AI Security Trend Roundup — Jul 03, 2026

Covering Jun 26 → Jul 03, 2026. 32 new items from 8 tracked sources.

This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.

Academic & Research

• Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety

Source: arXiv cs.CR — Jul 03 arXiv:2607.01277v1 Announce Type: new Abstract: Large language models (LLMs) can be induced to produce harmful content through multi turn strategies in which no single user message appears clearly unsafe. Existing runtime safeguards commonly evaluate prompts or responses as isola

• Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

Source: arXiv cs.CR — Jul 03 arXiv:2607.01305v1 Announce Type: new Abstract: Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, deve

• From Forgeries to Foundation Models: A Systematic Survey of Identity Document Attack and Detection

Source: arXiv cs.CR — Jul 03 arXiv:2607.01442v1 Announce Type: new Abstract: Identity document forgery has undergone a fundamental capability shift: generative AI tools now enable high-fidelity document synthesis and field-level manipulation with minimal technical expertise, while detection methods remain co

• Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes

Source: arXiv cs.CR — Jul 03 arXiv:2607.01445v1 Announce Type: new Abstract: Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. $n$-grams features are among the common static features used in effective machine

• Beyond Gradient-Based Attacks: Adversarial Robustness and Explainability Stability in Cybersecurity Classifiers

Source: arXiv cs.CR — Jul 03 arXiv:2607.01679v1 Announce Type: new Abstract: Adversarial attacks on cybersecurity classifiers pose a dual threat: degrading predictions and destabilising the SHAP-based explanations that security analysts rely on to understand and triage alerts. We extend our prior MLP confere

• Pmeta-TLA: Backdoor Attacks for Speech Classification Models via Meta-Learning with Timbre Leakage Attack

Source: arXiv cs.CR — Jul 03 arXiv:2607.01702v1 Announce Type: new Abstract: Recently, speech classification methods have gained widespread adoption in intelligent gadgets. Current study indicates that backdoor attacks provide a substantial security concern to these models, underscoring the pressing necessit

• Knowledge Over Parameters: Evolving Smart Contract Vulnerability Detection

Source: arXiv cs.CR — Jul 03 arXiv:2607.01742v1 Announce Type: new Abstract: Smart contract vulnerabilities are predominantly logic bugs whose detection requires structured, step-by-step procedural knowledge of attack patterns and contract semantics. Existing LLM-based methods struggle to generate this knowl

• Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring

Source: arXiv cs.CR — Jul 03 arXiv:2607.02121v1 Announce Type: new Abstract: As Large Language Models (LLMs) and agentic systems become integrated into real-world applications, ensuring their safety and security is critical. Guardrail systems that detect and block malicious instructions sent to and from an L

• Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

Source: arXiv cs.CR — Jul 03 arXiv:2607.02357v1 Announce Type: new Abstract: LLM coding agents increasingly rely on third-party agent skills from public marketplaces, which execute with the agent's privileges and create a software supply-chain attack surface: a malicious skill can steal credentials, exfiltra

• Black-Box Inference of LLM Architectural Properties with Restrictive API Access

Source: arXiv cs.CR — Jul 03 arXiv:2607.01313v1 Announce Type: cross Abstract: In practice, most commercial LLM providers do not publicly release details of underlying LLM architectures. However, prior work has shown that given limited API access to an LLM (namely, top-$k$ logits and/or a logit bias function

• AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs

Source: arXiv cs.CR — Jul 03 arXiv:2607.01640v1 Announce Type: cross Abstract: LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined semantics for models, prompts, tools, memory, and mul

• ElephantAgent: Contextual State Continuity in Agentic Systems

Source: arXiv cs.CR — Jul 03 arXiv:2607.01919v1 Announce Type: cross Abstract: Agentic systems enhance their capabilities by invoking external tools and maintaining persistent memory. However, these external dependencies introduce novel attack surfaces. Recent tool and memory poisoning attacks show that mali

Prompt Injection & LLM Security

• June 2026 newsletter

Source: Simon Willison — Jul 03 The June edition of my sponsors-only monthly newsletter is out. If you are a sponsor (or if you start a sponsorship now) you can access it here. This month: Claude Fable 5, GPT-5.6, and US export restrictions GLM-5.2 is the new best open weights model Tokenmaxxing is so over Data

• llm-coding-agent 0.1a0

Source: Simon Willison — Jul 02 Release: llm-coding-agent 0.1a0 Another Fable 5 experiment. Now that my LLM library has evolved into more of an agent framework it's time to see what a simple coding agent would look like built on it. I started a new Python library using my python-lib-template-repository GitHub t

• Using DSPy to evaluate and improve Datasette Agent's SQL system prompts

Source: Simon Willison — Jul 02 Research: Using DSPy to evaluate and improve Datasette Agent's SQL system prompts One of this morning's AIE keynotes covered dspy, which reminded me I've been meaning to see if it could help me improve the system prompt used by Datasette Agent - so I fired off an asynchronou

• Understand to participate

Source: Simon Willison — Jul 02 I saw Geoffrey Litt speak at AIE yesterday, and one framing he used particularly resonated with me: Understand to participate Geoffrey was talking about the challenge of collaborating with coding agents as they construct increasingly large and sophisticated changes, and the need

• Quoting Anthropic

Source: Simon Willison — Jun 30 We’ve received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5. We'll begin restoring access tomorrow, and will share an update soon. — Anthropic, on Twitter Tags: anthropic, claude, generative-ai, claude-mythos-fable, ai, ll

• Nano Banana 2 Lite

Source: Simon Willison — Jun 30 Nano Banana 2 Lite Also known as Gemini 3.1 Flash Lite Image (gemini-3.1-flash-lite-image in their API), this is the "fastest and cheapest Gemini image model, engineered for velocity and scale". I used AI studio to run this prompt: Do a where's Waldo style image but it's where is

• What's new in Claude Sonnet 5

Source: Simon Willison — Jun 30 What's new in Claude Sonnet 5 Claude Sonnet 5 came out this morning. I always head straight for the "what's new" developer docs because they tend to have more actionable information than the official announcement post. Anthropic say of Sonnet 5 that "its performance is close

• The AI Compass

Source: Simon Willison — Jun 30 The AI Compass This political compass style quiz by bambamramfan is pretty neat - answer 29 questions about AI and AI ethics to see which of the 30 archetypes you best fit. I'm impressed that my answers on my first time through the quiz categorized me as "The Garage Tinkerer", pa

• Have your agent record video demos of its work with shot-scraper video

Source: Simon Willison — Jun 30 shot-scraper video is a new command introduced in today's shot-scraper 1.10 release which accepts a storyboard.yml file defining a routine to run against a web application and uses Playwright to record a video of that routine. I've written before about the importance of having co

• shot-scraper 1.10

Source: Simon Willison — Jun 30 Release: shot-scraper 1.10 The big new feature is shot-scraper video storyboard.yml, described in detail in Have your agent record video demos of its work with shot-scraper video. Tags: shot-scraper

• HTML table extractor

Source: Simon Willison — Jun 29 Tool: HTML table extractor Yet another in my growing collection of paste-conversion tools. This one accepts pasted rich text from browsers (with embedded HTML tables) and converts every detected table into HTML, Markdown, CSV, TSV, or JSON. Try it out by selecting everything on t

• Count the number of Safari tabs

Source: Simon Willison — Jun 29 Tiniest TIL, using AppleScript to count the number of open browser tabs in Safari: osascript -e 'tell application "Safari" to count tabs of every window' Tags: safari, til, applescript

• Ornith-1.0: Self-Scaffolding LLMs for Agentic Coding

Source: Simon Willison — Jun 29 Ornith-1.0: Self-Scaffolding LLMs for Agentic Coding This is an interesting new open weights (MIT licensed) model, the first model release from DeepReinforce. [...] with variants including 9B Dense, 31B Dense, 35B MoE, and 397B MoE. Built on top of pretrained Gemma 4 and Qwen 3.5

• Quoting Jon Udell

Source: Simon Willison — Jun 28 Human Agent in the loop I dislike the phrase “human in the loop” because it cedes authority to the machines. Let’s flip the narrative. It’s our loop, we work the same way we always have, now we recruit agents to join the team. An agent-assisted process need not be a black box tha

• Hack Your Summer

Source: Simon Willison — Jun 28 Hack Your Summer I learned about this initiative from DJ Patil this morning: It’s a 4-week, high-velocity production sprint for undergraduate students, graduate students, and recent graduates who want to build something real this summer. You’ll learn how to identify a project, ma

• Quoting Dean W. Ball

Source: Simon Willison — Jun 26 This is a bad state of affairs. Consider, in particular, some industry dynamics: Frontier models are trained at an enormous cost, and a significant fraction of that cost is recouped in the few post-release months that they are broadly available. After that period elapses, the mod

• Quoting Timothy B. Lee

Source: Simon Willison — Jun 26 This is like saying there's no learning curve to being a manager because your employees will just do whatever you tell them to do. — Timothy B. Lee, on the idea that LLMs take no skill and have no learning curve Tags: llms, ai, generative-ai

• What happened after 2,000 people tried to hack my AI assistant

Source: Simon Willison — Jun 26 What happened after 2,000 people tried to hack my AI assistant Fernando Irarrázaval ran a challenge on hackmyclaw.com to see if anyone could leak secrets held by his OpenClaw test instance by sending it email. Surprisingly, after 6,000 attempts (and $500 in token spend and a Goog

• Incident Report: CVE-2026-LGTM

Source: Simon Willison — Jun 26 Incident Report: CVE-2026-LGTM Spectacular hypothetical incident report by Andrew Nesbitt. Day 2, 16:00 UTC --- Two AI review agents from competing vendors, both attached to a downstream pull request bumping foxhole-lz4, enter a disagreement loop over whether the package is malic

• Quoting OpenAI

Source: Simon Willison — Jun 26 We're beginning a limited preview of the GPT‑5.6 series: Sol, our flagship model; Terra, a balanced model for everyday work; and Luna, a fast and affordable model. Terra has competitive performance to GPT‑5.5 while being 2x cheaper and Luna brings strong capability at our lowest

---

Source List

All sources tracked in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project — feed: https://genai.owasp.org/feed/
• Simon Willison — feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR — feed: http://export.arxiv.org/rss/cs.CR
• Protect AI — feed: https://protectai.com/blog/rss.xml
• Google Project Zero — feed: https://googleprojectzero.blogspot.com/feeds/posts/default
• CISA Cybersecurity Advisories — feed: https://www.cisa.gov/cybersecurity-advisories/all.xml
• NIST Cybersecurity News — feed: https://www.nist.gov/news-events/cybersecurity/rss.xml
• Hacker News (AI Security) — feed: https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20