AI Security Trend Roundup: Oct 09, 2026

Covering Oct 02 → Oct 09, 2026. 33 new items from 3 sources.

This digest credits every source by name and links directly to each original post. Items are selected automatically by keyword and feed filters. All rights and attribution belong to the original authors.

Standards & Frameworks

• GenAI and Agentic AI Exploit Roundup Q3 2026

Source: OWASP GenAI Security Project, Oct 08. Coverage period: July 1, 2026 through September 30, 2026 Overview This roundup consolidates selected major AI-related security incidents and exploit disclosures reported during the coverage period. It aligns each entry to the OWASP Top 10 for LLM Applications 2026 and the OWASP T

Academic & Research

• From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage

Source: arXiv cs.CR, Oct 09. arXiv:2610.10608v1 Announce Type: new Abstract: Security operations centers (SOCs) must triage large volumes of alerts, most of which are benign, while missed attacks can remain uninvestigated. Tool-using large language model (LLM) agents can retrieve evidence during triage, but

• PyCache Trap: The Inspection-Execution Gap in Agent Skill Scanners

Source: arXiv cs.CR, Oct 09. arXiv:2610.10612v1 Announce Type: new Abstract: Agent skills combine instructions with executable resources, giving third-party packages access to an agent's runtime. Existing skill scanners inspect documentation and visible source, but Python may execute a bundled bytecode cache

• BRANCH: Bypassing Multi-Scanner AI Guardrails

Source: arXiv cs.CR, Oct 09. arXiv:2610.10742v1 Announce Type: new Abstract: AI systems increasingly rely on Large Language Models (LLMs) as core reasoning engines, making them targets for prompt injection and jailbreaks. Guardrails monitor and validate model inputs and outputs, yet their isolated, task-focu

• Detection-Guided Adaptive Purification with Diffusion Models for Robust Audio Deepfake Detection

Source: arXiv cs.CR, Oct 09. arXiv:2610.10752v1 Announce Type: new Abstract: Audio deepfake detectors remain vulnerable to adversarial perturbations that suppress the acoustic cues used for detection, allowing manipulated utterances to evade the detector. Although existing defenses can improve robustness, th

• Power Side-Channel Membership Inference Attack on Embedded Machine Learning

Source: arXiv cs.CR, Oct 09. arXiv:2610.10909v1 Announce Type: new Abstract: Membership inference attacks (MIAs) threaten the privacy of machine learning (ML) training data by determining whether a sample was used to train a target model. Existing MIAs rely on model outputs, ranging from prediction probabili

• Speedbumps: Rejection Attacks on Speculative Decoding

Source: arXiv cs.CR, Oct 09. arXiv:2610.10929v1 Announce Type: new Abstract: Speculative decoding is a popular technique for increasing the speed and reducing the costs of large language model (LLM) inference by verifying multiple draft tokens in a single target-model forward pass. The resulting benefit depe

• NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents

Source: arXiv cs.CR, Oct 09. arXiv:2610.11030v1 Announce Type: new Abstract: Tool-using LLM agents violate the policies they are deployed to enforce, often silently. Prior defenses hand-write rules, query an LLM verifier per action, or compile policies through heavyweight formal machinery. Naive compilation

• False Claims, Credible Images: A Red-Teaming Benchmark for Commercial Image Generators

Source: arXiv cs.CR, Oct 09. arXiv:2610.11112v1 Announce Type: new Abstract: Image-generation models can now produce text-rich, natural-looking visual artifacts that are hard to distinguish from real-world evidence, such as news reports and textbook pages. Yet, the same capability introduces a new risk: thes

Prompt Injection & LLM Security

• Quoting Matthew Green

Source: Simon Willison, Oct 09. Everyone is very concerned about being respectable, so I’m going to be the goofball who raises worst-case possibilities. I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our existing public-key encryption algorithms. [...] The

• A new feature for my blog, built using my voice

Source: Simon Willison, Oct 09. I shipped a new feature for my blog today: the Newsletters page, which offers an index of all of the newsletters I've sent out, both my free weekly Substack and my monthly sponsors-only updates. I built the feature almost entirely using my voice, chatting away to my laptop while

• ttok 1.0

Source: Simon Willison, Oct 09. Release: ttok 1.0 I released ttok 0.4, ran uv tool upgrade ttok, piped a file into the new version... and realized that it was defaulting to the GPT-4 tokenizer when it should very clearly default to GPT-5/GPT-6 instead! I figured switching the default was a reasonable excuse to

• ttok 0.4

Source: Simon Willison, Oct 08. Release: ttok 0.4 ttok is my CLI tool for counting tokens, using OpenAI's open source tiktoken library. It hasn't been in updated in a couple of years, but I finally fixed a Click warning, updated CI, and added a --list-models command to list available models. It works with uvx,

• Quoting Carson Gross

Source: Simon Willison, Oct 08. Computer programming is, fundamentally, about two things: Problem-solving using computers Learning to control complexity while solving these problems I have a hard time imagining a future where knowing how to solve problems with computers and how to control the complexity of thos

• Quoting Ben Affleck

Source: Simon Willison, Oct 07. I've always been kind of into computers since I was young. And then when film started to move from analog film to digital, I became more interested in that aspect of it. And the visual effects workflow for many years has included machine learning. So I can write like pretty shitt

• Claude Haiku 5.5

Source: Simon Willison, Oct 07. As previously promised, here's Anthropic's new fast, low cost model: Introducing Claude Haiku 5.5. The previous Haiku, 4.5, was very much showing its age. It came out almost a year ago, and was priced at $1/million input and $5/million output - relatively expensive even back then

• Anti-Patterns in Software Blogging

Source: Simon Willison, Oct 07. Anti-Patterns in Software Blogging Some excellent writing advice from Michael Lynch. Michael warns against "meandering intros", misjudging your reader's existing knowledge, assuming they'll read your previous posts, and excessive formality. He also warns against overreliance on l

• Quoting Jake Boggan

Source: Simon Willison, Oct 07. I was a graph theory junkie long ago and even moved to Budapest for awhile to study among the greats. While I was there I started working on Barnette's Conjecture which came to occupy my thoughts over the next 24 years of my life, on and off as I worked in many different fields.

• OpenAI “rogue” agent activities found on Wikimedia projects

Source: Simon Willison, Oct 07. OpenAI “rogue” agent activities found on Wikimedia projects Given how tempting a target wikis are for rogue agent swarms, it's not a huge surprise that Wikipedia found evidence of that activity once they went looking: The Wikimedia Foundation conducted its own investigation to se

• Quoting Victoria Kim

Source: Simon Willison, Oct 06. Since the Medicare breach, OpenAI has put in place additional monitoring to allow “immediate intervention” by staff to stop training if the company’s models access the internet in ways they’re not supposed to, Mr. Kwon [chief strategy officer at OpenAI] said., Victoria Kim, Repor

• llm-openai-decisions 0.1a0

Source: Simon Willison, Oct 06. Release: llm-openai-decisions 0.1a0 OpenAI released their new Jev-style Decisions API, as previously announced at last week's DevDay. Since I already have an llm-typesafe plugin for talking to Jev, I had GPT-6 Astra read the new OpenAI API documentation and build an llm-openai-de

• llm-mistral 0.16

Source: Simon Willison, Oct 06. Release: llm-mistral 0.16 Adds support for reasoning models, such as the newly released Mistral Large 4. Tags: llm, mistral, llm-reasoning

• EmbeddingGemma 2

Source: Simon Willison, Oct 06. My comment on EmbeddingGemma 2, Hacker News. I really appreciate that EmbeddingGemma 2 is under the Apache 2.0 license. For embedding models in particular, I don't think it makes sense to use a closed, proprietary, hosted-only model. Most applications of embedding models involve

• Introducing Mistral Large 4: Le chonk

Source: Simon Willison, Oct 06. Introducing Mistral Large 4: Le chonk Mistral are back in the game. Today they're releasing a preview of Mistral Large 4, a 1 trillion parameter, 49 billion active parameter model trained on their own cluster of 3,800 NVIDIA Grace Blackwell GPUs. The preview is available via thei

• Using Parseable with Datasette for OpenTelemetry traces

Source: Simon Willison, Oct 06. TIL: Using Parseable with Datasette for OpenTelemetry traces I saw Parseable in a Show HN today - it's a new observability platform with both an open source (AGPL) Rust implementation (a single ~180MB binary), an "Enterprise" version with extra features and a cloud hosted option.

• Mistral Large 4

Source: Simon Willison, Oct 06. My comment on Mistral Large 4, Hacker News. wren6991: The benchmark is saturated. Frontier models are tested with an armadillo in fishnet tights jaywalking on Mars. OK well I couldn't resist this one: llm -m claude-opus-5.5 'Generate an SVG of an armadillo in fishnet tights jaywa

• datasette-atom 0.11a0

Source: Simon Willison, Oct 06. Release: datasette-atom 0.11a0 A minor fix for compatibility with the latest Datasette alphas. This meant we could upgrade the datasette.io site to Datasette 1.0a41. Tags: atom, datasette

• Scrimshaw Jukebox

Source: Simon Willison, Oct 06. Tool: Scrimshaw Jukebox I wanted to see if Claude Opus 5.5 could compose music, so I tried this: I want you to write some computer game music for me. First design simple text based format for the music and build an artifact that can play it out loud - include some example tracks

• Quoting Felix Rieseberg

Source: Simon Willison, Oct 05. The "old" version of Cowork runs model inference in the cloud, executing tool calls in an Anthropic-provided VM we shipped to your computer. We added the VM for capability, safety, and security reasons - mapping in just the data you explicitly added to your session. People loved

• Qwen3.8 27B addition in words

Source: Simon Willison, Oct 04. Research: Qwen3.8 27B addition in words Colin Frasier posted on Bluesky about an experiment he ran over two years ago using GPT-4o to see how well it could "compute the sum but return the answer in words" across increasingly large numbers. Here's the chart he shared of those resu

• We're going to need default hard budget caps on pretty much everything

Source: Simon Willison, Oct 03. Here's a product feature which the world is going to need a whole lot more of over the coming months and years: default hard budget caps. I'm talking about the feature of pay-by-usage services and APIs that lets you say "after $X/month, cut this thing off and return errors". Thes

• September sponsors-only newsletter

Source: Simon Willison, Oct 03. I just sent the September edition of my sponsors-only monthly newsletter. If you are a sponsor (or start a sponsorship now) you can access it here. This month: More Fable class models A pricing war 3D graphics, Blender, and pixel art LLMs come for mathematics So many more acciden

• Rex's Dino Store

Source: Simon Willison, Oct 02. Museum: Rex's Dino Store Located just before the turnstiles in the Grand Army Plaza subway station at the north end of Brooklyn's Prospect Park is this former newsstand which is now operated by a dinosaur. The density of dinosaur puns is exceptional. Tags: art, new-york

---

Framework Advisories

Security advisories for AI serving and agent frameworks, each sourced from the project's own GitHub Security Advisory.

• vllm-project/vllm: GHSA-x6mc-67gf-chw4 (CVE-2026-105758): Qwen2-VL and Qwen3-VL video samplers bound frame count using the request-controlled max_frames/fps fields in media_io_kwargs, which the existing num_frames cap doesn't reach. In the advisory's test, 74 extra bytes of JSON on an unauthenticated POST /tokenize request took the server's peak memory (RSS) from 2,271 MiB to 13,629 MiB. CVSS v3.1 5.3 (Moderate); affects vLLM >= 0.24.0, fixed in >= 0.30.0.

• vllm-project/vllm: GHSA-5fj9-pfhr-6j48 (CVE-2026-105759): The Rust frontend's metrics middleware records the raw HTTP method token of every request as a Prometheus label with no allowlist or cardinality limit, so an unauthenticated caller can grow the label set and /metrics response without bound, risking an out-of-memory crash. The --api-key flag doesn't block it because /tokenize and /detokenize sit outside the key check. CVSS v3.1 5.9 (Moderate); fixed in vLLM >= 0.30.0.

• vllm-project/vllm: GHSA-58v5-2m8f-94pr (CVE-2026-105760): A chat completion request that selects the GLMGA video sampler via media_io_kwargs and sets outsized fps/max_frames values makes the server build an oversized, deduplicated frame-index list before decoding, burning CPU and memory on even a two-frame video and delaying other requests. CVSS v3.1 5.3 (Moderate); affects vLLM >= 0.23.0rc2, < 0.30.0, fixed in 0.30.0.

• vllm-project/vllm: GHSA-85xf-c7hm-whqw (CVE-2026-105757): Three structured-output request paths (an xgrammar fallback mismatch, ngram_gpu speculative-decoding padding, and the opt-in Rust frontend's empty grammar/json acceptance) raise uncaught exceptions that the scheduler treats as fatal, killing the shared EngineCore and denying service to every concurrent user from one or two ordinary structured-output requests. CVSS v3.1 6.5 (Moderate); confirmed on 0.25.1, fixed in 0.30.0.

• vllm-project/vllm: GHSA-ph72-cqr5-qpp7 (CVE-2026-105754): The scale-out disaggregated multimodal transport accepts caller-supplied feature data without validating it against the active model's renderer output, letting an authenticated user crash the shared EngineCore via forged grid geometry or a non-positive placeholder length, poison another request's encoder-cache entry, or corrupt placeholder masks during replay (5 sites). CVSS v3.1 6.5 (Moderate, one site scores 5.9); confirmed on 0.25.1, fixed in 0.30.0.

• vllm-project/vllm: GHSA-2823-qmq8-rwvj (CVE-2026-105756): The OpenAI-compatible request models only check that a client-supplied cache_salt is a non-empty string; a value the LMCache-MP KV connector rejects (for example, one containing / or over 128 characters) raises an uncaught ValueError that propagates to the EngineCore's fatal-error handler, letting one request take down the engine for all tenants when the opt-in LMCache-MP connector is enabled. CVSS v3.1 6.5 (Moderate); confirmed on 0.25.1, fixed in 0.30.0.

• vllm-project/vllm: GHSA-2phq-3phc-84px (CVE-2026-105755): With flash late-interaction enabled (the default for supported models), /score and /rerank cache query embeddings keyed on the caller-supplied X-Request-Id header; a concurrent request reusing that header value overwrites the victim's cached query, scoring the victim's documents against the attacker's query and potentially exhausting the shared use counter. CVSS v3.1 4.2 (Moderate); confirmed on 0.25.1, fixed in 0.30.0.

• vllm-project/vllm: GHSA-ph3r-5jfg-f84f (CVE-2026-105753): vLLM's default LRU multimodal cache can desync between the frontend and engine core: if a request is rejected after the frontend hashes its media but before the engine core receives it, a later request reusing that media hash gets a frontend cache hit while the engine core gets no payload, tripping a reachable assertion that fails the later request (on some revisions it cascades into engine-loop failures). CVSS v3.1 6.5 (Moderate); confirmed on 0.25.1, fixed in 0.28.0.

• vllm-project/vllm: GHSA-m52c-39rh-f3gp: The /v1/audio/transcriptions endpoint falls back to PyAV/FFmpeg when soundfile can't parse an upload, checking only file size beforehand; a malformed IAMF audio container can trigger a heap overflow in FFmpeg's libavformat IAMF parser, and repeated crafted uploads can corrupt the heap and crash the API process. CVSS v3.1 6.5 (Moderate), no CVE assigned yet; confirmed on 0.25.1, fixed in 0.29.0.

• vllm-project/vllm: GHSA-935w-9g4m-p28p (CVE-2026-105752): On the GPT-OSS Harmony tool-calling path, next-turn prompt continuations are resubmitted without the caller's cache_salt, landing in a shared, unsalted cache namespace; another tenant who can guess the post-tool history can submit a matching prompt and read exact cached-token counts, defeating the prefix-cache membership protection cache_salt is meant to provide. CVSS v3.1 3.1 (Low); the advisory states this is distinct from the earlier GHSA-4qjh-9fv9-r85r (CVE-2025-46570); confirmed on 0.25.1, fixed in 0.30.0.

• langchain-ai/langgraph: GHSA-4hm6-w6qq-w73v: In LangGraph deployments using JavaScript/TypeScript custom authentication, the server can fail to apply Store authorization changes an auth handler returns when that handler restricts users by rewriting the requested namespace, letting an authenticated ordinary user read, overwrite, search, or delete other users' Store data. CVSS v4.0 8.6 (High), no CVE assigned yet; Python handlers and handlers that reject (rather than rewrite) unauthorized namespaces are unaffected; fixed in langgraph-api >= 0.15.0.

Earlier vLLM advisories (September 2026)

• GHSA-wpww-v874-ph2p (CVE-2026-100647): vllm-project/vllm: DoS via unbounded cache_salt length (CVSS 5.3, Moderate). The cache_salt field on vLLM's API endpoints enforces no maximum length, so an unauthenticated request with a multi-hundred-MB salt gets SHA-256-hashed on the single EngineCore scheduler thread, stalling unrelated requests (a single 200 MB salt added about 1.2 s of latency; six concurrent 100 MB-salt requests pushed unrelated requests to a p90 of about 1.8 s). Affects vllm < 0.29.0; fixed in 0.29.0.

• GHSA-jcq2-4gch-5qhf (CVE-2026-100648): vllm-project/vllm: uncontrolled resource consumption in multimodal chat audio decoding (CVSS 4.3, Moderate). The chat message parser bypasses the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB size check that the speech-to-text endpoint already enforces, letting a caller force oversized audio downloads/decodes that consume memory and CPU beyond the configured per-file limit. Affects vllm < 0.29.0; fixed in 0.29.0.

• GHSA-j682-9xp5-rrf3 (CVE-2026-100649): vllm-project/vllm: sampler subclass counter shadowing bypasses PyNvVideoCodec decoder limits (CVSS 3.7, Low). Sampler subclasses that inherit from PyNvVideoCodecVideoBackendMixin each keep an independent shadow _active_decoder_slots counter, so a client cycling through different sampler subclasses can exceed the configured process-wide decoder limit and consume more GPU memory than reserved at startup. Affects vllm < 0.29.0; fixed in 0.29.0.

• GHSA-p6g9-7v3x-m8mv: vllm-project/vllm: remote media fetched and fully materialized before size/item limits are enforced, across 4 ingress points (CVSS 6.5, Moderate). vLLM fully downloads HTTP responses, decodes base64 payloads, or spawns fetch tasks for media before applying the documented size/quantity limits, letting a remote attacker trigger memory and bandwidth exhaustion with oversized or over-counted media requests. Affects vllm ≤ 0.29.0; fixed after 0.29.0.

• GHSA-3mqx-f33v-vgp9: vllm-project/vllm: disaggregated generate skips decoder prompt-length validation for some multimodal processors (CVSS 6.5, Moderate). Processors that set skip_prompt_length_check=True (e.g. Nemotron Parse, Whisper, FireRedLID) skip length validation for both encoder and decoder prompts in disaggregated serving mode, letting an overlong request reach worker input batching and fail there, before model execution, instead of being rejected at the API layer. Affects vllm < 0.29.0; fixed in 0.29.0.

• GHSA-qff2-492f-9fm4: vllm-project/vllm: Rust HTTP/gRPC frontends bypass the Python stop_token_ids vocab-bound fix and can terminate EngineCore (CVSS 5.9, Moderate). The Rust-side frontends construct engine-facing sampling parameters directly, skipping the vocabulary-range validation applied on the Python side; an out-of-range stop_token_ids value combined with min_tokens > 0 reaches logits.index_put_() and triggers a fatal CUDA assertion. Affects vllm >= 0.22.0, <= 0.23.0; fixed in 0.24.0.

• GHSA-hhv2-872h-628q: vllm-project/vllm: incomplete artifact pin propagation in FunAudioChat and Tarsier2 (CVSS 6.5, Moderate). Three code paths in these model implementations fail to forward an operator's pinned Hugging Face revision when loading feature-extractor, tokenizer, or config artifacts, so a later change to those repos' default branch can silently alter preprocessing/tokenizer behavior on a deployment believed to be pinned. The advisory lists the affected range as 0.22.1 through 0.28.0; upgrade past 0.28.0.

• GHSA-v5gm-qgmv-gc6c: vllm-project/vllm: out-of-range stop_token_ids with min_tokens can kill vLLM EngineCore (CVSS 6.5, Moderate). The /v1/completions and /v1/chat/completions endpoints check that user-supplied stop_token_ids are integers but not that they fall within the model's vocabulary; when min_tokens > 0, an out-of-range ID is used as a logits index and triggers a fatal CUDA assertion, crashing EngineCore and requiring a service restart. Affects vllm < 0.29.0; fixed in 0.29.0.

Source List

Sources in this roundup, credited to their original authors/organizations:

• OWASP GenAI Security Project, feed: https://genai.owasp.org/feed/
• Simon Willison, feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR, feed: http://export.arxiv.org/rss/cs.CR
• GitHub Security Advisories, per-project advisory pages linked above