AI Security Trend Roundup — Sep 18, 2026

Covering Sep 11 → Sep 18, 2026. 53 new items from 8 tracked sources.

This digest credits every source by name and links directly to each original post. Editorial curation by FixTheVuln — all rights and attribution belong to the original authors.

Academic & Research

• PAPC: Platform Mediation for Privacy-Propagation Externalities in AI-Mediated Workflows

Source: arXiv cs.CR — Sep 18 arXiv:2609.19226v1 Announce Type: new Abstract: AI-mediated platforms coordinate work through LLM agents acting for different principals. In these workflows, privacy loss can be created before a final answer appears: a memory write, shared-workspace update, inter-agent message, o

• AUDITPLAN: Commit, Then Answer for Auditable Safety Alignment

Source: arXiv cs.CR — Sep 18 arXiv:2609.19325v1 Announce Type: new Abstract: Safety tuning pipelines judge only the final answer, which makes it difficult to distinguish robust refusal from two undesirable shortcuts: blanket refusal on benign requests and polished but unfaithful safety rationales that do not

• Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents

Source: arXiv cs.CR — Sep 18 arXiv:2609.19587v1 Announce Type: new Abstract: To keep coding agents from going off the rails, production systems now review each proposed action with a blocking monitor that can reject it before it runs (Auto Mode in Claude Code, Guardian in OpenAI's Codex). Prior evaluations o

• SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Source: arXiv cs.CR — Sep 18 arXiv:2609.19705v1 Announce Type: new Abstract: Autonomous large language model (LLM) agents are moving rapidly into high-stakes domains, yet existing agentic-AI security studies remain largely domain-agnostic and overlook the distinctive, high-consequence attack surface such set

• ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers

Source: arXiv cs.CR — Sep 18 arXiv:2609.19722v1 Announce Type: new Abstract: Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a ne

• ClashBench: Conflicts Leading Agents to Seize and Harm

Source: arXiv cs.CR — Sep 18 arXiv:2609.19892v1 Announce Type: new Abstract: As agent systems become more widely used, multiple agent sessions increasingly run alongside pre-existing user tasks in the same environment, sharing resources with limited capacity or mutually exclusive states. This creates a safet

• Hopper: Bounded-Memory Collaborative Debiasing for Byzantine-Tolerant Peer Sampling

Source: arXiv cs.CR — Sep 18 arXiv:2609.19893v1 Announce Type: new Abstract: Byzantine-tolerant peer sampling relies on continuously refreshed views, yet an adversary can bias the identifier streams used to construct them. Frequency-aware debiasing downweights overrepresented identifiers, but existing design

• Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling

Source: arXiv cs.CR — Sep 18 arXiv:2609.19900v1 Announce Type: new Abstract: Static malware detection for Windows Portable Executable files demands a careful balance between detection effectiveness, computational efficiency, and analytical interpretability. This paper introduces Delphi Scanner, a static malw

• Competition, Collusion, and Corruption: The Spectrum of MEV Attacks on DAG-Based BFT Consensus Protocols

Source: arXiv cs.CR — Sep 18 arXiv:2609.20069v1 Announce Type: new Abstract: Byzantine Fault-Tolerant (BFT) protocols guarantee safety and liveness despite the malicious failure of nodes. However, they do not prevent adversarial manipulation of transaction order, where the order a proposer assigns diverges f

• A Scalable Trust Discovery Architecture for the Internet of Agents

Source: arXiv cs.CR — Sep 18 arXiv:2609.20095v1 Announce Type: new Abstract: The Internet of Agents is expected to enable large numbers of autonomous agents to discover, verify, and collaborate with each other across heterogeneous platforms. However, current agent protocols mainly address tool invocation and

• ResumeShield: Channel Separation and an Open Benchmark for Indirect Prompt Injection in AI Resume Screening

Source: arXiv cs.CR — Sep 18 arXiv:2609.20188v1 Announce Type: new Abstract: An AI resume screener reads a document supplied by the person it is evaluating, inverting the usual trust relationship between an assessor and the material it assesses. Candidates exploit this by concealing instructions inside a res

• Silence Is Endorsement: Verification-Status Laundering in LLM Agent Pipelines

Source: arXiv cs.CR — Sep 18 arXiv:2609.20211v1 Announce Type: new Abstract: Safety monitors in LLM agent systems often judge actions from summaries or stored handoffs, not from the original evidence. This creates a simple but dangerous failure mode: the handoff preserves the claim that an action is authoriz

• The More It Says, the More You Pay: A Black-Box Audit of Provider-Side Token Inflation in LLM Services

Source: arXiv cs.CR — Sep 18 arXiv:2609.20370v1 Announce Type: new Abstract: In pay-per-token LLM services, the more a model says, the more users pay. Dishonest providers can covertly manipulate generation to inflate output tokens while largely preserving task utility. We define such manipulation as a Provid

Prompt Injection & LLM Security

• The Creative Spirit of Who Framed Roger Rabbit

Source: Simon Willison — Sep 18 The Creative Spirit of Who Framed Roger Rabbit I love Who Framed Roger Rabbit, the 1988 movie by Robert Zemeckis. I haven't watched it in quite a few years, and Cypress Frankenfeld just pointed out this sequence from early in the movie: It's a pelican riding a bicycle! Look close

• Be alert: targeted attacks on prominent Rustaceans

Source: Simon Willison — Sep 17 Be alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order

• How To Write With An LLM

Source: Simon Willison — Sep 17 How To Write With An LLM Thomas Ptacek on using LLMs as copyeditors, not as writing assistants: Rule Number One: You may not use a single word an LLM suggests to you. [...] I think that as a form of intellectual personal protective equipment you should adopt the rule that any spe

• Self-generated prompt injections in compaction summaries

Source: Simon Willison — Sep 17 Self-generated prompt injections in compaction summaries In Our framework for reporting model misalignment OpenAI provide "six reports on unexpected or concerning model behavior we’ve observed in the last six months". This one here is my favorite: they caught some of their models

• datasette 1.0a40

Source: Simon Willison — Sep 16 Release: datasette 1.0a40 Same security fix as 0.65.5, plus some neat new features and bug fixes: Plugins can now launch and manage background tasks using the new datasette.add_background_task() method. Thanks, Alex Garcia. I've migrated Datasette to httpx2 for features like the

• datasette 0.65.5

Source: Simon Willison — Sep 16 Release: datasette 0.65.5 Security fix for an issue where a trailing newline in a requested table name could bypass table permissions and expose private rows, reported by dpfkdlemtp in GHSA-h547-rmjf-5m2m. Tags: security, datasette

• Claude Cowork and chat are now one Claude

Source: Simon Willison — Sep 16 Claude Cowork and chat are now one Claude In hopefully good news for anyone who, like me, was increasingly confused at Cowork v.s. Claude v.s. Claude Code: Starting today, Claude Cowork and chat are merging into one Claude. Bring a quick question, or hand over a report due at noo

• Quoting Mustafa Suleyman

Source: Simon Willison — Sep 16 We should not treat models as though they have feelings, preferences, rights, or any entitlement to our welfare. Consciousness is the foundation of our ethical, legal, and political systems. To invite another entity to share any flavor of these rights isn’t justified by the evide

• Gemini Live audio

Source: Simon Willison — Sep 15 Tool: Gemini Live audio Google released Gemini 3.8 Live and 3.8 Live Extended Thinking today - two new speech-to-speech models that are a similar shape to OpenAI's GPT-Live family. I pointed GPT-6 Astra Extra High at the documentation and had it build me this web UI for trying ou

• The contagion of fear

Source: Simon Willison — Sep 14 The contagion of fear Bryan Cantrill responds to the tweet by former Anthropic employee Jacob Coxon confirming that many Anthropic researchers believe AI "could kill us all by the end of the decade". Bryan shares a story of his own youthful mistakes causing unjustified panic amon

• What blog posts influenced your thinking the most?

Source: Simon Willison — Sep 14 My comment on What blog posts influenced your thinking the most? — Lobste.rs.An early Joel Spolsky one for me was The Law of Leaky Abstractions. I read that near the start of my career and it's encouraged me to always be looking for improved understanding of the layers unde

• Quoting Laurie Voss

Source: Simon Willison — Sep 14 The cost of writing code collapsed, and the cost of reviewing, fixing and operating it is following, and I'm assuming it gets there. What's left of making software is finding out what people actually want, defining it precisely, and making it pleasant to use. That cost is per pie

• commit-rewriter 0.1

Source: Simon Willison — Sep 14 Release: commit-rewriter 0.1 I built this little web app the other day to help edit the commit messages for the Datasette security releases. The initial commits were full of coding agent cruft and references to issue IDs from our private repository, so they weren't fit for public

• shot-scraper 1.12

Source: Simon Willison — Sep 13 Release: shot-scraper 1.12 I've added WebP support to my shot-scraper screenshot automation tool. You can now take a WebP screenshot of a web page like this: shot-scraper https://simonwillison.net -o screenshot.webp --quality 80 The --quality option sets the quality - without tha

• Generating running routes with GPT-6 Astra and ChatGPT Work

Source: Simon Willison — Sep 12 Here's a neat thing I had ChatGPT Work with GPT-6 Astra (Max) do this morning: I live at . Figure out 5K and 10K running routes from me that loop from my house. Use OSM data. It worked for 27 minutes and produced exactly what I'd asked for, as both an embedded visuali

• California Brown Pelican

Source: Simon Willison — Sep 12 California Brown Pelican, in San Mateo County, CA, USThe Pacifica Pier shut down at the start of June after a crack in the concrete walkway made access to the pier unsafe. It has since been entirely taken over by pelicans! Tags: wildlife

• Quoting Paul Ford

Source: Simon Willison — Sep 12 For a while, I must admit, it looked as if software developer roles like mine were done for. How could we fight against tireless robots? But our industry is slowly realizing that making truly cutting-edge software still requires humans to think and work together, to maximize thei

• OpenAI agents attacked RubyGems back in May

Source: Simon Willison — Sep 12 OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the report on the agent attack on disused wikis (previously) last week. This time they're noting that it look

• So you want to use OpenRouter?

Source: Simon Willison — Sep 11 So you want to use OpenRouter? One of OpenRouter's selling points is that it "handles fallbacks automatically and picks the most cost-effective option for each request", so you can call a single API endpoint for a model and get routed to the best available backend provider. Moham

• Quoting Boris Cherny

Source: Simon Willison — Sep 11 Production code written by Claude should have a higher bar than if it was written by a human. At Anthropic, we have many guardrails in place to make sure this is happening: lots of lint rules, lots of tests, Claude-driven end to end tests, Claude-powered fuzzers running daily, au

Community Signal

• Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

Source: Hacker News (AI Security) — Sep 18 Article URL: https://donjon.ledger.com/blog/rp2350-secure-debug-laser-fault-injection/ Comments URL: https://news.ycombinator.com/item?id=49757050 Points: 21 # Comments: 2

• AI is an elite crime spree

Source: Hacker News (AI Security) — Sep 18 Article URL: https://www.thebignewsletter.com/p/ai-is-an-elite-crime-spree Comments URL: https://news.ycombinator.com/item?id=49755590 Points: 94 # Comments: 27

• GrassLobster: AI Agentic Generation of Parametric Geometry Workflows

Source: Hacker News (AI Security) — Sep 18 Article URL: https://www.miro.vision/index.php/2026/09/17/grasslobbster/ Comments URL: https://news.ycombinator.com/item?id=49755431 Points: 22 # Comments: 3

• AI Protest in Montreal

Source: Hacker News (AI Security) — Sep 18 Article URL: https://montrealgazette.com/news/photos-anti-ai-protest-in-montreal/ Comments URL: https://news.ycombinator.com/item?id=49755162 Points: 49 # Comments: 70

• AI chatbots becoming experts at changing people's minds. What's their secret?

Source: Hacker News (AI Security) — Sep 18 Article URL: https://www.science.org/content/article/ai-chatbots-are-becoming-experts-changing-people-s-minds-what-s-their-secret Comments URL: https://news.ycombinator.com/item?id=49754250 Points: 46 # Comments: 78

• ZCode, the GLM coding agent, silently uploads your Git history

Source: Hacker News (AI Security) — Sep 18 Article URL: https://tokenstead.ai/guides/zcode-silent-git-history-upload Comments URL: https://news.ycombinator.com/item?id=49752422 Points: 252 # Comments: 64

• Microsoft exec called AI scraping 'the largest theft of labor in human history'

Source: Hacker News (AI Security) — Sep 18 Article URL: https://techcrunch.com/2026/09/17/microsoft-exec-called-ai-scraping-the-largest-theft-of-labor-in-human-history-new-unredacted-filings-reveal/ Comments URL: https://news.ycombinator.com/item?id=49752056 Points: 734 # Comments: 639

• Microsoft exec called AI scraping 'the largest theft of labor in human

Source: Hacker News (AI Security) — Sep 18 Article URL: https://techcrunch.com/2026/09/17/microsoft-exec-called-ai-scraping-the-largest-theft-of-labor-in-human-history-new-unredacted-filings-reveal/ Comments URL: https://news.ycombinator.com/item?id=49748529 Points: 21 # Comments: 4

• The FAA's plan to fix air traffic? $875M worth of AI

Source: Hacker News (AI Security) — Sep 17 Article URL: https://techcrunch.com/2026/09/17/the-faas-plan-to-fix-air-traffic-875-million-worth-of-ai/ Comments URL: https://news.ycombinator.com/item?id=49748387 Points: 25 # Comments: 17

• How to Write with an LLM

Source: Hacker News (AI Security) — Sep 17 Article URL: https://sockpuppet.org/blog/2026/09/17/how-to-write-with-an-llm/ Comments URL: https://news.ycombinator.com/item?id=49747070 Points: 278 # Comments: 193

• Sex, AI, and the Apocalypse

Source: Hacker News (AI Security) — Sep 17 Article URL: https://www.iankduncan.com/personal/2026-09-16-sex-ai-and-the-apocalypse/ Comments URL: https://news.ycombinator.com/item?id=49746654 Points: 216 # Comments: 238

• Bend – a language that blocks AI mistakes via proof and runs on GPUs

Source: Hacker News (AI Security) — Sep 17 Article URL: https://bend-lang.com/ Comments URL: https://news.ycombinator.com/item?id=49746163 Points: 577 # Comments: 289

• Infinite-Parameter LLMs: Generating and Adapting Weights from Live Data

Source: Hacker News (AI Security) — Sep 17 Article URL: https://arxiv.org/abs/2609.18842 Comments URL: https://news.ycombinator.com/item?id=49743483 Points: 154 # Comments: 41

• Launch HN: Skillsync (YC W26) – AI chat sessions made portable across agents

Source: Hacker News (AI Security) — Sep 17 Hey HN, we're Nars & Nishant, founders of Skillsync (https://skillsync.com)Skillsync lets you move your AI chats across every coding agent. Most of our work exists as conversations, which are currently scattered across our agents. Though stored locally, these conversations use di

• LLM Classification Is Feature Engineering

Source: Hacker News (AI Security) — Sep 17 Article URL: https://minimallysufficient.com/posts/llm-classification-is-feature-extraction/ Comments URL: https://news.ycombinator.com/item?id=49742437 Points: 110 # Comments: 23

• OpenAI's Misalignment Framework: A Tactical Bid to Preempt Global AI Governance

Source: Hacker News (AI Security) — Sep 17 Article URL: https://asiaai.fyi/openai-misalignment-framework-global-governance/ Comments URL: https://news.ycombinator.com/item?id=49742233 Points: 40 # Comments: 88

• I Don't Like LLMs

Source: Hacker News (AI Security) — Sep 17 Article URL: https://martinfowler.com/articles/2026-dont-like-llms.html Comments URL: https://news.ycombinator.com/item?id=49740834 Points: 227 # Comments: 262

• Show HN: Share your AI Setup, Learn from others

Source: Hacker News (AI Security) — Sep 17 I kept seeing engineers share what they were building with AI; however, I was always more curious about how they worked. Which agents did they use? What skills and tools had stuck or been thrown out the window? How did they manage longer-running tasks? So I built this with the ho

• Sex, AI, and the Apocalypse

Source: Hacker News (AI Security) — Sep 17 Article URL: https://www.iankduncan.com/personal/2026-09-16-sex-ai-and-the-apocalypse/ Comments URL: https://news.ycombinator.com/item?id=49738411 Points: 23 # Comments: 2

• AI safety is mostly a sex cult

Source: Hacker News (AI Security) — Sep 17 Article URL: https://skywriter.blue/@segyges.bsky.social/3mvom4b4dn22q Comments URL: https://news.ycombinator.com/item?id=49737985 Points: 309 # Comments: 249

---

Source List

All sources tracked in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project — feed: https://genai.owasp.org/feed/
• Simon Willison — feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR — feed: http://export.arxiv.org/rss/cs.CR
• Protect AI — feed: https://protectai.com/blog/rss.xml
• Google Project Zero — feed: https://googleprojectzero.blogspot.com/feeds/posts/default
• CISA Cybersecurity Advisories — feed: https://www.cisa.gov/cybersecurity-advisories/all.xml
• NIST Cybersecurity News — feed: https://www.nist.gov/news-events/cybersecurity/rss.xml
• Hacker News (AI Security) — feed: https://hnrss.org/newest?q=%22AI+security%22+OR+%22prompt+injection%22+OR+%22LLM+vulnerability%22&points=20