AI Security Trend Roundup — May 15, 2026
Covering May 08 → May 15, 2026. 52 new items from 8 tracked sources.
This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.
Government Advisories
Source: CISA Cybersecurity Advisories — May 12 CISA and the Group of Seven (G7) international partners—Germany, Canada, France, Italy, Japan, the United Kingdom, and the European Union—have released joint guidance, Software Bill of Materials for AI – Minimum Elements, to help public and private sector stakeholders improve tra
Academic & Research
Source: arXiv cs.CR — May 15 arXiv:2605.13922v1 Announce Type: new Abstract: During the last few years, the term Mechanistic Interpretability, a specific area, under the umbrella of explainable artificial intelligence (XAI), has been introduced, to explain the decisions made by complex machine learning (ML)
Source: arXiv cs.CR — May 15 arXiv:2605.13940v1 Announce Type: new Abstract: Third-party skills are becoming the package ecosystem for LLM agents. They package natural-language instructions, helper scripts, templates, documents, and service configuration into reusable workflows. This makes skills useful, but
Source: arXiv cs.CR — May 15 arXiv:2605.14153v1 Announce Type: new Abstract: Exploitation is not a binary event. It is a ladder of acquiring progressive capabilities, from executing a single buggy line of code to taking full control of the target. However, existing LLM security benchmarks treat a crash as ex
Source: arXiv cs.CR — May 15 arXiv:2605.14290v1 Announce Type: new Abstract: ReAct has become the default architecture across LLM agents, and many existing web agents follow this paradigm. We argue that it is the wrong default for web agents. Instead, web agents should default to plan-then-execute: commit to
Source: arXiv cs.CR — May 15 arXiv:2605.14418v1 Announce Type: new Abstract: "Oh-Oh, yes, I'm the great pretender. Pretending that I'm doing well. My need is such, I pretend too much..." summarizes the state in the area of jailbreak creation and evaluation. You find this method to generate adversarial attack
Source: arXiv cs.CR — May 15 arXiv:2605.14421v1 Announce Type: new Abstract: We introduce MemLineage, a defense for LLM agent memory that attaches both cryptographic provenance and LLM-mediated derivation lineage to every entry. Recent and concurrent work shows that untrusted content can be written into pers
Source: arXiv cs.CR — May 15 arXiv:2605.14460v1 Announce Type: new Abstract: Autonomous agents powered by Large Language Models (LLMs) acquire external functionalities through third-party skills available in open marketplaces. Adopting these integrations broadens the potential attack surface, prompting a nee
Source: arXiv cs.CR — May 15 arXiv:2605.14750v1 Announce Type: new Abstract: Large Language Models (LLMs) and Vision Language Models (VLMs) have demonstrated impressive capabilities but remain vulnerable to jailbreaking attacks, where adversaries exploit textual or visual triggers to bypass safety guardrails
Source: arXiv cs.CR — May 15 arXiv:2605.14786v1 Announce Type: new Abstract: As LLM-based agents increasingly browse the web on users' behalf, a natural question arises: can websites passively identify which underlying model powers an agent? Doing so would represent a significant security risk, enabling targ
Source: arXiv cs.CR — May 15 arXiv:2605.14859v1 Announce Type: new Abstract: As coding agents gain access to shells, repositories, and user files, least-privilege authorization becomes a prerequisite for safe deployment: an agent should receive enough authority to complete the task, without unnecessary autho
Source: arXiv cs.CR — May 15 arXiv:2605.15030v1 Announce Type: new Abstract: Web agents can autonomously complete online tasks by interacting with websites, but their exposure to open web environments makes them vulnerable to prompt injection attacks embedded in HTML content or visual interfaces. Existing gu
Source: arXiv cs.CR — May 15 arXiv:2605.15084v1 Announce Type: new Abstract: Python's native serialization protocol, pickle, is a powerful but insecure format for transferring untrusted data. It is frequently used, especially for saving machine learning models, despite known security challenges. While develo
Prompt Injection & LLM Security
Source: Simon Willison — May 14 This Mitchell Hashimoto quote about Bun migrating from Zig to Rust reminded me of a similar conversation I had at a conference last week. I was talking to someone who worked for a medium sized technology company with a pair of legacy/legendary iPhone and Android apps. They told m
Source: Simon Willison — May 14 [...] On the interesting side is how fungible programming languages are nowadays. Programming languages used to be LOCK IN, and they're increasingly not so. You think the Bun rewrite in Rust is good for Rust? Bun has shown they can be in probably any language they want in roughly
Source: Simon Willison — May 14 Release: datasette-ip-rate-limit 0.1a0 The datasette.io site was being hammered by poorly-behaved crawlers, so I had Codex (GPT-5.5 xhigh) build a configurable rate limiting plugin to block IPs that were hammering specific areas of the site too quickly. Here's the production conf
Source: Simon Willison — May 13 Welcome to the Datasette blog We have a bunch of neat Datasette announcements in the pipeline so we decided it was time the project grew an official blog. I built this using OpenAI Codex desktop, which turns out to have the Markdown session transcript export feature I've always w
Source: Simon Willison — May 13 “11 AI agents” is meaningless as a phrase. If I said “I have 11 spreadsheets” or “I have 11 browser tabs” to do my work, it means about the same thing. — Boris Mann Tags: ai-agents, ai, agent-definitions
Source: Simon Willison — May 13 Tool: CSP Allow-list Experiment An experiment that shows that you can load an app in a CSP-protected sandboxed iframe (see previous note) and have a custom fetch() that intercepts CSP errors and passes them up to the parent window... which can then prompt the user to add that dom
Source: Simon Willison — May 12 Release: datasette 1.0a29 New TokenRestrictions.abbreviated(datasette) utility method for creating "_r" dictionaries. #2695 Table headers and column options are now visible even if a table contains zero rows. #2701 Fixed bug with display of column actions dialog on Mobile Safari.
Source: Simon Willison — May 12 Now, if your CEO has never heard the phrase Ralph Loop, oh man, you are less than 30 days away from your next promotion. I'm not even exaggerating. Walk into his office, close the door, and say, hey chief, been experimenting with something. It's called Ralph Loops. And I think it
Source: Simon Willison — May 12 The thing about 90% of TDMs [Technical Decision Makers] is that they're motivated primarily by NOT GETTING FIRED. These aren't people who browser Lobsters or push to GH on the weekend. These are people that work 9 to 5, get paid, go home, and NEVER THINK ABOUT WORK AGAIN. So to a
Source: Simon Willison — May 12 Release: llm 0.32a2 A bunch of useful stuff in this LLM alpha, but the most important detail is this one: Most reasoning-capable OpenAI models now use the /v1/responses endpoint instead of /v1/chat/completions. This enables interleaved reasoning across tool calls for GPT-5 class
Source: Simon Willison — May 11 GitLab Act 2 There's a lot going on in this announcement from GitLab about the "workforce reduction" and "structural and strategic decisions" they are making with respect to the agentic era. They're "planning to reduce the number of countries by up to 30% where we have small team
Source: Simon Willison — May 11 Your AI coding agent, the one you use to write code, needs to reduce your maintenance costs. Not by a little bit, either. You write code twice as quick now? Better hope you’ve halved your maintenance costs. Three times as productive? One third the maintenance costs. Otherwise, yo
Source: Simon Willison — May 11 Your AI Use Is Breaking My Brain Excellent, angry piece by Jason Koebler on how AI writing online is becoming impossible to avoid, filtering it is mentally exhausting and it's even starting to distort regular human writing styles. I particularly liked his use of the term "Zombie
Source: Simon Willison — May 11 TIL: Using LLM in the shebang line of a script Kim_Bruning on Hacker News: But seriously, you can put a shebang on an english text file now (if you're sufficiently brave) [...] This inspired me to look at patterns for doing exactly that with LLM. Here's the simplest, which takes
Source: Simon Willison — May 11 Learning on the Shop floor Tobias Lütke describes Shopify's internal coding agent tool, River, which operates entirely in public on their Slack: River does not respond to direct messages. She politely declines and suggests to create a public channel for you and her to start worki
Source: Simon Willison — May 10 This article was updated after The Times learned that a remark attributed to Pierre Poilievre, the Conservative leader, was in fact an A.I.-generated summary of his views about Canadian politics that A.I. rendered as a quotation. The reporter should have checked the accuracy of w
Source: Simon Willison — May 10 One could say in the first quarter-century of my life, that while I was always fascinated by programming, I could never overcome the guilt of not really knowing whether the tool I am building right now isn’t already superceded by some much better implementation someone else has a
Source: Simon Willison — May 09 WebRTC is designed to degrade and drop my prompt during poor network conditions. wtf my dude WebRTC aggressively drops audio packets to keep latency low. If you’ve ever heard distorted audio on a conference call, that’s WebRTC baybee. The idea is that conference calls depend on r
Source: Simon Willison — May 08 Using Claude Code: The Unreasonable Effectiveness of HTML Thought-provoking piece by Thariq Shihipar (on the Claude Code team at Anthropic) advocating for HTML over Markdown as an output format to request from Claude. The article is crammed with interesting examples (collected on
Community Signal
Source: Hacker News (AI Security) — May 15 Article URL: https://fortune.com/2026/05/15/ai-entry-level-jobs-higher-education-experience-gap/ Comments URL: https://news.ycombinator.com/item?id=48148440 Points: 37 # Comments: 63
Source: Hacker News (AI Security) — May 15 Article URL: https://www.fastcompany.com/91541586/amazon-workers-pressured-to-up-ai-use-extraneous-tasks Comments URL: https://news.ycombinator.com/item?id=48148337 Points: 111 # Comments: 73
Source: Hacker News (AI Security) — May 15 Article URL: https://www.metabase.com/blog/strip-mining-era-of-open-source-security Comments URL: https://news.ycombinator.com/item?id=48147339 Points: 76 # Comments: 59
Source: Hacker News (AI Security) — May 15 Article URL: https://www.bbc.co.uk/news/articles/ckgpyn30dp3o Comments URL: https://news.ycombinator.com/item?id=48146656 Points: 47 # Comments: 36
Source: Hacker News (AI Security) — May 15 Article URL: https://relax.ai/docs Comments URL: https://news.ycombinator.com/item?id=48146424 Points: 98 # Comments: 108
Source: Hacker News (AI Security) — May 15 Article URL: https://github.com/Andyyyy64/whichllm Comments URL: https://news.ycombinator.com/item?id=48146369 Points: 261 # Comments: 61
Source: Hacker News (AI Security) — May 15 I'm a Type 1 diabetic and software engineer. Last year I went months between endocrinologists with no clinician reviewing my data. I'm an engineer, so I built the tool I needed — and now I'm open sourcing it. GlycemicGPT is a self-hosted platform that connects continuous glucose
Source: Hacker News (AI Security) — May 15 Article URL: https://writing.antonleicht.me/p/cut-off Comments URL: https://news.ycombinator.com/item?id=48143284 Points: 194 # Comments: 195
Source: Hacker News (AI Security) — May 14 Article URL: https://github.com/rust-lang/rust-forge/pull/1040 Comments URL: https://news.ycombinator.com/item?id=48142650 Points: 94 # Comments: 77
Source: Hacker News (AI Security) — May 14 Article URL: https://brianmeeker.me/2026/05/14/have-a-coherent-ai-policy/ Comments URL: https://news.ycombinator.com/item?id=48142553 Points: 68 # Comments: 60
Source: Hacker News (AI Security) — May 14 Article URL: https://www.theregister.com/ai-ml/2026/05/14/ontario-auditors-find-doctors-ai-note-takers-routinely-blow-basic-facts/5240771 Comments URL: https://news.ycombinator.com/item?id=48142188 Points: 266 # Comments: 126
Source: Hacker News (AI Security) — May 14 Article URL: https://www.thenewcritic.com/p/the-great-zombification Comments URL: https://news.ycombinator.com/item?id=48139355 Points: 187 # Comments: 203
Source: Hacker News (AI Security) — May 14 Article URL: https://jpain.io/god-damn-ai-is-making-me-dumb/ Comments URL: https://news.ycombinator.com/item?id=48139148 Points: 514 # Comments: 297
Source: Hacker News (AI Security) — May 14 Article URL: https://danieltan.weblog.lol/2026/05/you-dont-align-an-ai-you-align-with-it Comments URL: https://news.ycombinator.com/item?id=48139144 Points: 90 # Comments: 61
Source: Hacker News (AI Security) — May 14 Article URL: https://nonogra.ph/using-chinese-ai-models-to-get-a-degree-05-14-2026 Comments URL: https://news.ycombinator.com/item?id=48139058 Points: 20 # Comments: 8
Source: Hacker News (AI Security) — May 14 Article URL: https://twitter.com/jediwolf/status/2054776716770320631 Comments URL: https://news.ycombinator.com/item?id=48134400 Points: 83 # Comments: 74
Source: Hacker News (AI Security) — May 14 Article URL: https://zknill.io/posts/llms-are-breaking-20-year-old-system-design/ Comments URL: https://news.ycombinator.com/item?id=48131888 Points: 30 # Comments: 27
Source: Hacker News (AI Security) — May 14 Article URL: https://www.businessinsider.com/coders-keep-laptops-open-in-public-ai-agent-2026-5 Comments URL: https://news.ycombinator.com/item?id=48131370 Points: 29 # Comments: 40
Source: Hacker News (AI Security) — May 14 Hi HN,I built a live tracker to visualize the lifecycle and performance changes of flagship AI models.We've all experienced the phenomenon where a flagship model feels amazing at launch, but weeks later, it suddenly feels a bit off. I wanted to see if this was just a feeling or a
Source: Hacker News (AI Security) — May 14 Article URL: https://personalaisafety.com/p/the-other-half-of-ai-safety Comments URL: https://news.ycombinator.com/item?id=48129561 Points: 97 # Comments: 130
Source List
All sources tracked in this roundup, credited to their original authors/organizations:
- OWASP GenAI Security Project — feed:
https://genai.owasp.org/feed/ - Simon Willison — feed:
https://simonwillison.net/atom/everything/ - arXiv cs.CR — feed:
http://export.arxiv.org/rss/cs.CR - Protect AI — feed:
https://protectai.com/blog/rss.xml - Google Project Zero — feed:
https://googleprojectzero.blogspot.com/feeds/posts/default - CISA Cybersecurity Advisories — feed:
https://www.cisa.gov/cybersecurity-advisories/all.xml - NIST Cybersecurity News — feed:
https://www.nist.gov/news-events/cybersecurity/rss.xml - Hacker News (AI Security) — feed:
https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20
Explore More
FixTheVuln Store
Studying for Security+? Get the Study Planner
Structured study planners for CompTIA certifications. Domain trackers, time blocking, and exam strategies.
Shop Security+ PlannerAlso available: CompTIA A+, Network+, CySA+, PenTest+
CyberFolio
Building cybersecurity skills? Track them in one place.
Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.
Build Your Portfolio →