AI Security Trend Roundup — Jun 12, 2026

Covering Jun 05 → Jun 12, 2026. 47 new items from 8 tracked sources.

This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.

Academic & Research

• Influence Factors on RAG Poisoning

Source: arXiv cs.CR — Jun 12 arXiv:2606.12469v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) systems enhance large language models by grounding responses in retrieved documents from external knowledge sources at inference time. However, this reliance on retrieved content introduces vulne

• SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems

Source: arXiv cs.CR — Jun 12 arXiv:2606.12703v1 Announce Type: new Abstract: Retrieval-augmented generation (RAG) agents increasingly run with persistent memory that accumulates across user sessions. This creates a new attack surface: an adversary interacting only through normal channels can inject crafted m

• PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections

Source: arXiv cs.CR — Jun 12 arXiv:2606.12737v1 Announce Type: new Abstract: Large Language Models (LLMs) are rapidly evolving into agentic systems that interact with external tools and environments, introducing new security risks such as indirect prompt injection attacks through untrusted external sources.

• A Privacy-Preserving Framework Using Remote Data Science for Inter-Institutional Student Retention Prediction

Source: arXiv cs.CR — Jun 12 arXiv:2606.12845v1 Announce Type: new Abstract: This study explores privacy-preserving machine learning (PPML) techniques using the PySyft platform to enable collaborative prediction of student retention between institutions. We developed a remote data science (RDS) framework wit

• MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems

Source: arXiv cs.CR — Jun 12 arXiv:2606.12918v1 Announce Type: new Abstract: Hierarchical multi-agent systems (MAS) are rapidly being deployed in high-stakes workflows across domains such as finance and software engineering. In these systems, safety and security are inherently distributed across role-special

• The Emergence of Autonomous Penetration Capabilities in Large Language Model-Powered AI Systems

Source: arXiv cs.CR — Jun 12 arXiv:2606.13079v1 Announce Type: new Abstract: Nowadays, the autonomous execution of cyberattacks capable of causing substantial real-world harm is widely regarded as one of the critical red lines that frontier AI systems must not cross. Within this broader red-line scenario, au

• Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

Source: arXiv cs.CR — Jun 12 arXiv:2606.13385v1 Announce Type: new Abstract: Web agents driven by large language models (LLMs) are increasingly deployed in real-world environments, where they operate over untrusted web content and execute actions with direct consequences. This makes them vulnerable to prompt

• SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems

Source: arXiv cs.CR — Jun 12 arXiv:2606.12474v1 Announce Type: cross Abstract: LLM-based multi-agent systems (MAS) solve complex tasks through inter-agent collaboration, but their communication-driven nature also allows security risks to spread across agents and trigger system-wide failures. Existing MAS def

• Fed-FBD: Federated Functional Block Diversification for Isolation, Privacy, and Surgical Unlearning

Source: arXiv cs.CR — Jun 12 arXiv:2606.12679v1 Announce Type: cross Abstract: Federated learning (FL) enables collaborative model training without sharing raw patient data, but standard approaches such as FedAvg treat each client as a black box and provide no mechanism for isolating an adversarial contribut

• Smarter Saboteurs, Better Fixers: Scaling & Security in Linear Multi-Agent Workflows

Source: arXiv cs.CR — Jun 12 arXiv:2606.12709v1 Announce Type: cross Abstract: As LLM-based multi-agent systems (MAS) are deployed in the wild, the resilience of their collaboration structures against adversarial compromise becomes a critical safety concern. Attackers may leverage prompt-injection or jailbre

Prompt Injection & LLM Security

• Claude Fable is relentlessly proactive

Source: Simon Willison — Jun 11 After two days of experience with Claude Fable 5 I think the best way to describe it is relentlessly proactive. It knows a whole lot of tricks and it will deploy pretty much any of them to get to its goal. I'll illustrate this with an example. I was hacking on Datasette Agent tod

• datasette 1.0a33

Source: Simon Willison — Jun 11 Release: datasette 1.0a33 This alpha is a significant step on the road to a stable 1.0, finally extending the ?_extra= pattern I introduced in Datasette 1.0a3 to cover queries and rows in addition to tables. That pattern is also now documented! I wrote a whole lot more about the

• asyncinject 0.7

Source: Simon Willison — Jun 11 Release: asyncinject 0.7 I built this utility library to support an asyncio dependency injection pattern a few years ago. I was using it with Datasette and Claude Fable 5 spotted some bugs in the dependency which it then fixed for me. It's a very proactive model! Tags: async, pro

• Anthropic Walks Back Policy That Could Have ‘Sabotaged’ AI Researchers Using Claude

Source: Simon Willison — Jun 11 Anthropic Walks Back Policy That Could Have ‘Sabotaged’ AI Researchers Using Claude Big scoop for Maxwell Zeff at Wired: “We’re changing Fable 5’s safeguards for frontier LLM development to make them visible.” Anthropic said in a statement to WIRED. “We made the wrong tradeoff an

• datasette-agent 0.2a0

Source: Simon Willison — Jun 10 Release: datasette-agent 0.2a0 Highlights from the release notes: Tools can now ask the user questions mid-execution. Tools that declare a context parameter receive a ToolContext object, and await context.ask_user(...) can ask a yes/no, multiple-choice (options=[...]) or free-tex

• DiffusionGemma

Source: Simon Willison — Jun 10 DiffusionGemma Last May Google briefly released an experimental Gemini Diffusion model. I tried the preview at the time and recorded it running at 857 tokens/second. It was an exciting model, but Google made no further announcements about it. That research has returned in the bes

• Quoting Jeremy Howard

Source: Simon Willison — Jun 10 Easy solution to slow down recursive AI self improvement: The lab with the top-ranked model must agree THEY must not use it for working on frontier AI But everyone else should have access to it. By definition, this means the frontier doesn't advance. It also has the critical bene

• If Claude Fable stops helping you, you'll never know

Source: Simon Willison — Jun 10 If Claude Fable stops helping you, you'll never know Jonathon Ready highlights one of the more eyebrow-raising details from the 319 page system card for Fable 5 and Mythos 5. Here's a longer excerpt, highlights mine: In light of the ability of recent models to accelerate the

• Initial impressions of Claude Fable 5

Source: Simon Willison — Jun 09 I didn't have early access to today's Claude Fable 5 release, but I've spent the past ~5.5 hours putting it through its paces. My initial impressions are that this is something of a beast. It's slow, expensive and has been quite happily churning through everything I've thrown at

• llm 0.32a3

Source: Simon Willison — Jun 09 Release: llm 0.32a3 Almost entirely written by the new Claude Fable 5, see my write-up for more details. Tags: projects, ai, generative-ai, llms, llm, claude-mythos

• Setting a custom price for a model in AgentsView

Source: Simon Willison — Jun 09 TIL: Setting a custom price for a model in AgentsView I've been really enjoying AgentsView by Wes McKinney as a tool for exploring my token usage across different coding agents running on my laptop. Claude Fable 5 came out today and wasn't yet included in the pricing database Age

• Quoting Andrej Karpathy

Source: Simon Willison — Jun 09 I feel a lot of things changing as working software increasingly comes out on a tap. The Jevon's paradox kicks in and I feel my own demand for software growing substantially. You can ask for anything - explainers, visualizers, dashboards, bespoke single-use apps (e.g. a full wand

• Siri AI at WWDC 2026

Source: Simon Willison — Jun 08 Given how badly burned anyone who took Apple's 2024 WWDC Apple Intelligence announcements at face value was, I'm holding to a strict "I'll believe it when I see it" policy for everything they announced today. The new Siri AI features do at least look feasible with today's technol

• datasette-agent-edit 0.1a0

Source: Simon Willison — Jun 07 Release: datasette-agent-edit 0.1a0 I'm planning several plugins for Datasette Agent which can make edits to existing pieces of text - things like collaborative Markdown editing, updating large SQL queries, and editing SVG files. Agentic editing of text is a little tricky to get

• micropython-wasm 0.1a2

Source: Simon Willison — Jun 06 Release: micropython-wasm 0.1a2 I added a CLI to micropython-wasm (issue #7), inspired by the first draft of the blog entry when I realized it would be a great way to illustrate the Try it yourself section. Tags: python, sandboxing, webassembly, micropython

• Running Python code in a sandbox with MicroPython and WASM

Source: Simon Willison — Jun 06 I've been experimenting with different approaches to running code in a sandbox for several years now, but my latest attempt feels like it might finally have all of the characteristics I've been looking for. I've released it as an alpha package called micropython-wasm, and I'm usi

• OpenAI Help: Lockdown Mode

Source: Simon Willison — Jun 05 OpenAI Help: Lockdown Mode OpenAI first teased this in February, but now it's live and "rolling out to eligible personal accounts, including Free, Go, Plus, and Pro, and self-serve ChatGPT Business accounts": Lockdown Mode is designed to help prevent the final stage of data exfil

Community Signal

• Slightly reducing the sloppiness of AI generated front end

Source: Hacker News (AI Security) — Jun 12 Article URL: https://envs.net/~volpe/blog/posts/reduce-slop.html Comments URL: https://news.ycombinator.com/item?id=48504912 Points: 51 # Comments: 26

• AI will be massively deflationary

Source: Hacker News (AI Security) — Jun 12 Article URL: https://geohot.github.io//blog/jekyll/update/2026/06/11/ai-will-be-deflationary.html Comments URL: https://news.ycombinator.com/item?id=48502750 Points: 20 # Comments: 5

• AI Economics for Dummies

Source: Hacker News (AI Security) — Jun 12 Article URL: https://www.mcsweeneys.net/articles/ai-economics-for-dummies Comments URL: https://news.ycombinator.com/item?id=48502456 Points: 23 # Comments: 1

• AI agent bankrupted their operator while trying to scan DN42

Source: Hacker News (AI Security) — Jun 12 Article URL: https://lantian.pub/en/article/fun/ai-agent-bankrupted-their-operator-scan-dn42lantian.lantian/ Comments URL: https://news.ycombinator.com/item?id=48500012 Points: 1237 # Comments: 450

• Don't let the LLM speak, just probe it

Source: Hacker News (AI Security) — Jun 12 Article URL: https://blog.j11y.io/2026-06-10_hidden-state-probes/ Comments URL: https://news.ycombinator.com/item?id=48498283 Points: 37 # Comments: 2

• Show HN: FablePool – pool money behind a prompt, and Fable builds it in public

Source: Hacker News (AI Security) — Jun 11 Article URL: https://fablepool.com Comments URL: https://news.ycombinator.com/item?id=48496539 Points: 490 # Comments: 256

• [OpenAI's June 2026 Report on Malicious Uses of AI [pdf]](https://cdn.openai.com/pdf/96b559fa-c165-4575-805d-e636909e2f78/June-2026-Threat-Report.pdf)

Source: Hacker News (AI Security) — Jun 11 Article URL: https://cdn.openai.com/pdf/96b559fa-c165-4575-805d-e636909e2f78/June-2026-Threat-Report.pdf Comments URL: https://news.ycombinator.com/item?id=48496332 Points: 20 # Comments: 4

• Shall we play a game? My AI nuclear simulation

Source: Hacker News (AI Security) — Jun 11 https://arxiv.org/pdf/2602.14740 Comments URL: https://news.ycombinator.com/item?id=48495575 Points: 202 # Comments: 189

• MTG Bench: Testing how well LLMs can play Magic

Source: Hacker News (AI Security) — Jun 11 Article URL: https://mtgautodeck.com/articles/mtg-bench/ Comments URL: https://news.ycombinator.com/item?id=48492177 Points: 63 # Comments: 31

• Ask HN: How do you get into a flow state when using AI to code?

Source: Hacker News (AI Security) — Jun 11 Before agentic coding, I always prided myself on how long I could work in a flow state. I was really good at working deeply.Now, with slow agents like Claude, I find myself no longer working deeply.What are you all doing to stay focused? Comments URL: https://news.ycombinator.com

• [The $15,000 AI Bill. Your $20 Subscription is a DELUSION [video]](https://www.youtube.com/watch?v=UfApUobqN8Y)

Source: Hacker News (AI Security) — Jun 11 Article URL: https://www.youtube.com/watch?v=UfApUobqN8Y Comments URL: https://news.ycombinator.com/item?id=48491670 Points: 27 # Comments: 57

• [AMD gaslights security researcher, changes rules retroactively [video]](https://www.youtube.com/watch?v=4HjWHNLRMB0)

Source: Hacker News (AI Security) — Jun 11 Article URL: https://www.youtube.com/watch?v=4HjWHNLRMB0 Comments URL: https://news.ycombinator.com/item?id=48490946 Points: 26 # Comments: 2

• How a new DSL may survive in the era of LLMs

Source: Hacker News (AI Security) — Jun 11 Article URL: https://www.williamcotton.com/articles/how-a-new-dsl-survives-in-the-era-of-llms Comments URL: https://news.ycombinator.com/item?id=48490939 Points: 48 # Comments: 16

• Nobody needs AI to search the Internet, court says in ruling against Google

Source: Hacker News (AI Security) — Jun 11 Article URL: https://arstechnica.com/tech-policy/2026/06/nobody-needs-ai-to-search-the-internet-court-says-in-ruling-against-google/ Comments URL: https://news.ycombinator.com/item?id=48490410 Points: 29 # Comments: 4

• Workers are spending over 6 hours a week botsitting AI, fueling job frustration

Source: Hacker News (AI Security) — Jun 11 Article URL: https://www.businessinsider.com/botsitting-ai-hidden-human-labor-at-work-2026-6 Comments URL: https://news.ycombinator.com/item?id=48490057 Points: 272 # Comments: 220

• Europe 2031: What getting AI wrong means for us

Source: Hacker News (AI Security) — Jun 11 Article URL: https://europe2031.ai/ Comments URL: https://news.ycombinator.com/item?id=48489996 Points: 24 # Comments: 6

• More AI-generated code doesn't make your team faster. It might slow you

Source: Hacker News (AI Security) — Jun 11 Article URL: https://twitter.com/awscloud/status/2064449711155589396 Comments URL: https://news.ycombinator.com/item?id=48489835 Points: 43 # Comments: 18

• The AI Agent in the Billing Department of Verizon Is a Mentally Handicapped Thug

Source: Hacker News (AI Security) — Jun 11 Article URL: https://samhenrycliff.medium.com/the-ai-agent-in-the-billing-department-of-verizon-wireless-is-a-mentally-handicapped-thug-99890a389ff5 Comments URL: https://news.ycombinator.com/item?id=48489335 Points: 28 # Comments: 9

• Making a vintage LLM from scratch

Source: Hacker News (AI Security) — Jun 11 Article URL: https://crlf.link/log/entries/260525-1/ Comments URL: https://news.ycombinator.com/item?id=48487829 Points: 79 # Comments: 22

• Why AI hasn't replaced software engineers, and won't

Source: Hacker News (AI Security) — Jun 11 Article URL: https://www.normaltech.ai/p/why-ai-hasnt-replaced-software-engineers Comments URL: https://news.ycombinator.com/item?id=48487540 Points: 302 # Comments: 344

---

Source List

All sources tracked in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project — feed: https://genai.owasp.org/feed/
• Simon Willison — feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR — feed: http://export.arxiv.org/rss/cs.CR
• Protect AI — feed: https://protectai.com/blog/rss.xml
• Google Project Zero — feed: https://googleprojectzero.blogspot.com/feeds/posts/default
• CISA Cybersecurity Advisories — feed: https://www.cisa.gov/cybersecurity-advisories/all.xml
• NIST Cybersecurity News — feed: https://www.nist.gov/news-events/cybersecurity/rss.xml
• Hacker News (AI Security) — feed: https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20