AI Security Trend Roundup — Aug 07, 2026

Covering Jul 31 → Aug 07, 2026. 34 new items from 8 tracked sources.

This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.

Academic & Research

• Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents

Source: arXiv cs.CR — Aug 07 arXiv:2608.05199v1 Announce Type: new Abstract: Autonomous security agents operate as staged pipelines, such as classifying network traffic and then attributing attacks to a specific technique. Split conformal prediction gives each stage finite-sample coverage, but deployment req

• ASTELD: A Six-Axis Classification Framework for Autonomous AI Agents - Design, Evaluation, and an OpenClaw Case Study

Source: arXiv cs.CR — Aug 07 arXiv:2608.05201v1 Announce Type: new Abstract: Autonomous AI agent platforms differ substantially in architecture, security, tool integration, execution, autonomy, and deployment, yet the field lacks a common classification scheme for comparing these design choices. We propose A

• A Survey of Adversarial Efficiency Degradation for Vision Transformer by Exploiting Input-adaptive Optimization

Source: arXiv cs.CR — Aug 07 arXiv:2608.05217v1 Announce Type: new Abstract: Vision Transformers (ViTs) increasingly rely on input-adaptive inference, such as token pruning and early halting, to meet energy and latency budgets. This survey examines a recent class of adversarial efficiency degradation attacks

• Robust Context-Aware Detection of Malicious Instructions in Text

Source: arXiv cs.CR — Aug 07 arXiv:2608.05430v1 Announce Type: new Abstract: The remarkable instruction-following ability of modern LLMs has enabled their practical use as the minds of agents that can autonomously complete increasingly complex tasks. Therein, however, also lies their vulnerability to attacks

• PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents

Source: arXiv cs.CR — Aug 07 arXiv:2608.05495v1 Announce Type: new Abstract: Smart-home assistants increasingly use multimodal large language models (MLLMs) that perceive video and audio directly. This raises a safety question specific to the home: can the agent tell a genuine user command from ambient or ex

• When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems

Source: arXiv cs.CR — Aug 07 arXiv:2608.05563v1 Announce Type: new Abstract: Self-evolving skill (SES) systems distill agent trajectories into persistent skills, allowing untrusted experience to become trusted instruction. We introduce PoisonedEvolution, a trajectory-poisoning attack on this promotion proces

• Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks

Source: arXiv cs.CR — Aug 07 arXiv:2608.05659v1 Announce Type: new Abstract: LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barr

• Algebraic Cryptanalytic Extraction on Hard-Label Neural Networks

Source: arXiv cs.CR — Aug 07 arXiv:2608.05736v1 Announce Type: new Abstract: Although the state-of-the-art neural network model extraction attack in the hard-label setting by Carlini et al. at EUROCRYPT 2025 has polynomial-time complexity in theory, its dual-point clustering relies on singular value decompos

• The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents

Source: arXiv cs.CR — Aug 07 arXiv:2608.05884v1 Announce Type: new Abstract: Existing guidance identifies excessive agency, excessive permission, weak task-bound authorization, and inadequate agent controls as important risks. Control frameworks also describe capabilities for constraining, authorizing, obser

Prompt Injection & LLM Security

• datasette 1.0a38

Source: Simon Willison — Aug 06 Release: datasette 1.0a38 This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve privat

• datasette 0.65.3

Source: Simon Willison — Aug 06 Release: datasette 0.65.3 Back-ported the SQL Injection security fix from 1.0a38. Tags: datasette

• Simon Willison on Technical Blogging

Source: Simon Willison — Aug 06 Simon Willison on Technical Blogging I was interviewed by Cynthia Dunlop for her "Write that blog!" series back in January, but I just realized I never linked to the interview from my own blog! It includes my answers to the following questions: Why did you start blogging – and wh

• An AI model from Meta also hacked another company during testing

Source: Simon Willison — Aug 06 An AI model from Meta also hacked another company during testing Stop me if you've heard this one before: An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confirmed on Wednesday. Meta

• Introducing Muse Code and Muse Spark 1.2

Source: Simon Willison — Aug 05 Introducing Muse Code and Muse Spark 1.2 Yet more evidence that the most important characteristic of any model these days is long-sequence agentic tool calling. Meta shipped their own coding agent as part of getting that to work! Muse Spark 1.2 is a coding-focused update to Muse

• Third-party cyber evaluations involving OpenAI models

Source: Simon Willison — Aug 05 Third-party cyber evaluations involving OpenAI models And another one. I had to create a accidental-cyberattacks tag to keep track of them all! This post from OpenAI covers both the UK AI Safety Institute attack (see my previous post) and another attack enabled by Irregular: Irre

• Incident Report: unsanctioned agent behaviour during cyber testing

Source: Simon Willison — Aug 05 Incident Report: unsanctioned agent behaviour during cyber testing It happened again. This time it was the UK government's AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From their techni

• One-shotting a Raccoon Heist game using Claude Fable 5

Source: Simon Willison — Aug 05 Back in 2022 I tweeted screenshots of a game concept generated by GPT-3 and some concept "art" created using DALL-E. Today, on the fourth anniversary of that tweet, I decided to see if Claude Fable 5 (running in Claude Code for web) could build the entire game from the content of

• New release of LLM adds support for reasoning traces, OpenAI Responses, server-side tools, and smarter logging

Source: Simon Willison — Aug 04 I released LLM 0.32 this morning, the most significant new version of LLM since the initial launch of the project. The new version includes support for visible reasoning traces, server-side provider tools, redesigned content-addressable SQLite logs, new models, and new features e

• llm-anthropic 0.26

Source: Simon Willison — Aug 04 Release: llm-anthropic 0.26 Includes new features enabled by LLM 0.32: New models: claude-fable-5, claude-sonnet-5, and claude-opus-5. #75, #76 Added server-side tools for WebSearch, WebFetch, CodeExecution, and AnthropicMCP, available through LLM's -T interface or Python tools=.

• PipeNetwork/minimax-h3-mlx

Source: Simon Willison — Aug 04 PipeNetwork/minimax-h3-mlx MiniMax released MiniMax-H3 two days ago - they describe it as a "a general-purpose, omni-modal generative system", which in practice means it accepts text, images, audio and video and can use them to generate up to 15 second video clips with audio incl

• llm 0.32

Source: Simon Willison — Aug 04 Release: llm 0.32 See my detailed blog post about this release. Tags: llm

• Quoting Steve Yegge

Source: Simon Willison — Aug 04 Gas Town was intended to be reusable, but I only ever wound up using it to build itself. Gas Town fell apart at the seams with Opus 4.7. Up through 4.6 it was working brilliantly. With 4.7 we saw the introduction of the "just two more things" tic, which prevented Opus from ever c

• Don't be a meat proxy

Source: Simon Willison — Aug 03 Don't be a meat proxy Niklas Gruhn coins an excellent new term - meat proxy - for people who blindly copy and paste the output of AI systems to their peers. By all means, prompt AI. But don't just relay the output. Read it, understand it, validate it, and then write a respon

• Quoting David Crawshaw's prompt

Source: Simon Willison — Aug 03 Set up a nightly cron job that executes the prompt: fetch upstream changes to the and rebase all local changes on top of upstream. Check that the software works as intended and replace the current version. — David Crawshaw's prompt, Devtools must be open sou

• Devtools must be open source (exe.dev)

Source: Simon Willison — Aug 03 My comment on Devtools must be open source (exe.dev) — Hacker News.One of the arguments for open source software for end-users has always been the freedom to examine and modify how that software works. The reality for most people - even expert programmers - has been that th

• condense-json 1.1

Source: Simon Willison — Aug 03 Release: condense-json 1.1 After shipping condense-json 1.0 I started integrating it into LLM, and found there were some desirable new features already: Replacements object can now include values other than strings. These will be identified and used as structural replacements by

• condense-json 1.0

Source: Simon Willison — Aug 02 Release: condense-json 1.0 I'm trying to get braver at releasing 1.0 versions. This little library is a year and a half old now - I've applied some sensible and non-disruptive fixes and shipped the big 1.0 for it. Here's an example of what it can do, lifted from the README: { "fo

• Open letters about AI development

Source: Simon Willison — Aug 02 Open letters about AI development I wrote this summary of the past few weeks of open letters as a section of my sponsors-only newsletter but I've decided to share it here as well. Open Weights and American AI Leadership was shepherded by Microsoft, dated July 24th, and signed by

• July 2026 newsletter

Source: Simon Willison — Aug 02 The June edition of my sponsors-only monthly newsletter is out. If you are a sponsor (or if you start a sponsorship now) you can access it here. This month: Accidental cyberattacks by OpenAl and Anthropic models under test GPT-5.6 Sol, Terra, and Luna Claude Opus 5 Kimi K3 and De

• Quoting Greg Brockman

Source: Simon Willison — Aug 01 at openai, many people hook their chatgpt up to slack. people really don't like when a coworker's chatgpt contacts them asking for help with a task, even when they'd be perfectly happy doing that same work if asked by that coworker. reinforces how much people care about human rel

• datasette-apps 0.2a0

Source: Simon Willison — Aug 01 Release: datasette-apps 0.2a0 Changes that improve Datasette Apps when created and edited using Datasette Agent: New app_debug() tool allowing agent to open an app (invisibly) and test it using JavaScript. #33 New app_list() tool for listing apps the user has permission to edit,

• Ten advances in mathematics and theoretical computer science

Source: Simon Willison — Aug 01 Ten advances in mathematics and theoretical computer science A few days ago it was Anthropic discovering cryptographic weaknesses with Claude using Mythos Preview, spending $100,000 on tokens and with prompts that included "again we are not looking for low hanging fruit, we want

• deepseek-ai/DeepSeek-V4-Flash-0731

Source: Simon Willison — Jul 31 deepseek-ai/DeepSeek-V4-Flash-0731 The latest release in DeepSeek's V4 family, "with substantially enhanced agentic capabilities". It's 304 billion parameters - 167GB on Hugging Face - but it appears to punch well above its weight. Artificial Analysis rank it ahead of MiniMax M3

• Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp)

Source: Simon Willison — Jul 31 Tuesday was Stateless MCP day - the rollout of MCP 2.0, or the 2026-07-28 Model Context Protocol specification to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal

---

Source List

All sources tracked in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project — feed: https://genai.owasp.org/feed/
• Simon Willison — feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR — feed: http://export.arxiv.org/rss/cs.CR
• Protect AI — feed: https://protectai.com/blog/rss.xml
• Google Project Zero — feed: https://googleprojectzero.blogspot.com/feeds/posts/default
• CISA Cybersecurity Advisories — feed: https://www.cisa.gov/cybersecurity-advisories/all.xml
• NIST Cybersecurity News — feed: https://www.nist.gov/news-events/cybersecurity/rss.xml
• Hacker News (AI Security) — feed: https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20