AI Security Trend Roundup — May 01, 2026

Covering Apr 24 → May 01, 2026. 37 new items from 8 tracked sources.

This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.

Standards & Frameworks

• FinBot CTF Is Live: A Hands-On Companion to the OWASP GenAI Security Project

Source: OWASP GenAI Security Project — Apr 14 At RSAC 2026, the community got an early look at FinBot through the OWASP GenAI Security Summit and Open Workshop, including the session “FinBot: An Agentic AI Capture-The-Flag Deep Dive.” FinBot was also showcased at AppSec Village in “AI Risks Through the OWASP GenAI Security P

Government Advisories

• Careful Adoption of Agentic AI Services

Source: CISA Cybersecurity Advisories — May 01 CISA, in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and other international and U.S. partners, released guidance for organizations on adopting agentic artificial intelligence (AI) systems. This guide outlines key security

Academic & Research

• Agent Name Service (ANS): A Proof-of-Concept Trust Layer for Secure AI Agent Discovery, Identity, and Governance in Kubernetes

Source: arXiv cs.CR — May 01 arXiv:2604.26997v1 Announce Type: new Abstract: Autonomous AI agent ecosystems require stronger mechanisms for secure discovery, identity verification, capability attestation, and policy governance. Current deployments frequently lack (1) uniform agent discovery, (2) cryptographi

• An Empirical Security Evaluation of LLM-Generated Cryptographic Rust Code

Source: arXiv cs.CR — May 01 arXiv:2604.27001v1 Announce Type: new Abstract: Developers and organizations are using Large Language Models (LLMs) to generate security-critical code more frequently than ever, including cryptographic solutions for their products. This study presents an empirical evaluation of c

• Enhancing Linux Privilege Escalation Attack Capabilities of Local LLM Agents

Source: arXiv cs.CR — May 01 arXiv:2604.27143v1 Announce Type: new Abstract: Recent research has demonstrated the potential of Large Language Models (LLMs) for autonomous penetration testing, particularly when using cloud-based restricted-weight models. However, reliance on such models introduces security, p

• Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives

Source: arXiv cs.CR — May 01 arXiv:2604.27202v1 Announce Type: new Abstract: As LLMs are increasingly integrated into systems that browse, retrieve, summarize, and act on web content, webpages have become an untrusted input vector for downstream model behavior. This enables site owners, contributors, and adv

• SafeTune: Mitigating Data Poisoning in LLM Fine-Tuning for RTL Code Generation

Source: arXiv cs.CR — May 01 arXiv:2604.27238v1 Announce Type: new Abstract: As large language models (LLMs) are increasingly fine-tuned for hardware tasks like RTL code generation, the scarcity of high-quality datasets often leads to the use of rapidly assembled or generated training data. These datasets fr

• From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systems

Source: arXiv cs.CR — May 01 arXiv:2604.27267v1 Announce Type: new Abstract: As large language models are integrated into autonomous robotic systems for task planning and control, compromised inputs or unsafe model outputs can propagate through the planning pipeline to physical-world consequences. Although p

• Toward Autonomous SOC Operations: End-to-End LLM Framework for Threat Detection, Query Generation, and Resolution in Security Operations

Source: arXiv cs.CR — May 01 arXiv:2604.27321v1 Announce Type: new Abstract: Security Operations Centers (SOCs) face mounting operational challenges. These challenges come from increasing threat volumes, heterogeneous SIEM platforms, and time-consuming manual triage workflows. We present an end-to-end threat

• Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoors

Source: arXiv cs.CR — May 01 arXiv:2604.27426v1 Announce Type: new Abstract: Local fine-tuning datasets routinely contain sensitive secrets such as API keys, personal identifiers, and financial records. Although ''local offline fine-tuning'' is often viewed as a privacy boundary, we reveal that compromised m

• Tracking Conversations: Measuring Content and Identity Exposure on AI Chatbots

Source: arXiv cs.CR — May 01 arXiv:2604.27438v1 Announce Type: new Abstract: AI chatbots are becoming a primary interface for seeking information. As their popularity grows, chatbot providers are starting to deploy advertising and analytics. Despite this, tracking on AI chatbots has not been systematically s

• Secure Cross-Silo Synthetic Genomic Data Generation

Source: arXiv cs.CR — May 01 arXiv:2604.27456v1 Announce Type: new Abstract: Access to genomic data is highly regulated due to its sensitive nature. While safeguards are essential, cumbersome data access processes pose a significant barrier to the development of AI methods for genomics. Synthetic data genera

• Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study

Source: arXiv cs.CR — May 01 arXiv:2604.27464v1 Announce Type: new Abstract: Autonomous agent frameworks built upon large language models (LLMs) are evolving into complex, tool-integrated, and continuously operating systems, introducing security risks beyond traditional prompt-level vulnerabilities. As this

• VOW: Verifiable and Oblivious Watermark Detection for Large Language Models

Source: arXiv cs.CR — May 01 arXiv:2604.27666v1 Announce Type: new Abstract: Large Language Model (LLM) watermarking is crucial for establishing the provenance of machine-generated text, but most existing methods rely on a centralized trust model. This model forces users to reveal potentially sensitive text

• How Code Representation Shapes False-Positive Dynamics in Cross-Language LLM Vulnerability Detection

Source: arXiv cs.CR — May 01 arXiv:2604.27714v1 Announce Type: new Abstract: How code representation format shapes false positive behaviour in cross-language LLM vulnerability detection remains poorly understood. We systematically vary training intensity and code representation format, comparing raw source t

• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning

Source: arXiv cs.CR — May 01 arXiv:2604.27861v1 Announce Type: new Abstract: Decompositional jailbreaks pose a critical threat to large language models (LLMs) by allowing adversaries to fragment a malicious objective into a sequence of individually benign queries that collectively reconstruct prohibited cont

• Latent Adversarial Detection: Adaptive Probing of LLM Activations for Multi-Turn Attack Detection

Source: arXiv cs.CR — May 01 arXiv:2604.28129v1 Announce Type: new Abstract: Multi-turn prompt injection follows a known attack path -- trust-building, pivoting, escalation but text-level defenses miss covert attacks where individual turns appear benign. We show this attack path leaves an activation-level si

Prompt Injection & LLM Security

• Codex CLI 0.128.0 adds /goal

Source: Simon Willison — Apr 30 Codex CLI 0.128.0 adds /goal The latest version of OpenAI's Codex CLI coding agent adds their own version of the Ralph loop: you can now set a /goal and Codex will keep on looping until it evaluates that the goal has been completed... or the configured token budget has been exhau

• Our evaluation of OpenAI's GPT-5.5 cyber capabilities

Source: Simon Willison — Apr 30 Our evaluation of OpenAI's GPT-5.5 cyber capabilities The UK's AI Security Institute previously evaluated Claude Mythos: now they've evaluated GPT-5.5 for finding security vulnerability and found it to be comparable to Mythos, but unlike Mythos it's generally available right

• Quoting Andrew Kelley

Source: Simon Willison — Apr 30 It's a common misconception that we can't tell who is using LLM and who is not. I'm sure we didn't catch 100% of LLM-assisted PRs over the past few months, but the kind of mistakes humans make are fundamentally different than LLM hallucinations, making them easy to spot. Furtherm

• We need RSS for sharing abundant vibe-coded apps

Source: Simon Willison — Apr 30 We need RSS for sharing abundant vibe-coded apps Matt Webb: I would love an RSS web feed for all those various tools and apps pages, each item with an “Install” button. (But install to where?) The lesson here is that when vibe-coding accelerates app development, apps become more

• The Zig project's rationale for their firm anti-AI contribution policy

Source: Simon Willison — Apr 30 Zig has one of the most stringent anti-LLM policies of any major open source project: No LLMs for issues. No LLMs for pull requests. No LLMs for comments on the bug tracker, including translation. English is encouraged, but not required. You are welcome to post in your native lan

• llm 0.32a1

Source: Simon Willison — Apr 29 Release: llm 0.32a1 Fixed a bug in 0.32a0 where tool-calling conversations were not correctly reinflated from SQLite. #1426 Tags: llm

• LLM 0.32a0 is a major backwards-compatible refactor

Source: Simon Willison — Apr 29 I just released LLM 0.32a0, an alpha release of my LLM Python library and CLI tool for accessing LLMs, with some consequential changes that I've been working towards for quite a while. Previous versions of LLM modeled the world in terms of prompts and responses. Send the model a

• llm 0.32a0

Source: Simon Willison — Apr 29 Release: llm 0.32a0 See the annotated release notes. Tags: llm

• Quoting OpenAI Codex base_instructions

Source: Simon Willison — Apr 28 Never talk about goblins, gremlins, raccoons, trolls, ogres, pigeons, or other animals or creatures unless it is absolutely and unambiguously relevant to the user's query. — OpenAI Codex base_instructions, for GPT-5.5 Tags: openai, ai, llms, system-prompts, prompt-engineeri

• Quoting Matthew Yglesias

Source: Simon Willison — Apr 28 Five months in, I think I've decided that I don't want to vibecode — I want professionally managed software companies to use AI coding assistance to make more/better/cheaper software products that they sell to me for money. — Matthew Yglesias Tags: agentic-engineering, vibe

• What's new in pip 26.1 - lockfiles and dependency cooldowns!

Source: Simon Willison — Apr 28 What's new in pip 26.1 - lockfiles and dependency cooldowns! Richard Si describes an excellent set of upgrades to Python's default pip tool for installing dependencies. This version drops support for Python 3.9 - fair enough, since it's been EOL since October. macOS still sh

• Introducing talkie: a 13B vintage language model from 1930

Source: Simon Willison — Apr 28 Introducing talkie: a 13B vintage language model from 1930 New project from Nick Levine, David Duvenaud, and Alec Radford (of GPT, GPT-2, Whisper fame). talkie-1930-13b-base (53.1 GB) is a "13B language model trained on 260B tokens of historical pre-1931 English text". talkie-193

• microsoft/VibeVoice

Source: Simon Willison — Apr 27 microsoft/VibeVoice VibeVoice is Microsoft's Whisper-style audio model for speech-to-text, MIT licensed and with speaker diarization built into the model. Microsoft released it on January 21st, 2026 but I hadn't tried it until today. Here's a one-liner to run it on a Mac with uv,

• Tracking the history of the now-deceased OpenAI Microsoft AGI clause

Source: Simon Willison — Apr 27 For many years, Microsoft and OpenAI's relationship has included a weird clause saying that, should AGI be achieved, Microsoft's commercial IP rights to OpenAI's technology would be null and void. That clause appeared to end today. I decided to try and track its expression over t

• Speech translation in Google Meet is now rolling out to mobile devices

Source: Simon Willison — Apr 27 Speech translation in Google Meet is now rolling out to mobile devices I just encountered this feature via a "try this out now" prompt in a Google Meet meeting. It kind-of worked! This is Google's implementation of the ultimate sci-fi translation app, where two people can talk to

• WHY ARE YOU LIKE THIS

Source: Simon Willison — Apr 25 @scottjla on Twitter in reply to my pelican riding a bicycle benchmark: I feel like we need to stack these tests now I checked to confirm that the model (ChatGPT Images 2.0) added the "WHY ARE YOU LIKE THIS" sign of its own accord and it did - the prompt Scott used was: Create an

• Quoting Romain Huet

Source: Simon Willison — Apr 25 Since GPT-5.4, we’ve unified Codex and the main model into a single system, so there’s no separate coding line anymore. GPT-5.5 takes this further, with strong gains in agentic coding, computer use, and any task on a computer. — Romain Huet, confirming OpenAI won't release

• GPT-5.5 prompting guide

Source: Simon Willison — Apr 25 GPT-5.5 prompting guide Now that GPT-5.5 is available in the API, OpenAI have released a wealth of useful tips on how best to prompt the new model. Here's a neat trick they recommend for applications that might spend considerable time thinking before returning a user-visible resp

• llm 0.31

Source: Simon Willison — Apr 24 Release: llm 0.31 New GPT-5.5 OpenAI model: llm -m gpt-5.5. #1418 New option to set the text verbosity level for GPT-5+ OpenAI models: -o verbosity low. Values are low, medium, high. New option for setting the image detail level used for image attachments to OpenAI models: -o ima

• The people do not yearn for automation

Source: Simon Willison — Apr 24 The people do not yearn for automation This written and video essay by Nilay Patel explores why AI is unpopular with the general public even as usage numbers for ChatGPT continue to skyrocket. It’s a superb piece of commentary, and something I expect I’ll be thinking about for a

---

Source List

All sources tracked in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project — feed: https://genai.owasp.org/feed/
• Simon Willison — feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR — feed: http://export.arxiv.org/rss/cs.CR
• Protect AI — feed: https://protectai.com/blog/rss.xml
• Google Project Zero — feed: https://googleprojectzero.blogspot.com/feeds/posts/default
• CISA Cybersecurity Advisories — feed: https://www.cisa.gov/cybersecurity-advisories/all.xml
• NIST Cybersecurity News — feed: https://www.nist.gov/news-events/cybersecurity/rss.xml
• Hacker News (AI Security) — feed: https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20