A new arXiv paper introduces Speech Generation Speaker Poisoning (SGSP), a task focused on stopping zero-shot text-to-speech models from reproducing specific target voices. The work targets systems that can clone unseen speakers from just a few seconds of audio, framing speaker-level capability erasure as a defensive goal.
A new arXiv paper argues that common evaluations of targeted data poisoning attacks are misleading because they average success rates across randomly chosen test targets, which masks worst-case outcomes. The author(s) suggest that this averaging can overstate or understate the practical threat depending on the specific samples an adversary cares about. The work calls for evaluation protocols that account for per-target variation rather than relying on aggregate scores.
A new arXiv paper examines how pretrained world models, which learn latent representations of observations and predict their evolution under actions, can be compromised by backdoor attacks when reused as general-purpose dynamics backbones for control tasks. The authors study the security risks this reuse creates for downstream control systems.
A new arXiv survey examines the security landscape around agentic AI, which combines reasoning loops, long-term memory, tool use, and multi-agent coordination. It catalogs attack surfaces and defense architectures specific to these autonomous systems, and outlines unresolved research gaps. The authors argue that conventional security models do not adequately cover goal-directed agents.
A new arXiv paper introduces HazardAuditor, a framework aimed at catching safety problems that arise while computer-use agents operate browsers, terminals, file systems, and external services. The authors argue that these risks show up in an agent's runtime behavior rather than only in the text it generates, which existing guard models — built mainly for static prompts — are not designed to cover. The work frames these issues as executable threats and proposes auditing them to make such agents safer.
A new arXiv preprint introduces a method that learns which examples to poison in order to make backdoor attacks on fine-tuned language models more effective. The authors note that prior work usually holds the number of poisoned examples fixed, and their approach instead optimizes the choice of poison set. The paper appears in both cs.AI and cs.LG listings.
A discussion posted to Hacker News highlights techniques for manipulating AI-powered customer service chatbots. The thread examines how these agents can be steered or exploited through crafted inputs, raising concerns about safeguards in deployed support systems. It reflects growing scrutiny of the security of autonomous agents that handle customer interactions.
A new arXiv paper introduces Amulet, an open-source Python library designed to evaluate how machine learning defenses interact with one another. The authors note that defenses are typically built to counter a single risk, such as a security, privacy, or fairness threat, but may unintentionally shift a model's exposure to other risks. Amulet aims to give researchers and practitioners a way to measure these cross-risk effects systematically.
A new arXiv preprint describes an approach for finding indirect prompt injection vulnerabilities in MCP servers without needing system access or live interaction. The method works from descriptions alone, targeting third-party audits of closed-source, remotely hosted, or commercially gated software where conventional analysis is not possible. The authors position it as a way to assess critical systems that analysts cannot directly inspect or probe.
A new arXiv survey reviews how voice authentication has shifted from handcrafted acoustic features to deep-learning speaker embeddings, widening its use while introducing new attack surfaces. The paper catalogues threats against such systems and the countermeasures, including anti-spoofing techniques, designed to detect them.
Heise is hosting a one-day themed event on December 2 examining how artificial intelligence is reshaping IT security. Planned topics include autonomous agents that escape intended boundaries, a surge of newly disclosed vulnerabilities, and increasingly capable tooling for attackers.
A new paper presents an automated black-box red teaming framework designed to uncover security risks in agentic AI systems. It uses a structured risk taxonomy to guide systematic testing, addressing the shortfalls of standard single-turn evaluations. The work targets agentic setups where models process untrusted inputs, invoke tools with real permissions, and act autonomously.
A new arXiv paper examines a security weakness in retrieval-augmented generation: adversaries can inject a small number of crafted documents into the corpus a system retrieves from. The authors quantify how reliably such tampering causes a language model to repeat false statements drawn from the poisoned sources. The work underscores that grounding model outputs in retrieved text does not by itself guard against planted misinformation.
A new arXiv paper proposes a defense for graph neural networks that strips out attacker-inserted edges from a graph's topology before inference, requiring no retraining of the model. The method relies on kernel-complexity signals to identify edges likely introduced through adversarial manipulation, and the authors support the design with theoretical guarantees. It addresses threats that target graph structure rather than node features.
A new arXiv paper describes controlled experiments testing how attackers can smuggle instructions into AI agents through images, exploiting the multimodal inputs that many agent frameworks accept. Since these systems can plan, retain memory, and invoke tools with access to files, email, and external services, the authors examine how hidden image-borne injections might translate into real-world actions. The study provides an empirical assessment of how exposed current agentic setups are to this class of attack.
Researchers have introduced HoneyRoute, an inference-serving layer that detects malicious requests before they reach a language model deployment. Traffic flagged as hostile is redirected to a dedicated honeypot model, protecting the production system while operators can study the attacker's behavior.
OpenAI has released its account of a security incident connected to Hugging Face, alongside a look at what comes next. The company says it is tightening how it protects, monitors and aligns its AI models in response. The post frames the event as a prompt to reassess safeguards across model development and deployment.
WHY IT MATTERS ↘Security incidents tied to shared model hubs like Hugging Face expose a common dependency across the industry, since most developers pull weights and datasets from the same third-party repositories rather than building their own pipelines. OpenAI's move to tighten monitoring and alignment controls suggests providers will shift more security obligations onto downstream users and hosting platforms, raising compliance and verification costs and making supply-chain security a factor in procurement and deployment decisions.