AI Security Trend Roundup: Oct 16, 2026

Covering Oct 09 → Oct 16, 2026. 28 new items from 2 sources.

This digest credits every source by name and links directly to each original post. Items are selected automatically by keyword and feed filters. All rights and attribution belong to the original authors.

Academic & Research

• Empirical Evaluation of Machine Learning for Cloud Cryptojacking Detection: Effects of Preprocessing and Evaluation Protocols

Source: arXiv cs.CR, Oct 16. arXiv:2610.20658v1 Announce Type: new Abstract: Artificial intelligence (AI) has been widely applied to cloud cryptojacking detection. Classical machine learning models remain among the most widely used approaches for cloud cryptojacking detection. This paper presents an empirica

• Hybrid DeepXAI Fusion Network for Interpretable Big Data Analytics and Secure Cloud Decision-Making Systems

Source: arXiv cs.CR, Oct 16. arXiv:2610.20661v1 Announce Type: new Abstract: Big data analytics supports modern intelligent systems, but model complexity and limited transparency can undermine interpretability, trust, and security in decision-making. This paper presents the Hybrid DeepXAI Fusion Network, a d

• CascadeLedger: Counterfactual Auditing of Information and Resource Integrity in LLM Cascades

Source: arXiv cs.CR, Oct 16. arXiv:2610.20668v1 Announce Type: new Abstract: We introduce CascadeLedger, a counterfactual execution-audit framework for budgeted language-model cascades. The protocol enforces call-before-read semantics, binds successful reads to service and cache identities, records availabil

• INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems

Source: arXiv cs.CR, Oct 16. arXiv:2610.20776v1 Announce Type: new Abstract: LLM-based agents increasingly execute long-horizon, end-to-end workflows involving shell commands, code modification, dependency installation, and interaction with remote services. This growing autonomy expands their exposure to ind

• Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents

Source: arXiv cs.CR, Oct 16. arXiv:2610.20902v1 Announce Type: new Abstract: LLM coding agents such as Claude Code and OpenAI Codex can drive penetration-testing tools, but they reason about an engagement as a flat list of findings in a context window. Attackers think in graphs: isolated low-severity exposur

• From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection

Source: arXiv cs.CR, Oct 16. arXiv:2610.20907v1 Announce Type: new Abstract: Prompt-injection defenses are commonly evaluated as binary detectors, although deployed LLM applications must make operational decisions about whether to allow, block, or escalate potentially malicious inputs. Recent probabilistic d

• Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming

Source: arXiv cs.CR, Oct 16. arXiv:2610.20941v1 Announce Type: new Abstract: We present Screwtape, a pipeline that converts real agent transcripts into attacks that evade action-only monitors. An LLM attacker edits a transcript so that the agent causes a specified harm, such as leaking an API key or spawning

• PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration

Source: arXiv cs.CR, Oct 16. arXiv:2610.20962v1 Announce Type: new Abstract: NVIDIA's Grace Hopper (GH200) superchip represents a new generation of heterogeneous computing, tightly integrating a 72-core Arm-based CPU with a Hopper GPU on a single module via a high-bandwidth, cache-coherent interconnect. By e

• Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization

Source: arXiv cs.CR, Oct 16. arXiv:2610.21063v1 Announce Type: new Abstract: AI agents now pause for approval before they send money, delete files or email outsiders, and that approval is usually treated as a second factor. We argue it is one only when compromising the agent cannot produce it and when it nam

• Stronger Judges Do Not See More: Deployment-Integrity Blindness in LLM Evaluation

Source: arXiv cs.CR, Oct 16. arXiv:2610.21135v1 Announce Type: new Abstract: LLM-agent evaluation reports behavioral scores but leaves the identity of the deployed runtime stack unreported. A tampered deployment that preserves evaluated outputs passes every output-only evaluator. We introduce DIB-Bench, a be

• ExecWeave: Cross-Layer Execution Provenance for Observable Agentic Software

Source: arXiv cs.CR, Oct 16. arXiv:2610.21146v1 Announce Type: new Abstract: Agentic software invokes tools, launches processes, accesses files, and communicates with local or remote services. Application traces describe logical operations, whereas operating-system telemetry records machine activity without

Prompt Injection & LLM Security

• Chirp Pong

Source: Simon Willison, Oct 15. Tool: Chirp Pong Another game experiment - I wanted to see if it was feasible to have a two player game on two separate phones running in static HTML where the networking code uses chirps sent via the microphone. It seems to work! Build a two player competitive pong like game whe

• Anthropic tells investors quarterly revenue up nearly 50% to $16.8bn ahead of IPO

Source: Simon Willison, Oct 15. Anthropic tells investors quarterly revenue up nearly 50% to $16.8bn ahead of IPO The phrase "told investors" appears four times in this FT article, which reports on Anthropic's day of hosting investors on Wednesday. Lots of details in here from "people with knowledge of the matt

• Tree Appreciator

Source: Simon Willison, Oct 14. Tool: Tree Appreciator Another game experiment with Claude. This one used the default Claude iPhone app (chat mode, not Claude Code mode), where I prompted Claude Opus 5.5 Max with: Build a three js game called "Tree appreciator" - it shows you two algorithmically generated trees

• AI is mass decompiling games. That's both awesome and scary.

Source: Simon Willison, Oct 14. AI is mass decompiling games. That's both awesome and scary. Indie game developer Popcar talks about the recent wave of AI-powered decompilation of existing games, enabling weird mashups between existing games, and producing a boom in game preservation projects to get old ga

• Redesigning source control at Anthropic

Source: Simon Willison, Oct 13. Redesigning source control at Anthropic Interesting piece from Anthropic describing why and how they built their own custom alternative to Git, based on the dramatic increase in rate of changes to their code after the past six months. In May 2026, Anthropic averaged around 2,500

• llm-gemini 0.35

Source: Simon Willison, Oct 13. Release: llm-gemini 0.35 I added support to llm-gemini for the new Gemini 4 Argon model, made available today via the Gemini API and for customers of their $100/month subscription plan. Here are the low, medium and high pelicans. As expected, they are all excellent: Gemini has a

• Quoting Geoffrey Huntley

Source: Simon Willison, Oct 13. If the agent isn't using my diagnostics library, I could introspect and update AGENTS.md, but there's still a delta, and it'll drift. Instead, I write a pre-commit hook that checks the git diff for direct calls to observability modules that bypass my diagnostics module. Boom: fai

• web-edit 0.1a1

Source: Simon Willison, Oct 13. Release: web-edit 0.1a1 Includes performance optimizations written by Claude Opus 5.5 after I fed it this Python 3.15 profiling report generated by GPT-6 Astra. Tags: profiling, projects

• llm-meta-ai 0.2

Source: Simon Willison, Oct 12. Release: llm-meta-ai 0.2 Meta AI release Muse Wonder (and Muse Wonder Full), their new "most capable models". These look like they may be Meta's first Fable class models - Artificial Analysis scores Muse Wonder (Max) as equivalent to GPT-6.1 Sol. I updated my llm-meta-ai plugin f

• Hello Python 3.15, goodbye 3.10, and now I can use 3.11

Source: Simon Willison, Oct 12. Python 3.15 is here! Here's the essential What's new in Python 3.15 guide, this year curated by 3.14 and 3.15 release manager Hugo van Kemenade. As someone who builds open source software that works in every supported Python version, I get to say goodbye to Python 3.10 and start

• Profiling web-edit with Python 3.15: flame graphs and source heatmaps

Source: Simon Willison, Oct 12. Research: Profiling web-edit with Python 3.15: flame graphs and source heatmaps I put the new Python 3.15 profiler through its paces by having GPT-6 Astra Extra High in Codex run it against my new web-edit app: I need a Python 3.15 flame graph and heatmap demo of the "web-edit" a

• web-edit 0.1a0

Source: Simon Willison, Oct 12. Release: web-edit 0.1a0 I was working on a project from my phone using Codex Remote when I found myself wanting to edit a credentials file without round-tripping those credentials through the LLM itself. So... I had Codex and GPT-6 Astra Extra High build this Python web app which

• datasette-ports 0.4

Source: Simon Willison, Oct 12. Release: datasette-ports 0.4 My plugin for detecting and listing all Datasette instances on the current machine now works with the latest version, and displays the detected PID as well. Knowing the PID makes it easier to attach the new Python 3.15 profiler. Tags: datasette

• Dwarf Fortress uses version control now

Source: Simon Willison, Oct 11. I remember hearing a while ago that Dwarf Fortress didn't use version control. That fact has been lodged in my head, because given its inherent complexity I have trouble imagining a codebase that would benefit from version control more. That's art. I went looking and I'm sad to r

• Python 3.15.0 added to actions/python-versions

Source: Simon Willison, Oct 10. Python 3.15.0 added to actions/python-versions Bit of a niche link, but I've been waiting for this for a couple of days - I even told ChatGPT to check for it: Clone https://github.com/actions/python-versions and git pull once an hour until they add the stable 3.15 - then tell me

• Quoting The New York Times

Source: Simon Willison, Oct 10. Anthropic detailed the activity of its A.I. agents in a blog post on Friday, without naming the targeted websites. But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s we

• Deno is joining Cloudflare

Source: Simon Willison, Oct 09. Deno is joining Cloudflare The Deno team released the first version of celld back in August - their open source implementation of the Durable Objects pattern from Cloudflare Workers. Today, Cloudflare are acquiring Deno outright, with the goal of building on celld to "make worker

---

Framework Advisories

• GHSA-6cxc-2vcg-w5qc (vllm-project/vllm)

InputBatch.condense() in vLLM's V1 worker leaves a stale allowed_token_ids mask on a recycled batch row, so a later unrestricted request reusing that slot can have its sampling silently limited by an earlier request's allowlist, with no error returned. Rated Low (CVSS 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N), no CVE assigned. Affects vllm below 0.31.0; fixed in 0.31.0 (PR #43931).

• GHSA-p92p-rxj5-7p2x (vllm-project/vllm)

A client-supplied UUID on a multimodal content part is used directly as the cache identity across two uncoordinated processor caches (API process and engine process); an unauthenticated remote client can exploit the resulting mismatch to trigger a fatal error that kills the EngineCore process and crashes the whole serving instance. Rated Moderate (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), no CVE. Affects vllm below 0.31.0; fixed in 0.31.0 (PR #57833).

• GHSA-4xqp-c3mv-qff7 (vllm-project/vllm)

A single request with max_tokens: null and an oversized min_tokens skips the API process's validation and later crashes the engine's input-handling thread outside normal error handling, hanging all generation while /health keeps reporting 200. Reachable without an API key via the /inference/v1/generate endpoint mounted by default since v0.29.0. Rated Moderate (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), no CVE. Affects vllm below 0.31.0; fixed in 0.31.0.

• GHSA-823j-m4cj-hmjf (vllm-project/vllm)

When serving a MOSS-Audio model, caller-controlled mm_processor_kwargs on the unauthenticated /tokenize endpoint build processors cached in an unbounded dictionary, so repeated or oversized requests can exhaust host memory and crash or degrade the API process; the --api-key flag does not protect /tokenize. Rated High (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no CVE. Affects vllm above 0.24.0 and below 0.31.0; fixed in 0.31.0.

• GHSA-h3rc-6mm3-gc2m (vllm-project/vllm)

A caller-supplied code_revision inside mm_processor_kwargs is passed through to Transformers, which imports processor code from that revision when the operator has trust_remote_code enabled — letting a remote client swap in different code from the same model repo and achieve code execution in the API process. The default trust_remote_code=False setting is unaffected. GitHub displays High (8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H); the advisory text separately suggests Critical (9.8) under a lower-complexity vector, a discrepancy worth noting rather than resolving in either direction. No CVE. Affects vllm 0.7.3 up to (not including) 0.31.0; fixed in 0.31.0 (PR #58830).

• GHSA-rh6f-3x46-j33q (vllm-project/vllm)

Two caller-influenced cache keys — a multimodal EXIF ImageID hash, and untyped prefix-cache "extra keys" — can collide across unrelated requests, letting one request's cached image or KV state be reused by another and weakening cache_salt isolation between LoRA and base-model requests. The higher-rated site is Moderate (CVSS 6.5); a second site is Low (3.1). No CVE. Affects vllm below 0.31.0 (confirmed on 0.25.1); fixed in 0.31.0 (PR #51899).

• GHSA-3fx2-cqw9-xr3c (langchain-ai/langgraph)

The LangGraph Python SDK's v3 streaming client inserts caller-supplied thread_id/assistant_id values into request paths without URL-encoding at four call sites, so relative path segments can redirect an authenticated GET request to a different readable path on the same configured server; the affected requests are GETs only, so there is no write capability. Rated Moderate (CVSS 4.3). Affects langgraph >=1.2.3,<1.2.14 and langgraph-sdk >=0.4.0,<0.4.6; fixed in langgraph 1.2.14 / langgraph-sdk 0.4.6. The LangGraph Platform is not affected.

---

Source List

Sources in this roundup, credited to their original authors/organizations:

• Simon Willison, feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR, feed: http://export.arxiv.org/rss/cs.CR