AI Security Trend Roundup — May 08, 2026

Covering May 01 → May 08, 2026. 52 new items from 8 tracked sources.

This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.

Academic & Research

• SecureMCP: A Policy-Enforced LLM Data Access Framework for AIoT Systems via Model Context Protocol

Source: arXiv cs.CR — May 08 arXiv:2605.05260v1 Announce Type: new Abstract: The deployment of Large Language Model (LLM)-generated SQL queries in Artificial Intelligence of Things (AIoT) systems introduces critical security risks, as prompt injection attacks can manipulate LLMs into producing unauthorized q

• Dynamic Authorization for Knowledge-Base Agents in 6G

Source: arXiv cs.CR — May 08 arXiv:2605.05269v1 Announce Type: new Abstract: As 6G architectures transition toward decentralized Multi-Agent Systems (MAS), ensuring secure access to shared Knowledge Bases (KB) is critical. Traditional authorization models like RBAC fail to provide the granularity required fo

• Sealing the Audit-Runtime Gap for LLM Skills

Source: arXiv cs.CR — May 08 arXiv:2605.05274v1 Announce Type: new Abstract: Large language model (LLM) ecosystems such as Claude Code and ChatGPT increasingly rely on skills: packages of natural-language instructions and executable tools. Once in the LLM's context, skill content cannot be reliably separated

• GLiNER Guard: Unified Encoder Family for Production LLM Safety and Privacy

Source: arXiv cs.CR — May 08 arXiv:2605.05277v1 Announce Type: new Abstract: Production LLM systems require both safety moderation and PII detection under strict latency and cost constraints. This creates a trade-off: autoregressive moderators are accurate but expensive, while lightweight encoders are faster

• Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use

Source: arXiv cs.CR — May 08 arXiv:2605.05287v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) and agentic AI systems are increasingly prevalent in enterprise AI deployments. However, real enterprise environments introduce challenges largely absent from academic treatments and consumer-fac

• Privacy Without Losing Place: A Paradigm for Private Retrieval in Spatial RAGs

Source: arXiv cs.CR — May 08 arXiv:2605.05459v1 Announce Type: new Abstract: This work introduces PAS -- Privacy Anchor Substitution, a structured mechanism for enabling user location privacy in spatial retrieval-augmented generation (RAG) systems. Unlike conventional differential privacy methods that direct

• SOCpilot: Verifying Policy Compliance for LLM-Assisted Incident Response

Source: arXiv cs.CR — May 08 arXiv:2605.05501v1 Announce Type: new Abstract: Security operations centers (SOCs) are beginning to use large language models (LLMs) as copilots to draft incident-response plans. These plans may include actions that are valid per the catalog but still violate mandatory steps, req

• WAAA! Web Adversaries Against Agentic Browsers

Source: arXiv cs.CR — May 08 arXiv:2605.05509v1 Announce Type: new Abstract: Large language models (LLMs) are increasingly being integrated into web browsers to create agentic browsing systems that execute actions on behalf of the user. Prior work considering the security of agentic browsers focuses exclusiv

• Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning

Source: arXiv cs.CR — May 08 arXiv:2605.05632v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) systems are vulnerable to knowledge base poisoning, yet existing attacks have been evaluated almost exclusively against vanilla retrieve-then-generate pipelines. Architectures designed to handle

• SafeHarbor: Hierarchical Memory-Augmented Guardrail for LLM Agent Safety

Source: arXiv cs.CR — May 08 arXiv:2605.05704v1 Announce Type: new Abstract: With the rapid evolution of foundation models, Large Language Model (LLM) agents have demonstrated increasingly powerful tool-use capabilities. However, this proficiency introduces significant security risks, as malicious actors can

• LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution

Source: arXiv cs.CR — May 08 arXiv:2605.05807v1 Announce Type: new Abstract: LLMs are increasingly explored for malware analysis; however, current LLM-based malware attribution remains limited by unsupported indicators and insufficient code-level grounding for identifying malicious and vulnerable code segmen

• LeakDojo: Decoding the Leakage Threats of RAG Systems

Source: arXiv cs.CR — May 08 arXiv:2605.05818v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) enables large language models (LLMs) to leverage external knowledge, but also exposes valuable RAG databases to leakage attacks. As RAG systems grow more complex and LLMs exhibit stronger instruc

Prompt Injection & LLM Security

• llm-gemini 0.31

Source: Simon Willison — May 07 Release: llm-gemini 0.31 gemini-3.1-flash-lite is no longer a preview. Here's my write-up of the Gemini 3.1 Flash-Lite Preview model back in March. I don't believe this new non-preview model has changed since then. Tags: llm-release, gemini, llm, google, generative-ai, ai, llms

• Big Words

Source: Simon Willison — May 07 Tool: Big Words I'm using my vibe coded macOS presentations tool to put together a talk, and I wanted to add a slide with some text on it. The tool only accepts URLs, so I put together a quick page that accepts query string arguments and turns them into a simple slide. Here's an

• Behind the Scenes Hardening Firefox with Claude Mythos Preview

Source: Simon Willison — May 07 Behind the Scenes Hardening Firefox with Claude Mythos Preview Fascinating, in-depth details on how Mozilla used their access to the Claude Mythos preview to locate and then fix hundreds of vulnerabilities in Firefox: Suddenly, the bugs are very good Just a few months ago, AI-gen

• Notes on the xAI/Anthropic data center deal

Source: Simon Willison — May 07 There weren't a lot of big new announcements from Anthropic at yesterday's Code w/ Claude event, but the biggest by far was the deal they've struck with SpaceX/xAI to use "all of the capacity of their Colossus data center". As I mentioned in my live blog of the keynote, that's th

• GitHub Repo Stats

Source: Simon Willison — May 07 Tool: GitHub Repo Stats One of the things I always look for when evaluating a new GitHub repository is the number of commits it has... but that number isn't visible on GitHub's mobile site layout. I built this tool to fix that, using this prompt: Given a GitHub repo URL or foo/ba

• Live blog: Code w/ Claude 2026

Source: Simon Willison — May 06 I'm at Anthropic's Code w/ Claude event today. Here's my live blog of the morning keynote sessions. Tags: ai, generative-ai, llms, anthropic, claude, claude-code, live-blog

• Vibe coding and agentic engineering are getting closer than I'd like

Source: Simon Willison — May 06 I recently talked with Joseph Ruscio about AI coding tools for Heavybit's High Leverage podcast: Ep. #9, The AI Coding Paradigm Shift with Simon Willison. Here are some of my highlights, including my disturbing realization that vibe coding and agentic engineering have started to

• datasette-referrer-policy 0.1

Source: Simon Willison — May 05 Release: datasette-referrer-policy 0.1 The OpenStreetMap tiles on the Datasette global-power-plants demo weren't displaying correctly. This turned out to be caused by two bugs. The first is that the CAPTCHA I added to that site a few weeks ago was triggering for the .json fetch r

• Our AI started a cafe in Stockholm

Source: Simon Willison — May 05 Our AI started a cafe in Stockholm Andon Labs previously started an AI-run retail store in San Francisco. Now they're running a similar experiment in Stockholm, Sweden, only this time it's a cafe. These experiments are interesting, and often throw out amusing anecdotes: During th

• datasette-llm 0.1a7

Source: Simon Willison — May 05 Release: datasette-llm 0.1a7 Mechanism for configuring default options for specific models. Part of Datasette's evolving support mechanism for plugins that use LLMs. It's now possible to configure a model with default options, e.g. to say all enrichment operations should use a sp

• llm-echo 0.5a0

Source: Simon Willison — May 05 Release: llm-echo 0.5a0 New -o thinking 1 option to help test against LLM 0.32a0 and higher. This plugin provides a fake model called "echo" for LLM which doesn't run an LLM at all - it's useful for writing automated tests. You can now do this: uvx --with llm==0.32a1 --with llm-e

• Quoting John Gruber

Source: Simon Willison — May 05 So it’s well known that Y Combinator owns some stake in OpenAI. But how big is that stake? This seems like devilishly difficult information to obtain. I asked around and a little birdie who knows several OpenAI investors came back with an answer: Y Combinator owns about 0.6 perce

• Granite 4.1 3B SVG Pelican Gallery

Source: Simon Willison — May 04 Granite 4.1 3B SVG Pelican Gallery IBM released their Granite 4.1 family of LLMs a few days ago. They're Apache 2.0 licensed and come in 3B, 8B and 30B sizes. Granite 4.1 LLMs: How They’re Built by Granite team member Yousaf Shah describes the training process in detail. Unsloth

• Quoting Andy Masley

Source: Simon Willison — May 04 [...] Between 2000 and 2024, farmers sold in total a Colorado-sized chunk of land all on their own, 77 times all land on data center property in 2028, and grew more food than ever on what was left. None of this caused any problems for US food access. And then, in the middle of al

• April 2026 newsletter

Source: Simon Willison — May 04 I just sent out the April edition of my sponsors-only monthly newsletter. If you are a sponsor (or if you start a sponsorship now) you can access it here. In this month's newsletter: Opus 4.7 and GPT-5.5, both with price increases Claude Mythos and LLM security research ChatGPT I

• TRE Python binding — ReDoS robustness demo

Source: Simon Willison — May 04 Research: TRE Python binding — ReDoS robustness demo If it's good enough for antirez to add to Redis I figured Ville Laurikari's TRE regular expression engine was worth exploring in a little more detail. I had Claude Code build an experimental Python binding (it used ctypes) and

• Redis Array Playground

Source: Simon Willison — May 04 Tool: Redis Array Playground Salvatore Sanfilippo submitted a PR adding a new data type - arrays - to Redis. The new commands are ARCOUNT, ARDEL, ARDELRANGE, ARGET, ARGETRANGE, ARGREP, ARINFO, ARINSERT, ARLASTITEMS, ARLEN, ARMGET, ARMSET, ARNEXT, AROP, ARRING, ARSCAN, ARSEEK, ARS

• Quoting Anthropic

Source: Simon Willison — May 03 We used an automatic classifier which judged sycophancy by looking at whether Claude showed a willingness to push back, maintain positions when challenged, give praise proportional to the merit of ideas, and speak frankly regardless of what a person wants to hear. Most of the tim

• Sightings

Source: Simon Willison — May 02 /elsewhere/sightings/ I have a new camera (a Canon R6 Mark II) so I'm taking a lot more photos of birds. I share my best wildlife photos on iNaturalist, and based on yesterday's successful prototype I decided to add those to my blog. I built this feature on my phone using Claude

• iNaturalist Sightings

Source: Simon Willison — May 01 Tool: iNaturalist Sightings I wanted to see my iNaturalist observations - across two separate accounts - grouped by when they occurred. I'm camping this weekend so I built this entirely on my phone using Claude Code for web. I started by building an inaturalist-clumper Python CLI

Community Signal

• Two Home Affairs officials suspended after AI 'hallucinations' found

Source: Hacker News (AI Security) — May 07 Article URL: https://www.citizen.co.za/news/home-affairs-officials-suspended-ai-hallucinations/ Comments URL: https://news.ycombinator.com/item?id=48053842 Points: 127 # Comments: 30

• Mozilla says 271 vulnerabilities found by Mythos and "almost no false positives"

Source: Hacker News (AI Security) — May 07 Article URL: https://arstechnica.com/information-technology/2026/05/mozilla-says-271-vulnerabilities-found-by-mythos-have-almost-no-false-positives/ Comments URL: https://news.ycombinator.com/item?id=48053816 Points: 122 # Comments: 4

• AI slop is killing online communities

Source: Hacker News (AI Security) — May 07 Article URL: https://rmoff.net/2026/05/06/ai-slop-is-killing-online-communities/ Comments URL: https://news.ycombinator.com/item?id=48053203 Points: 761 # Comments: 656

• Agents need control flow, not more prompts

Source: Hacker News (AI Security) — May 07 Article URL: https://bsuh.bearblog.dev/agents-need-control-flow/ Comments URL: https://news.ycombinator.com/item?id=48051562 Points: 537 # Comments: 265

• Show HN: Stage CLI – An easier way of reading your AI generated changes locally

Source: Hacker News (AI Security) — May 07 Hey HN! We're Charles and Dean. A few weeks ago we posted about Stage, a code review tool that guides you through reading a PR step by step - https://news.ycombinator.com/item?id=47796818.We got a lot of great feedback but also heard from many people that they wanted to have the

• Motherboard sales 'collapse' amid unprecedented shortages fueled by AI

Source: Hacker News (AI Security) — May 07 Article URL: https://www.tomshardware.com/pc-components/motherboards/motherboard-sales-collapse-by-more-than-25-percent-as-chipmakers-strangle-enthusiast-pc-market-to-build-more-ai-chips-asus-projected-to-sell-5-million-fewer-boards-in-2025-gigabyte-msi-and-asrock-also-expected-t

• How Cloudflare responded to the “Copy Fail” Linux vulnerability

Source: Hacker News (AI Security) — May 07 Article URL: https://blog.cloudflare.com/copy-fail-linux-vulnerability-mitigation/ Comments URL: https://news.ycombinator.com/item?id=48049160 Points: 97 # Comments: 74

• KLM flight attendant hospitalized after contact with hantavirus

Source: Hacker News (AI Security) — May 07 Article URL: https://nltimes.nl/2026/05/07/klm-flight-attendant-hospitalized-contact-hantavirus-cruise-ship-passenger Comments URL: https://news.ycombinator.com/item?id=48048121 Points: 35 # Comments: 24

• Making LLM Training Faster with Unsloth and NVIDIA

Source: Hacker News (AI Security) — May 07 Article URL: https://unsloth.ai/blog/nvidia-collab Comments URL: https://news.ycombinator.com/item?id=48046397 Points: 121 # Comments: 24

• Richard Dawkins concludes AI is conscious, even if it doesn't know it

Source: Hacker News (AI Security) — May 06 Article URL: https://www.theguardian.com/technology/2026/may/05/richard-dawkins-ai-consciousness-anthropic-claude-openai-chatgpt Comments URL: https://news.ycombinator.com/item?id=48042911 Points: 29 # Comments: 42

• Canadian fiddler sues Google after AI Overview claimed he was a sex offender

Source: Hacker News (AI Security) — May 06 Article URL: https://www.theguardian.com/music/2026/may/05/canadian-ashley-macisaac-fiddler-musician-singer-songwriter-sues-google-ai-sex-offender-ntwnfb Comments URL: https://news.ycombinator.com/item?id=48037923 Points: 49 # Comments: 21

• Google Chrome silently installs 4 GB Gemini Nano AI model without consent

Source: Hacker News (AI Security) — May 06 Article URL: https://alternativeto.net/news/2026/5/google-chrome-silently-installs-4-gb-gemini-nano-ai-model-to-user-device-without-consent/ Comments URL: https://news.ycombinator.com/item?id=48036683 Points: 20 # Comments: 3

• Show HN: Adam – An embeddable cross-platform AI agent library

Source: Hacker News (AI Security) — May 06 Article URL: https://github.com/sqliteai/adam Comments URL: https://news.ycombinator.com/item?id=48035677 Points: 24 # Comments: 9

• Academics Need to Wake Up on AI

Source: Hacker News (AI Security) — May 06 Article URL: https://www.popularbydesign.org/p/academics-need-to-wake-up-on-ai Comments URL: https://news.ycombinator.com/item?id=48032990 Points: 27 # Comments: 26

• FFmpeg developer calls out OxideAV for AI license laundering of his code

Source: Hacker News (AI Security) — May 06 Article URL: https://github.com/OxideAV/oxideav-magicyuv/issues/3 Comments URL: https://news.ycombinator.com/item?id=48031185 Points: 81 # Comments: 6

• Telus Uses AI to Alter Call-Agent Accents

Source: Hacker News (AI Security) — May 06 Article URL: https://letsdatascience.com/news/telus-uses-ai-to-alter-call-agent-accents-a3868f63 Comments URL: https://news.ycombinator.com/item?id=48031109 Points: 235 # Comments: 211

• Xbox CEO ends Copilot AI development and overhauls leadership

Source: Hacker News (AI Security) — May 05 Article URL: https://www.dexerto.com/gaming/xbox-ceo-ends-copilot-ai-development-overhauls-leadership-3361353/ Comments URL: https://news.ycombinator.com/item?id=48029753 Points: 111 # Comments: 41

• Our AI started a cafe in Stockholm

Source: Hacker News (AI Security) — May 05 Article URL: https://andonlabs.com/blog/ai-cafe-stockholm Comments URL: https://news.ycombinator.com/item?id=48028289 Points: 48 # Comments: 48

• Let's not fool ourselves about AI taking jobs. It's humans, laying humans off

Source: Hacker News (AI Security) — May 05 Article URL: https://circuitbored.com/viewtopic.php?t=246 Comments URL: https://news.ycombinator.com/item?id=48028189 Points: 37 # Comments: 2

• SubQ: Sub-quadratic LLM built for 12M-token context

Source: Hacker News (AI Security) — May 05 Article URL: https://subq.ai/ Comments URL: https://news.ycombinator.com/item?id=48026244 Points: 20 # Comments: 2

---

Source List

All sources tracked in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project — feed: https://genai.owasp.org/feed/
• Simon Willison — feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR — feed: http://export.arxiv.org/rss/cs.CR
• Protect AI — feed: https://protectai.com/blog/rss.xml
• Google Project Zero — feed: https://googleprojectzero.blogspot.com/feeds/posts/default
• CISA Cybersecurity Advisories — feed: https://www.cisa.gov/cybersecurity-advisories/all.xml
• NIST Cybersecurity News — feed: https://www.nist.gov/news-events/cybersecurity/rss.xml
• Hacker News (AI Security) — feed: https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20