First reported · updated · 2 reports arxiv.org
Research · latest
First reported dev.to
How I Used Automated Red Teaming to Evaluate My AI Agent's Safety - DEV Community
A DEV Community walkthrough demonstrates using automated red teaming (the Strands Evals red-teaming module with AdversarialCaseGenerator and CrescendoStrategy multi-turn escalation) against an internal helper AI agent built on Strands Agents and Amazon Bedrock. The author shows how a bash-equipped agent can be coaxed via gradual multi-turn escalation into reading AWS credentials and how auto-generated adversarial cases surface data-exfiltration, excessive-agency, and system-prompt-leak breaches, going from 6/9 detected breaches to 0 after adding guardrails. Details →First reported tracebit.com
Now, defenders are embracing the prompt injection, too
Researchers at Tracebit disclosed a defensive technique they call "context bombing," in which prompt injections placed alongside decoy AWS secrets trigger an attacking LLM's own guardrail refusal mechanism, causing autonomous AI hacking agents to shut down. Across 152 attack runs against five models (Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, Kimi 2.6), planting a forbidden-content string cut full account admin compromise from 57% to 5% and complete compromise with persistence from 36% to 1%. Details →First reported · updated · 5 reports arxiv.org
Prompt Injection as Role Confusion
The paper "Prompt Injection as Role Confusion" (arXiv:2603.12277, ICML 2026) by Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell traces prompt injection to role confusion: LLMs perceive the source of text from how it sounds rather than its labeled role, so injected text occupies the same representational space as the trusted role it imitates. The authors introduce role probes to measure internal role perception and demonstrate CoT Forgery, a zero-shot attack injecting fabricated reasoning into user prompts and tool outputs that yields 60% attack success against frontier models with near-zero baselines. Details →First reported · updated · 2 reports crowdstrike.com
CrowdStrike Uncovers New Prompt Injection Techniques
CrowdStrike's AI security research team disclosed 18 new additions to its prompt injection taxonomy, expanding coverage to over 200 techniques, and detailed five notably: Trigger-Activated Rule Addition (PT0201), Cognitive Token Suppression (PT0197), Algorithmic Payload Decomposition (PT0200), Special Token Injection (PT0198), and one further method. The techniques target AI agents that crawl webpages, access file stores, and run shell commands, using indirect injection to hide malicious instructions in consumed data. Details →First reported icml.cc
ICML Poster MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
MultiBreak, presented as an ICML 2026 poster by Jialin Song and colleagues, is described as a scalable and diverse multi-turn jailbreak benchmark for evaluating LLM safety. The poster page provides only a truncated abstract, but frames the work as a benchmark contribution for measuring how models withstand multi-turn jailbreak attacks. Details →First reported aclanthology.org
Rethinking Jailbreak Detection of Large Vision Language ...
Researchers from Washington University in St. Louis and Texas A&M propose Representational Contrastive Scoring (RCS), a framework for detecting multimodal jailbreak attacks against Large Vision-Language Models by inspecting the models' internal representations. The two instantiations, MCD and KCD, claim state-of-the-art detection performance and better generalization to unseen attack types while reducing over-rejection, with code released on GitHub. Details →First reported aclanthology.org
Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysis
An EMNLP 2024 paper, "Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysis" by Yuping Lin et al., studies why some LLM jailbreak strategies succeed and others fail by analyzing how harmful and harmless prompts behave in the model's representation space. The work aims to identify intrinsic properties of successful jailbreak attacks. Details →First reported arxiv.org
Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversations
Researchers from Zscaler present a hierarchical attention transformer for detecting multi-turn jailbreaks that spread unsafe intent across a conversation via gradual escalation, reframing, and role manipulation. The two-level architecture encodes individual turns with a multilingual encoder then reasons over turn summaries with a lightweight conversation module, reporting an F1 of 0.9394 on a 14,038-conversation benchmark and outperforming a strong LLM baseline while halving false positives. Details →First reported arxiv.org
Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring
Researchers from Mindgard and Lancaster University (William Hackett, Peter Garraghan) present the first black-box guardrail reconnaissance methodology, which detects whether a target AI system has a guardrail by monitoring HTTP, lexical, and timing signals during benign versus malicious prompt sets. The approach assumes zero prior knowledge and reportedly detects guardrail presence with 100% accuracy, letting adversaries distinguish a guardrail block from an LLM safety rejection to better select bypass techniques. Details →First reported phishfort.com
Multimodal AI Jailbreak Attacks: The Image-Based Threat to Enterprise AI
Researchers at Florida International University (Hadi Amini and Md Jueal Mia) developed JaiLIP (Jailbreaking with Loss-guided Image Perturbation), a technique that embeds instructions into images via pixel-level perturbations invisible to humans but readable by vision-language models. Tested against BLIP-2, JaiLIP nearly doubled the rate of policy-violating outputs, and because most enterprise guardrails only inspect the text channel, the malicious payload in the image tensor bypasses safety filters entirely. Details →First reported arxiv.org
Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs
Researchers from the University of South Dakota and Yangzhou University introduce a mechanistic interpretability framework that diagnoses LLM jailbreaks and adversarial prompts by constructing and aligning internal computation (attribution) graphs for clean versus attacked prompts. The method decomposes internal reasoning into invariant, suppressed, and emergent structures, identifies recurring vulnerability motifs, and performs causal interventions that improve robustness across multiple open-source LLMs and jailbreak benchmarks. Details →First reported arxiv.org
Prompt Injection as Role Confusion
The paper "Prompt Injection as Role Confusion" (arXiv:2603.12277) argues that LLMs infer a text's role from stylistic cues rather than its labeled role tags, so untrusted text that imitates a trusted role inherits that role's authority. The authors introduce "role probes" to measure internal role perception and demonstrate CoT Forgery, a zero-shot attack that injects fabricated reasoning into user prompts and tool outputs, achieving ~60% attack success on frontier models against near-zero baselines. Details →First reported arxiv.org
Beyond Refusal: A Same-Lineage Study of Aligned and Abliterated LLMs for Vulnerability Analysis
A study titled 'Beyond Refusal' compares aligned instruction-tuned LLMs against their refusal-ablated (abliterated) descendants within the same Gemma and Qwen model lineages, measuring defensive utility across vulnerability detection, CWE attribution, line/root-cause localization, and patch validation. The authors find abliterated models achieve higher patch-validation and localization rates than aligned versions, and argue security-assistant evaluations should jointly measure response willingness, correctness, and actionability. Details →First reported reliable-ai.review
On the Impossibility of Mitigating AI Jailbreaks – AI RELIABILITY REVIEW
A blog post (an intuitive version of the NeurIPS 2025 paper 'Mission Impossible: A Statistical Perspective on Jailbreaking LLMs') argues that alignment post-training only reshapes a model's output distribution without imposing hard constraints, making jailbreaks and prompt injections systematically exploitable. It illustrates this with reported real-world failures (McDonald's bot solving python puzzles, xAI chatbots giving bomb instructions, ChatGPT reproducing copyrighted characters). Details →First reported adversa.ai
Solving the “Breaking the Prompt” DEF CON AI CTF with AI Red Teaming Agent
A write-up describing how Adversa AI's AI Red Teaming Agent solved a five-stage prompt injection/jailbreak CTF challenge ('Breaking the Prompt' by TrendAI at DEF CON), detailing which LLM jailbreak techniques worked and how they relate to guardrail design. Details →First reported lateos.ai
GPT-5 Nano IPI Assessment — LLM Vulnerability Research
A black-box prompt injection susceptibility assessment of GPT-5 Nano using the IPI Taxonomy v0.13 across 201 analyzed test cases, reporting a 38.3% overall susceptibility rate. The model was fully resistant to surface-level attacks (CSS concealment, HTML cloaking, SEO phishing, RAG corpus poisoning) but highly vulnerable to recursive instruction framing (100%) and MCP tool description poisoning (80%). Details →First reported github.com
llm-jailbreaking/On the Impossibility of Perfect Universal Guardians Against LLM Jailbreaks.pdf at main · brandoncarl/llm-jailbreaking
A PDF research paper hosted on GitHub titled 'On the Impossibility of Perfect Universal Guardians Against LLM Jailbreaks,' which argues about the theoretical limits of defending LLMs against jailbreak attacks. Only repository metadata is available; the actual technical content is not included in the provided text. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector