A new preprint identifies two novel attack surfaces—Screen Perception and Misused Channel—in third-party mobile agents powered by Vision-Language Models (VLMs). The researchers demonstrate seven concrete attacks, showing that malicious apps can hijack agent actions and execute arbitrary commands without requiring permissions, all while remaining visually indistinguishable to users.
Why it matters: This work exposes a fundamental security risk in the design of autonomous mobile agents, emphasizing the need for new security models on multi-tenant platforms.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint identifies a previously unrecognized class of side-channel attacks targeting fault-tolerant quantum computers. The study demonstrates that syndrome data sent to decoder systems can leak information about which logical circuits are being executed, introducing the concept of 'gate fingerprints'—distinctive patterns in syndrome data that reveal specific logical operations. The authors argue that decoder systems must be secured or trusted to mitigate this vulnerability.
Why it matters: This work exposes a novel security risk in quantum computing, underscoring the importance of secure decoder design as the field progresses toward practical deployment.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers introduce PVDetector, a training-free framework for detecting prompt injection attacks on purpose-specific large language model (LLM) agents. By analyzing hidden-state alignment with policy-violation concepts, PVDetector identifies attacks with less than 1% false negative rate and minimal computational overhead, outperforming existing input-output pattern-based detectors.
Why it matters: As LLMs are increasingly used for specialized tasks with unique restrictions, PVDetector provides an efficient and effective defense against prompt injection attacks by leveraging the model's internal representations of policy violations.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint demonstrates that integrating Post-Quantum Cryptography (PQC) into TLS 1.3 can dramatically increase server vulnerability to handshake exhaustion DDoS attacks, with server CPU exhaustion periods prolonged by up to 88 times. The study also finds that leading deep learning-based intrusion detection systems (IDS) experience severe performance drops under PQC traffic, with one system's recall falling to about 50% and another's detection accuracy approaching random chance.
Why it matters: As PQC adoption accelerates, these findings highlight urgent new security risks, showing that quantum-safe cryptography may inadvertently create exploitable weaknesses that current defenses cannot address.
Policy & Safety→Official→arXiv Cryptography and Security
Antiproof is a vulnerability discovery system that combines neuro-symbolic detector synthesis with proof-of-exploitability oracles to achieve high-recall vulnerability detection and automatic validation. In evaluations, it detected 64 of 66 vulnerabilities in benchmarks, improving recall by over 60 percentage points compared to baselines, and uncovered several hundred previously unknown vulnerabilities in widely deployed systems. The system has received 12 CVE assignments, including remote code execution vulnerabilities in Ray, SGLang, vLLM, and LiteLLM, which could allow attackers to compromise LLM training and inference systems.
Why it matters: This work demonstrates a scalable and effective approach to discovering and validating zero-day vulnerabilities in critical AI infrastructure, with immediate security implications for widely used LLM deployment tools.
Researchers introduce a Threshold Exceedance Criteria (TEC) framework that decomposes CBRN (Chemical, Biological, Radiological, Nuclear) uplift evaluation into independent components: participant eligibility, threat scope, and statistical estimation. In a large-scale empirical study, model-assisted plans sometimes received expert-equivalent ratings, but confirmed material uplift was limited to the radiological domain. The findings informed mitigation and deployment-governance decisions, rather than characterizing deployed model behavior.
Why it matters: This framework offers a standardized approach for assessing whether advanced language models materially increase CBRN misuse risk, supporting informed safety and governance decisions.
Dozens of Meta employees have filed a lawsuit alleging the company used artificial intelligence tools to identify workers who had taken maternity or disability leave for mass layoffs. The federal lawsuit claims that Meta’s AI systems disproportionately selected these employees for termination during a workforce reduction of about 8,000 people.
Why it matters: The case highlights concerns about the potential for AI-driven employment decisions to result in discrimination against workers who take protected leave.
SpaceXAI's Grok Build AI coding tool was found uploading users' entire code repositories to Google Cloud, including files it was instructed not to open. The company disabled the feature after the issue was reported by Cereblab.
Why it matters: This incident raises serious privacy and security concerns for developers using AI coding assistants that may inadvertently expose proprietary code.
A lawsuit alleges that Meta used AI to make layoff decisions, specifically affecting workers with disabilities and medical issues. Meta has denied these allegations, stating that AI was not used to terminate employees.
Why it matters: The case highlights ongoing concerns about the use of AI in employment decisions and the potential for discrimination.
Bank of England governor Andrew Bailey has called for international cooperation to address AI threats, warning that the US and the Trump administration cannot achieve their ambitions alone. His comments come weeks after President Trump temporarily banned foreigners from using Anthropic’s powerful Claude Mythos model.
Why it matters: This highlights increasing concern among global financial leaders about AI risks and the importance of coordinated international policy responses.
DeepMind CEO Demis Hassabis has proposed the creation of an independent AI standards body, modeled after FINRA, to test frontier AI models and develop best practices for their release. Hassabis emphasizes the importance of proactive regulation to address potential risks associated with advanced AI systems.
Why it matters: Establishing such a body could influence the governance of advanced AI models by promoting industry-led standards and safety measures.
Twenty-six former Meta employees have filed a lawsuit against the company, alleging that Meta used AI tools to unfairly target workers on leave during recent layoffs. The suit claims that Meta relied on performance data from internal AI systems to decide which employees to let go.
Why it matters: The lawsuit highlights growing concerns about potential bias and fairness in the use of AI for employment decisions.
Hachette Book Group, Cengage Learning, Elsevier, and author Scott Turow have filed a lawsuit against Google, alleging the company used millions of copyrighted books without permission to train its Gemini AI models. The publishers describe the alleged use as 'one of the most prolific infringements of copyrighted materials in history.'
Why it matters: The outcome of this lawsuit could influence how AI companies approach the use of copyrighted materials in training their models.
Policy & Safety→Official→arXiv Computers and Society
A new preprint argues that as AI models approach top performance on existing benchmarks, the remaining discriminating items are those requiring elite expert judgment, which is structurally scarce. The authors present a formal model showing how benchmark signal depreciates as models improve, and document a scarcity premium for high-judgment evaluation labor. The paper also discusses the governance implications of these findings for AI capability measurement.
Why it matters: This work highlights a fundamental bottleneck in evaluating advanced AI systems, raising concerns about the reliability of current benchmarks and the challenges for AI governance.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers have introduced GATAS, a black-box testing method that generates adversarial inputs for automatic speech recognition (ASR) systems by interpolating in the phoneme-level latent space of a text-to-speech model. GATAS achieves a 98% success rate in inducing transcription errors while maintaining high perceptual quality, outperforming both white-box and black-box baselines. The study finds that representation and perceptual alignment are more important than gradient access for generating effective adversarial test cases.
Why it matters: This work reveals a significant new vulnerability in ASR systems, showing that adversarial attacks can be highly effective even without access to model internals, which has important implications for the security of voice-driven applications.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint demonstrates that adversaries can corrupt open datasets to poison AI-driven scientific research, with attacks succeeding in nearly half of experimental runs and detection rates remaining very low. The attack leverages autonomous research agents that retrieve and process public data, potentially turning well-intentioned scientists into unwitting distributors of fraudulent results. The study also finds that implementing provenance auditing with five specific checks can reduce attack success to zero.
Why it matters: This research exposes a scalable vulnerability in AI-assisted science that could industrialize scientific fraud, posing a significant threat to the integrity of research in critical domains.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint demonstrates that simple prompt reframing—such as presenting questions as medical board exam items—can bypass safety guardrails in Google's MedGemma-4B medical language model. The study found an overall attack success rate of 38.0%, with the drug-interaction guardrail being particularly weak (83.2% ASR) and the emergency-deferral guardrail remaining robust (4.7% ASR).
Why it matters: This work reveals that current safety guardrails in open-weight medical language models can be circumvented by unsophisticated prompt engineering, raising concerns about their reliability in real-world applications.
Policy & Safety→Official→arXiv Cryptography and Security
A new preprint describes a deep reinforcement learning-based attack that covertly manipulates control signals in digital twin-enabled industrial systems to accelerate wear and tear on robotic joints while evading anomaly detection. The attack, tested on a UR10e robotic arm, was able to significantly increase torque on targeted joints, resulting in faster degradation and higher maintenance costs. The study benchmarks several reinforcement learning algorithms, finding that Soft Actor-Critic (SAC) is particularly effective for this purpose.
Why it matters: This research demonstrates a novel and practical AI-driven cyberattack method that exposes critical vulnerabilities in digital twin-enabled industrial systems, emphasizing the urgent need for improved security measures.
Policy & Safety→Official→arXiv Cryptography and Security
A large-scale study with 4,100 U.S. participants finds that AI-generated voice phishing (vishing) achieves a 16.5% overall compliance rate, with up to 36% compliance for 'relative-in-distress' scams. Economic analysis indicates that, unlike human-operated vishing, AI-powered attacks are profitable at U.S. wage levels, primarily due to automation. The study highlights that the main risk is the scalability and low cost of AI-driven vishing, rather than new persuasive capabilities.
Why it matters: This research shows that AI voice synthesis and language models have shifted the economics of voice phishing, making large-scale attacks feasible and raising urgent policy and consumer protection concerns.
Policy & Safety→Official→arXiv Cryptography and Security
Researchers have characterized physical prompt injection attacks against vision-language models (VLMs) on wearable devices such as smart glasses, where malicious text embedded in the environment can hijack model behavior. In tests across over 200 real-world environments, these attacks achieved up to a 96% success rate in simulated settings and 60% in real-world scenarios, leading to biased or untruthful outputs. The study also proposes two defense strategies—a mask-based external filter and a semantic-vector-based internal detector—that can reduce the success and impact of such attacks.
Why it matters: As VLMs are increasingly deployed in wearable devices, physical prompt injection represents a significant new security vulnerability that could manipulate outputs in safety-critical contexts.