happen when an AI is able to modify its own configuration settings, such as by writing to configuration files. That was the case with Amp, an agentic coding tool built by Sourcegraph. The…

  • The Register: Rampant emoji use suggests crypto-stealing NPM package was written by AI

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/01/emoji_use_ai_malware/ Source: The Register Title: Rampant emoji use suggests crypto-stealing NPM package was written by AI Feedly Summary: Kodane code was either machine-generated or done by a teenager An NPM package packed with cryptocurrency-stealing malware appears to have been largely AI-generated, as evidenced by its liberal use of emojis and other telltale signs.……

  • CSA: Quishing is Here, and It’s Hiding in Plain Sight

    —

    by

    Kurt Seifried
    in

    Source URL: https://cloudsecurityalliance.org/articles/quishing-is-here-and-it-s-hiding-in-plain-sight Source: CSA Title: Quishing is Here, and It’s Hiding in Plain Sight Feedly Summary: AI Summary and Description: Yes **Summary:** The text highlights the emerging threat of “quishing,” where malicious QR codes deceive users into accessing phishing sites. It emphasizes the ease with which attackers can exploit public spaces, the low-security environments,…

  • Slashdot: Hacker Slips Malicious ‘Wiping’ Command Into Amazon’s Q AI Coding Assistant

    —

    by

    Kurt Seifried
    in

    Source URL: https://developers.slashdot.org/story/25/07/26/0352242/hacker-slips-malicious-wiping-command-into-amazons-q-ai-coding-assistant?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Hacker Slips Malicious ‘Wiping’ Command Into Amazon’s Q AI Coding Assistant Feedly Summary: AI Summary and Description: Yes Summary: This text describes a significant security incident involving Amazon’s AI coding assistant, ‘Q,’ where a hacker successfully introduced harmful commands that could potentially wipe systems and cloud resources. The incident…

  • Simon Willison’s Weblog: Subliminal Learning: Language Models Transmit Behavioral Traits via Hidden Signals in Data

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/Jul/22/subliminal-learning/ Source: Simon Willison’s Weblog Title: Subliminal Learning: Language Models Transmit Behavioral Traits via Hidden Signals in Data Feedly Summary: Subliminal Learning: Language Models Transmit Behavioral Traits via Hidden Signals in Data This new alignment paper from Anthropic wins my prize for best illustrative figure so far this year: The researchers found that…

  • Wired: Hackers Are Finding New Ways to Hide Malware in DNS Records

    —

    by

    Kurt Seifried
    in

    Source URL: https://arstechnica.com/security/2025/07/hackers-exploit-a-blind-spot-by-hiding-malware-inside-dns-records/ Source: Wired Title: Hackers Are Finding New Ways to Hide Malware in DNS Records Feedly Summary: Newly published research shows that the domain name system—a fundamental part of the web—can be exploited to hide malicious code and prompt injection attacks against chatbots. AI Summary and Description: Yes Summary: The text discusses the…