#security News & Analysis

Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

No Accidental Software Agent First Canonical Code for Human Code Entropy Reduction and 30 to 500 times Lower Frontier Model Requirements

Same-Origin Policy for Agentic Browsers

Securing the Future of IoMT in the Post-Quantum Era: An Edge-Native Federated Learning Approach

Safety-Contract Graph Multi-Agent Reinforcement Learning for Autonomous Network Security Response

Giving AI a Headache: Acoustic Adversarial Attacks to Computer Vision Applications

SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents

MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems

PolicyGuard: Towards Test-time and Step-level Adversary Defense for Reinforcement Learning Agent

Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

The Internet of Agentic AI: Communication, Coordination, and Collective Intelligence at Scale

SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems

Beyond Runtime Enforcement: Shield Synthesis as Defensibility Analysis for Adversarial Networks

PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections

US Homeland Security chief defends visa denials as World Cup begins

US Homeland Security officials defended visa denial decisions as the World Cup begins, creating friction between national security protocols and international sports diplomacy. The incident reflects broader tensions between immigration enforcement and global engagement, potentially affecting perceptions of US participation in international events.

Towards Responsibly Non-Compliant Machines

A new research paper proposes frameworks for building autonomous AI agents capable of responsibly refusing user requests rather than blindly complying with all commands. The work addresses how machines should justify non-compliance, allow override mechanisms, and manage associated security and liability risks.

Raydium DEX’s AMM Program Exploited For $1.34 Million — Here’s What Went Wrong

Raydium, a Solana-based DEX, suffered a $1.34 million exploit on its deprecated AMM V3 program due to insufficient validation of LP mint addresses, allowing an attacker to drain approximately 150,000 RAY, 5,600 SOL, and 900,000 USDC. The stolen funds were subsequently laundered across Solana and Ethereum through KuCoin and mixing services including Tornado Cash.

7 Factors That Actually Matter When Choosing a Crypto Swap Platform

The article discusses seven critical factors users should evaluate when selecting a cryptocurrency swap platform, with leading platforms prioritizing speed, security, and diverse asset availability. This reflects growing market demand for reliable, efficient trading infrastructure as crypto swaps gain mainstream adoption.

SwissBorg introduces withdrawal protection to combat physical extortion

SwissBorg has introduced a withdrawal protection feature designed to prevent crypto theft through physical coercion or 'wrench attacks.' This security mechanism prioritizes user safety by adding friction to withdrawal processes, potentially reshaping how cryptocurrency platforms balance accessibility with protection against forcible asset seizure.

Microsoft fixes high-severity zero-day disclosed by researcher Nightmare Eclipse

Microsoft has patched a high-severity zero-day vulnerability that was disclosed by security researcher Nightmare Eclipse. The incident highlights the importance of coordinated vulnerability disclosure and timely patch management in defending against sophisticated cyber threats.

Model Multiplicity for Adversarial Detection in Small Language Model Training on Edge Devices

Researchers propose a novel defense mechanism called model multiplicity to detect poisoning attacks in distributed small language model training on edge devices. Instead of maintaining a single global model, the system trains multiple independent models on different device subsets, using divergence between them to identify adversarial behavior—outperforming traditional single-model defenses.

Safe-RULE: Safe Reinforcement UnLEarning

Researchers propose Safe-RULE, a new reinforcement unlearning framework designed to defend offline safe reinforcement learning systems against data poisoning attacks. The approach removes malicious data influence without requiring model retraining or access to original training environments, addressing a critical vulnerability in safety-critical applications like robotics.

CoQuIR: A Comprehensive Benchmark for Code Quality-Aware Information Retrieval

Researchers introduce CoQuIR, a comprehensive benchmark for evaluating code retrieval systems across quality dimensions including correctness, efficiency, security, and maintainability. Testing 23 retrieval models reveals that even top performers struggle to distinguish high-quality code from buggy or insecure alternatives, with preliminary training methods showing promise in improving quality-awareness without sacrificing semantic relevance.

Step-Wise Refusal Dynamics in Autoregressive and Diffusion Language Models

Researchers demonstrate that diffusion language models exhibit superior jailbreak robustness compared to autoregressive models due to their sampling mechanisms' ability to recover from harmful intermediate generations. They introduce a Step-Wise Refusal Internal Dynamics (SRI) signal that enables effective jailbreak detection without modifying inference, generalizing to unseen attacks.

Ripple CTO Emeritus Breaks Down Zcash Paradox: Why 'Lonely' Coins Aren't Lost

Ripple CTO Emeritus David Schwartz clarifies misconceptions about Zcash's security vulnerability and the Ironwood upgrade, explaining that passive token holders face no risk of fund loss despite the critical flaw. The reassurance addresses widespread concern about the privacy-focused cryptocurrency's integrity following disclosure of the vulnerability.