AI Security Trend Roundup: Oct 25, 2026

Covering Oct 13 → Oct 23, 2026. 28 new items from 2 sources, plus 9 framework advisories.

This digest credits every source by name and links directly to each original post. Items are selected automatically by keyword and feed filters. All rights and attribution belong to the original authors.

Academic & Research

• Self-Evolving Static Analysis via LLM Pseudo-Labeling

Source: arXiv cs.CR, Oct 23. Security bugs often slip past static analysis not because they are impossible to detect, but because detection rules have not yet been written for the code in front of us. New frameworks, APIs, and coding idioms continually create s

• Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

Source: arXiv cs.CR, Oct 23. Retrieval-augmented generation (RAG) systems face security, privacy, and copyright risks including content leakage, source reconstruction, unauthorized access, data poisoning, and prompt injection. Yet RAG protection studies use inc

• MPIDetector: Detecting Multi-modal Prompt Injection via LLM-based Reasoning

Source: arXiv cs.CR, Oct 23. With the rapid integration of Multi-modal Large Language Models (MLLMs) into real-world applications, Prompt Injection (PI) has emerged as a critical security threat. Attackers can conceal malicious instructions within textual narra

• PhishGen: Understanding LLM Capabilities in Automated Phishing Website Generation

Source: arXiv cs.CR, Oct 23. Phishing relies on visual deception, traditionally requiring web-development skills or pre-built kits. LLMs erode this barrier by generating functional websites from natural-language prompts, yet prior work does not answer how far L

• Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models

Source: arXiv cs.CR, Oct 23. Post-generation safety checkers are widely employed in diffusion-model pipelines to prevent unsafe generated content from reaching users. In this paper, we show that these safety checkers can still be bypassed by our proposed multim

• Data-Void Exploits in Web-Searching LLMs

Source: arXiv cs.CR, Oct 23. Web-searching Large Language Models (LLMs) have changed how users seek online information: instead of sifting through ranked lists of links, users read synthesized answers. This shift creates a new LLM vulnerability: a data-void exp

• Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems

Source: arXiv cs.CR, Oct 23. Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify

• Beyond End-to-End Recovery: Towards a Better Understanding of LLM Steganography via Rolewise Decomposition

Source: arXiv cs.CR, Oct 23. In large language model (LLM) steganography, an encoder hides a private message in an otherwise ordinary response, as text transmitted to a decoder, who attempts to recover it. The success of this private-message transmission is com

• Bridging the Closed-World Gap: Interpretable Anomaly Detection via a Hybrid TSK-FCM Ensemble on the BETH Dataset

Source: arXiv cs.CR, Oct 23. A fundamental paradox plagues the deployment of Machine Learning in cybersecurity: supervised models generalize poorly to novel, Out-of-Distribution (OoD) attacks, whereas unsupervised models often suffer from poor separability, lea

• Model-intrinsic, Weight-level, and Training-free Spectral Fingerprinting for Large Language Models

Source: arXiv cs.CR, Oct 23. The increasing release and reuse of Large Language Models (LLMs) as open-weight checkpoints make model fingerprinting important for ownership protection and offline auditing. Existing fingerprinting methods typically construct evide

• Your Token Is Gone: A Token-Consumption Countermeasure for Disrupting LLM-Based Scam Systems

Source: arXiv cs.CR, Oct 23. LLM-based scam systems increasingly combine adaptive dialogue, persistent context, external tools, and multi-agent coordination to automate personalized fraud. These capabilities also create a resource dependency: every reasoning st

• AIRO: A Streaming-Based Machine Learning Framework for Threat Detection and Security in Industrial Internet of Things

Source: arXiv cs.CR, Oct 23. Modern Industrial Internet of Things (IIoT) im- plementations now connect edge gateways, cloud dashboards and business applications. This improves visibility and remote monitoring. However it simultaneously exposes industrial traffi

• Amplifying Latency and Cost of LLM Inference via Rowhammer Attack

Source: arXiv cs.CR, Oct 23. Large language models (LLMs) achieve high inference efficiency using optimized GPU kernels generated by just-in-time (JIT) compilation frameworks such as Triton. Triton compiles GPU kernels through an MLIR/LLVM-based pipeline. We in

• MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition

Source: arXiv cs.CR, Oct 23. Despite recent advances, deepfake detectors remain vulnerable to adversarial examples, particularly in diverse, real-world settings. We propose MIG-COW, a novel adversarial attack framework that generates highly generalizable and vi

Prompt Injection & LLM Security

• DE STAAT - FREEDOM (Official Music Video)

Source: Simon Willison, Oct 22. DE STAAT - FREEDOM (Official Music Video) OK well this is a first for me... at 00:44 in this new music video by Dutch alternative rock band De Staat: The visual effects are credited to Matties Grooten of Fake it or Leave it. Via flir on Hacker News Tags: music, ai, generative-ai,

• Donating Agent Skills to the Agentic AI Foundation

Source: Simon Willison, Oct 22. Donating Agent Skills to the Agentic AI Foundation News today from Anthropic: We’re committed to keeping Agent Skills open, community-driven, and vendor-neutral. Today, we are donating the standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, which we co-founde

• Quoting Armin Ronacher

Source: Simon Willison, Oct 22. As fun as AI is, we built so much bad software over the last 30 years, and now the universe is punishing us for our sins., Armin Ronacher Tags: security, generative-ai, armin-ronacher, ai, ai-security-research, llms

• Today's PHP Security Release, and How We're Strengthening PHP Security

Source: Simon Willison, Oct 21. Today's PHP Security Release, and How We're Strengthening PHP Security If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since las

• Panache — RTS Belle Époque pour mobile

Source: Simon Willison, Oct 21. Panache, RTS Belle Époque pour mobile Well this is delightful: I released Battle Drones yesterday under an Apache 2.0 License and there's already a French language fork which reskins the game to take place in steampunk 1900s France and adds an animated intro! Panache est un jeu d

• eMudhra Intermediate CA Compromise

Source: Simon Willison, Oct 20. eMudhra Intermediate CA Compromise This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Any sof

• Battle Drones - a vibe coded RTS with audio-based multiplayer

Source: Simon Willison, Oct 20 My latest vibe coded game experiment is a Command & Conquer style RTS (Real Time Strategy) game called Battle Drones (play it here). Unlike my previous experiments, this one is actually fun to play. I'm somewhat embarrassed to admit that I got there by telling Claude to "Make it

• My obituary for programming

Source: Simon Willison, Oct 19 My obituary for programming Jeremy Scheff poignantly captures the key loss caused by coding agents for career programmers who enjoyed the puzzle of developing code: Programming turned into one of the greatest jobs you could imagine. You got paid to work on tricky little logic puz

• llm-tools-datasette 0.1.1

Source: Simon Willison, Oct 18 Release: llm-tools-datasette 0.1.1 When I switched LLM over to httpx2 in LLM 0.33 I forget that this would break any plugins which used httpx without directly depending on it. llm-tools-datasette was one of those plugins, now fixed. Tags: datasette, llm

• llm-echo 0.5

Source: Simon Willison, Oct 18 Release: llm-echo 0.5 I'm working towards a new LLM release, and testing PRs caused me to revisit the llm-echo debug plugin. This plugin provides a "model" which doesn't involve an LLM at all - it just repeats back the prompts that have been fed to it. The new release now updates

• Inline rendering with document​.currentScript

Source: Simon Willison, Oct 17 Inline rendering with document​.currentScript Lean Rada describes a neat trick that takes advantage of the document.currentScript property. You can use that to drop in a tiny inline <script> element that replaces itself when the page loads: The year is <script> document.currentSc

• web-edit 0.1a2

Source: Simon Willison, Oct 17 Release: web-edit 0.1a2 web-edit (previously) is my tiny web app for browsing and editing files in a folder. I mainly built it for editing files on different machines via Tailscale. I added a "copy to clipboard" option for both text and image data. I needed this because I was run

• Quoting Addy Osmani, Morgan Westlee Lunt, and Qing Wang

Source: Simon Willison, Oct 16 We think "did a human read the code?" is an imprecise proxy for "what could go wrong with this change, and which check, automated or human, is the right one to catch it?" Asking that question also changed when review happens. Before, review was a gate at the end of the road: writ

• LaTeX renderer

Source: Simon Willison, Oct 15 Tool: LaTeX renderer Inspired by Paul Ford and Aboard Foundary's new web app Tiny Little Office, which provides a suite of web app content editors (a Word Processor, Outliner, Presentation Builder, Spreadsheet, Calculator, Drawing Tool, Diagram Maker, Animator, Calendar, and Trip

Framework Advisories

Security advisories for AI serving and agent frameworks, each sourced from the project's own GitHub Security Advisory.

• vllm-project/vllm: GHSA-vvpg-rrww-wpmh: The OpenAI-compatible server's CORS middleware defaults allowed_origins to a wildcard, and the server performs no authentication unless --api-key/VLLM_API_KEY is set. A malicious web page can therefore use a victim's browser to reach an internal or localhost vLLM deployment, list models, and submit completions. CVSS v3.1 3.4 (Low); affects all versions with default config, fixed in >= 0.32.0.

• vllm-project/vllm: GHSA-8397-8qf6-f2gm: The Phi-4 multimodal audio encoder runs its conformer attention in eager mode by default, materializing and retaining the full attention matrix for each of 24 layers. A single request with a max-length (~10 minute) audio clip can push memory use past what's available and OOM-crash the engine. CVSS v3.1 6.5 (Moderate); affects 0.31.0, fixed in >= 0.32.0.

• vllm-project/vllm: GHSA-h3rc-j82p-2c3h: ImageMediaIO passes attacker-supplied image bytes to Pillow's format autodetection without restricting formats, so a file mislabeled as PNG can be handled by Pillow's EPS plugin, which shells out to the host's Ghostscript. On a build vulnerable to the unrelated CVE-2024-29510, that can lead to command execution; on Pillow 12.0.0-12.2.0 a malformed EPS can instead loop and exhaust workers (DoS only, no code execution). CVSS v3.1 8.1 (High); affects 0.30.0, fixed in >= 0.32.0.

• vllm-project/vllm: GHSA-q97c-p368-75c4: An off-by-one in the tokenizer wrapper's max-token-id bound lets a pre-tokenized prompt token id equal to the vocab size pass input validation; with tensor-parallel size 1 the unmasked embedding lookup triggers a CUDA device-side assert that crashes the engine for all clients. CVSS v3.1 6.5 (Moderate); affects <= 0.30.0, fixed in >= 0.32.0.

• vllm-project/vllm: GHSA-gq5q-89c7-vhvx: DeepSeek-OCR family models (DeepSeek-OCR, DeepSeek-OCR-2, Unlimited-OCR) return None from embed_multimodal when a legitimate image's normalized pixels sum to exactly zero (e.g. a half-black, half-white PNG), violating the method's contract and tripping a fatal sanity assert that shuts down the whole EngineCore and API server until manually restarted. CVSS v3.1 6.5 (Moderate); affects 0.30.0, fixed in >= 0.32.0.

• vllm-project/vllm: GHSA-frvg-qw88-hww9 (CVE-2026-94624): OffloadingConnector with a P2P secondary tier keeps a ZeroMQ session alive for every never-established peer address an API client supplies via kv_transfer_params.prefill; around 340 such peers exhausted the default ZMQ socket quota in testing, and the next peer raised an uncaught error that crashed EngineCore and the API server. CVSS v3.1 6.5 (Moderate); affects 0.26.0, fixed in >= 0.32.0.

• vllm-project/vllm: GHSA-542m-9234-8gvf: Chat templates render in a Jinja2 sandbox with no wall-clock timeout or output-size cap, inside a thread pool whose default single worker can't be interrupted — one malicious template can block all chat-style endpoints for every tenant, or OOM-kill the API-server process via string multiplication. CVSS v3.1 6.5 (Moderate); affects >= 0.19.0, fixed in >= 0.32.0.

• vllm-project/vllm: GHSA-6757-hggm-hp2w: With --mm-processor-cache-type shm enabled, an authenticated caller can forge an SHM handle via features.kwargs_data and make the worker call pickle.loads() on attacker-staged bytes, with no need for VLLM_ALLOW_INSECURE_SERIALIZATION=1. The advisory body lists CVSS v3.1 8.8 (High, AC:L). Its structured metadata vector is AC:H, which scores 7.5 (High). As of Oct 25, 2026 the advisory had not been corrected; both scores are High. Affects <= 0.25.1, fixed in >= 0.32.0.

• langchain-ai/langgraph: GHSA-8prr-f582-jqq3 (CVE-2026-115885): langgraph deploy --verbose printed the short-lived Docker registry push token used for docker login, exposing it to anyone who could read CI logs or terminal recordings for up to its 12-hour, repo-scoped lifetime. CVSS v4.0 4.1 (Moderate); affects langgraph-cli >= 0.4.15, <= 0.4.31, fixed in 0.4.32.

Source List

Sources in this roundup, credited to their original authors/organizations:

• Simon Willison, feed: https://simonwillison.net/atom/everything/
• arXiv cs.CR, feed: http://export.arxiv.org/rss/cs.CR