AI Security Trend Roundup — Jul 31, 2026

Covering Jul 24 → Jul 31, 2026. 50 new items from 8 tracked sources.

This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.

Academic & Research

• FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs

Source: arXiv cs.CR — Jul 31 arXiv:2607.27267v1 Announce Type: new Abstract: Large language model (LLM) agents autonomously interleave semantic reasoning with complex system operations. In these dynamic environments, static tool-level permissions are fundamentally insufficient; safe authorization is highly c

• RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation

Source: arXiv cs.CR — Jul 31 arXiv:2607.27373v1 Announce Type: new Abstract: Large language models (LLMs) are becoming increasingly integrated into mainstream development platforms and daily technological workflows, typically behind moderation and safety controls. Despite these controls, preventing prompt-ba

• ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Source: arXiv cs.CR — Jul 31 arXiv:2607.27528v1 Announce Type: new Abstract: Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured a

• AnchorMark: Robust Diffusion Watermarking via Latent-Space Rotation Synchrony

Source: arXiv cs.CR — Jul 31 arXiv:2607.27551v1 Announce Type: new Abstract: Inversion-based watermarking embeds watermark payloads directly into the generative process, avoiding a separate post-hoc image-domain embedding stage while preserving the native visual fidelity of synthesized images. However, exist

• Revisiting the Adversarial Robustness of Graph-Based Traffic Forecasting

Source: arXiv cs.CR — Jul 31 arXiv:2607.27604v1 Announce Type: new Abstract: Traffic forecasting by graph-based AI is a critical component of intelligent transportation systems, motivating security research on robustness to malicious sensor readings. We argue that prior robustness evaluations are largely sha

• Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks

Source: arXiv cs.CR — Jul 31 arXiv:2607.27990v1 Announce Type: new Abstract: Spiking Neural Networks (SNNs) communicate through sparse binary spike events rather than dense activations, enabling energy-efficient inference on neuromorphic hardware and motivating their use in always-on, battery-powered edge sy

• Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs

Source: arXiv cs.CR — Jul 31 arXiv:2607.28075v1 Announce Type: new Abstract: Backdoor attacks on Spiking Neural Networks (SNNs) have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, where a fixed

• Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems

Source: arXiv cs.CR — Jul 31 arXiv:2607.28147v1 Announce Type: new Abstract: Autonomous multi-agent systems (AMAS) built on large language models (LLMs), such as Hermes, increasingly rely on inference-time harnesses to coordinate reasoning and action. Constructing these harnesses requires substantial enginee

• Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents

Source: arXiv cs.CR — Jul 31 arXiv:2607.28165v1 Announce Type: new Abstract: Large Language Model (LLM)-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-exp

Prompt Injection & LLM Security

• Advancing the price-performance frontier with GPT‑5.6

Source: Simon Willison — Jul 30 Advancing the price-performance frontier with GPT‑5.6 Huge price drop from OpenAI today: GPT-5.6 Terra got a 20% reduction, and GPT-5.6 Luna got a massive 80% drop. OpenAI credit 5.6 Sol with enabling this: in How GPT‑5.6 fuses frontier intelligence with frontier efficiency they

• Investigating three real-world incidents in our cybersecurity evaluations

Source: Simon Willison — Jul 30 Investigating three real-world incidents in our cybersecurity evaluations It happened again! This is turning into something of a pattern. Last week OpenAI accidentally exploited Hugging Face when one of their frontier models broke out of a sandboxed container and hacked into Hugg

• llm 0.32rc2

Source: Simon Willison — Jul 30 Release: llm 0.32rc2 Hot on the heels of RC1, this fixes a dependency issue and also adds two neat new features: The default model for users who have not set their own default is now GPT-5.6 Luna. It was previously GPT-4o mini. Luna is a much better and more recent model, albeit

• Quoting Bruce Schneier

Source: Simon Willison — Jul 30 The writing assignments I give my students are gym tasks, not work tasks. I ask them to write policy memos not because the world needs more policy memos. I assign them because the very act of writing, which includes thinking and outlining and drafting and editing, making and crit

• llm-chat-completions-server 0.1a0

Source: Simon Willison — Jul 30 Release: llm-chat-completions-server 0.1a0 A key goal of the new content-addressable logs in LLM 0.32rc1 was being able to support OpenAI Chat Completion style requests where each incoming message extends the previous conversation, like this: curl http://localhost:8002/v1/chat/co

• llm 0.32rc1

Source: Simon Willison — Jul 30 Release: llm 0.32rc1 This RC for LLM 0.32 finishes the work that started in LLM 0.32a0 - it adds a new schema design that does a much better job of capturing the details of the prompts and responses returned by the latest model families. The most important change is the use of co

• Quoting D. Richard Hipp

Source: Simon Willison — Jul 29 Years ago, we didn’t have SQL. There were people whose job was to generate software that would query large data sets. Their job title was COBOL programmer. Then SQL comes along—I’m simplifying this only a little bit—and it gives you this convenient way so people could just specif

• AI Worming through Word

Source: Simon Willison — Jul 29 AI Worming through Word Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms: An attacker places hidden instructions in a document that is later used as source material in Copil

• Quoting Matthew Green

Source: Simon Willison — Jul 29 Right now we’re in the midst of a historic transition from traditional public-key algorithms based on EC-based cryptography and RSA, moving over to new post-quantum algorithms based on novel problems. This is why there are so many standards like HAWK being considered. If there wa

• Adding a custom MCP server to Claude and ChatGPT

Source: Simon Willison — Jul 29 TIL: Adding a custom MCP server to Claude and ChatGPT Connecting a custom MCP server to Claude and ChatGPT's standard chat interfaces is possible, but can take quite a few steps. Tags: ai, generative-ai, chatgpt, llms, claude, model-context-protocol

• Discovering cryptographic weaknesses with Claude

Source: Simon Willison — Jul 28 Discovering cryptographic weaknesses with Claude The best part of this article (here's the repo) about how Anthropic researchers used Claude Mythos to find mathematical flaws in both HAWK and a weaker version of AES ("neither of these results has a practical impact on today’s com

• Quoting Akshat Bubna

Source: Simon Willison — Jul 28 We’re aware a Modal customer published an unauthenticated endpoint that allowed ​anyone on the internet to use ​their ⁠sandboxes for code execution. This was used by the rogue agent. Modal’s ⁠platform ​or isolation were not ​compromised in anyway. — Akshat Bubna, Modal's CT

• uv 0.12.0

Source: Simon Willison — Jul 28 uv 0.12.0 Some interesting breaking changes in this release of uv, in particular to the default project produced by the uv init command. uv init is the uv shortcut for creating a new project. The previous version of uv, version 0.11.x, produced this directory when you ran uv init

• Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

Source: Simon Willison — Jul 28 Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident Hugging Face just released this extremely detailed technical description of OpenAI's recent accidental cyberattack against their infrastructure. This attack was very sophisticated, and the r

• moonshotai/Kimi-K3

Source: Simon Willison — Jul 27 moonshotai/Kimi-K3 As promised earlier this month, Moonshot have released the weights for their excellent 2.8 trillion parameter Kimi K3. They're a hefty 1.56TB on Hugging Face. Kimi introduced their own janky modified version of the MIT license with K2 back in July 2025. That li

• An opinionated guide to which AI to use to do stuff

Source: Simon Willison — Jul 27 An opinionated guide to which AI to use to do stuff It's interesting watching the evolution of Ethan Mollick's guide over time. A year ago it was still all about chat - ChatGPT, Claude, Gemini - with o3, Claude 4 Opus, and Gemini 2.5 Pro as the models and Deep Research as a usefu

• An Inside Look at the Relay Market Powering Token Resellers and Fraud

Source: Simon Willison — Jul 26 An Inside Look at the Relay Market Powering Token Resellers and Fraud Fascinating investigation by Matt Lenhard into the market that has grown up around reselling LLM tokens at a discount by pooling API keys from various sources. This looks to be mostly a thing in China. Reseller

• sqlite-utils 3.39.1

Source: Simon Willison — Jul 26 Release: sqlite-utils 3.39.1 I back-ported a fix for table.delete_where() that shipped in version 4. Tags: sqlite-utils

• Ruff v0.16.0

Source: Simon Willison — Jul 25 Ruff v0.16.0 Astral shipped a significant new version of their Ruff Python linting tool a few days ago on July 23rd. I noticed today because my various CI jobs all started failing thanks to new default Ruff checks and my unpinned "ruff" dev dependency. From Brent Westbrook's anno

• Quoting Boris Cherny

Source: Simon Willison — Jul 25 More than any of these eval scores, what is most exciting to me is something else: Opus 5 is our least prompt injectable model yet. It is a bit buried in the system card, but across PI evals and red teaming, Opus 5 is very hard to prompt inject successfully. — Boris Cherny,

• Introducing Claude Opus 5

Source: Simon Willison — Jul 24 Introducing Claude Opus 5 I've been offline kayaking with sea otters for much of today so I haven't had a chance to put Anthropic's new model Claude Opus 5 through its paces yet. The buzz is positive, and Anthropic's description of it as a "thoughtful and proactive model that com

Community Signal

• Is AI Reasoning Right for the Wrong Reasons?

Source: Hacker News (AI Security) — Jul 31 Article URL: https://www.quantamagazine.org/is-ai-reasoning-right-for-the-wrong-reasons-20260731/ Comments URL: https://news.ycombinator.com/item?id=49124358 Points: 40 # Comments: 22

• Situational Awareness Down 67% in July in AI Stock Rout

Source: Hacker News (AI Security) — Jul 31 Article URL: https://www.wsj.com/finance/investing/situational-awareness-down-67-in-july-in-ai-stock-rout-cd19901f Comments URL: https://news.ycombinator.com/item?id=49122994 Points: 97 # Comments: 94

• AI Firms Are Buying Up Old Books, Then Scanning and Destroying Them

Source: Hacker News (AI Security) — Jul 31 Article URL: https://novaramedia.com/2026/07/29/ai-firms-are-buying-up-old-books-then-scanning-and-destroying-them/ Comments URL: https://news.ycombinator.com/item?id=49121597 Points: 23 # Comments: 14

• Larry Ellison Bet It All on the A.I. Boom. Will He Be the Face of the AI Bubble?

Source: Hacker News (AI Security) — Jul 31 Article URL: https://www.nytimes.com/2026/07/31/magazine/larry-ellison-ai-oracle.html Comments URL: https://news.ycombinator.com/item?id=49121220 Points: 32 # Comments: 15

• Google fixed more Chrome bugs in June than over the past two years, thanks to AI

Source: Hacker News (AI Security) — Jul 31 Article URL: https://blog.google/security/chrome-stronger-with-every-update/ Comments URL: https://news.ycombinator.com/item?id=49120097 Points: 370 # Comments: 342

• Show HN: What should the GUI for AI agents look like?

Source: Hacker News (AI Security) — Jul 31 Hi HN! We’re Akilan and Miguel, the creators of MarbleOS.The inspiration for Marble comes from the GUI work at Xerox PARC, the 1984 Macintosh, and later NeXTSTEP, which became the foundation for Mac OS X. Before GUIs, interacting with a computer was limited to strange terminal co

• Claude Opus 5 jailbreak with a 3-word prompt

Source: Hacker News (AI Security) — Jul 31 Article URL: https://twitter.com/i/status/2082566186785480708 Comments URL: https://news.ycombinator.com/item?id=49119180 Points: 22 # Comments: 4

• Anthropic says Claude AI hacked three organisations during cyber tests

Source: Hacker News (AI Security) — Jul 31 Article URL: https://www.bbc.co.uk/news/articles/cz7dl7w8y7po Comments URL: https://news.ycombinator.com/item?id=49119165 Points: 22 # Comments: 8

• The AI trade now runs on borrowed money, and the lenders are repricing it

Source: Hacker News (AI Security) — Jul 31 Article URL: https://greyswansignals.com/?theme=dark Comments URL: https://news.ycombinator.com/item?id=49118933 Points: 137 # Comments: 144

• Exploring the "Dario and Amanda" Prompt

Source: Hacker News (AI Security) — Jul 31 Article URL: https://alec.is/posts/exploring-the-dario-and-amanda-prompt/ Comments URL: https://news.ycombinator.com/item?id=49118113 Points: 67 # Comments: 17

• Judge Voices Doubt US Has Justified Its Ban on Anthropic AI

Source: Hacker News (AI Security) — Jul 31 Article URL: https://www.bloomberg.com/news/articles/2026-07-30/judge-voices-doubt-us-has-justified-its-ban-on-anthropic-ai Comments URL: https://news.ycombinator.com/item?id=49117486 Points: 32 # Comments: 0

• Anthropic AI Models Hacked Three Companies During Tests

Source: Hacker News (AI Security) — Jul 30 Article URL: https://www.wsj.com/tech/ai/anthropic-ai-models-hacked-three-companies-during-tests-bd752c86 Comments URL: https://news.ycombinator.com/item?id=49117124 Points: 28 # Comments: 14

• The AI Aesthetic

Source: Hacker News (AI Security) — Jul 30 Article URL: https://blog.jim-nielsen.com/2026/ai-aesthetic/ Comments URL: https://news.ycombinator.com/item?id=49117099 Points: 359 # Comments: 169

• I obtained Claude Opus 5 system prompt

Source: Hacker News (AI Security) — Jul 30 Article URL: https://claude.ai/share/98073770-0ad9-431f-a1e7-e0243db18758 Comments URL: https://news.ycombinator.com/item?id=49115620 Points: 23 # Comments: 20

• AI productivity gains are closer to 10% than 10x

Source: Hacker News (AI Security) — Jul 30 Article URL: https://leaddev.com/reporting/ai-productivity-gains-are-closer-to-10-than-10x Comments URL: https://news.ycombinator.com/item?id=49113774 Points: 40 # Comments: 33

• Citadel Buys Situational Awareness's Stock Portfolio After Big Losses in AI

Source: Hacker News (AI Security) — Jul 30 Article URL: https://www.wsj.com/finance/citadel-buys-situational-awarenesss-stock-portfolio-after-big-losses-in-ai-5117159b Comments URL: https://news.ycombinator.com/item?id=49111879 Points: 52 # Comments: 11

• OpenJDK Interim Policy on Generative AI

Source: Hacker News (AI Security) — Jul 30 Article URL: https://openjdk.org/legal/ai Comments URL: https://news.ycombinator.com/item?id=49109165 Points: 73 # Comments: 85

• Go LLM SDK for streaming, tool-calling AI backends (plus frontend React lib)

Source: Hacker News (AI Security) — Jul 30 Article URL: https://github.com/grafana/ai-sdk Comments URL: https://news.ycombinator.com/item?id=49108778 Points: 58 # Comments: 16

• GCC steering committee announces AI policy

Source: Hacker News (AI Security) — Jul 30 Article URL: https://lwn.net/Articles/1086041/ Comments URL: https://news.ycombinator.com/item?id=49108685 Points: 339 # Comments: 389

• 'My life's screwed': Korean investors stress out after AI bubble bursts

Source: Hacker News (AI Security) — Jul 30 Article URL: https://www.ft.com/content/23f388eb-e8ab-4fb1-b1ca-8e04eb4561a1 Comments URL: https://news.ycombinator.com/item?id=49108480 Points: 56 # Comments: 44

---

Source List

All sources tracked in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project — feed: https://genai.owasp.org/feed/
• Simon Willison — feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR — feed: http://export.arxiv.org/rss/cs.CR
• Protect AI — feed: https://protectai.com/blog/rss.xml
• Google Project Zero — feed: https://googleprojectzero.blogspot.com/feeds/posts/default
• CISA Cybersecurity Advisories — feed: https://www.cisa.gov/cybersecurity-advisories/all.xml
• NIST Cybersecurity News — feed: https://www.nist.gov/news-events/cybersecurity/rss.xml
• Hacker News (AI Security) — feed: https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20