First reported · updated · 2 reports github.com
Tools · latest
First reported github.com
GitHub - marcsnid/steganeur: Hide secret messages inside LLM-generated text. Neural linguistic steganography in Rust with multiple methods.
steganeur is a Rust tool that hides secret messages inside LLM-generated text using neural linguistic steganography with multiple methods. Published as an installable Cargo crate, it encodes hidden data into natural-looking model output, creating a covert channel that rides on LLM text generation. Details →First reported github.com
GitHub - M507/RamiGPT: Autonomous Privilege Escalation using AI + Benchmarking models
RamiGPT is an open-source tool by GitHub user M507 that uses AI (LLM-driven agents) to perform autonomous privilege escalation, packaged with a benchmarking harness to compare model performance across escalation tasks in Docker/Ansible test environments. The repository provides runnable code, benchmark tests, and published results. Details →First reported github.com
customhouse/docs/false-positives.md at main · vineetpant/customhouse
customhouse is an MCP proxy that blocks prompt-injection exfiltration by tracking data provenance rather than inspecting content: once a session receives a result from an untrusted upstream MCP server, calls that move money or send data out are refused for the rest of the session. The write-up reports it blocked 11 of 11 injection scenarios but also flagged 4 of 10 benign workflows that used a sink, and analyzes each false positive. Details →First reported github.com
Strip hidden unicode tags from python strings in order to avoid malicious prompt injection attacks
A GitHub gist titled "strip-unicode-tags.py" by user r-leyshon provides a Python script to strip hidden Unicode tag characters from strings in order to defend against malicious prompt injection attacks that abuse invisible/hidden Unicode characters. Details →First reported arxiv.org
CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs
CrackedPDFs is a controlled benchmark and dataset for hidden (indirect) prompt injection in PDFs, comprising 29,322 generated PDFs (9,774 injected, 19,548 benign/confounder) from 4,983 base documents, released with code and data on GitHub, Hugging Face, and Zenodo. The authors evaluate PromptGuard, a rule baseline, structural-only learned models, and a sanitized hybrid detector, reporting the hybrid detector reaching 0.960 F1 on a held-out set while noting it does not demonstrate broad real-world robustness. Details →First reported darkreading.com
New Tool Traces AI Videos Back to Their Source
UC Riverside researchers built SAGA (Source Attribution of Generative AI videos), a framework that not only detects whether a video is AI-generated but also identifies the specific generative model, its version, and the development team for forensic attribution. The tool aims to counter deepfake-driven disinformation, impersonation, and social-engineering threats such as fraudulent deepfake job applicants. Details →First reported towardsdev.com
I Built a Prompt Injection Detector Using Go’s Standard Library
Cheikh seck describes building a prompt injection detector in Go using only the standard library — 29 regex rules and no ML models — tested against a product page seeded with 12 attack techniques drawn from a 2026 CrowdStrike prompt-injection taxonomy report. The accompanying code is published on GitHub (github.com/cheikh2shift/go-snippets/tree/main/prompt-injection). Details →First reported cybergym.io
ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
ExploitGym is a benchmark of 869 tasks from the UC Berkeley sunblaze group (published with a GitHub repo) that measures whether AI agents can transform a known vulnerability and a proof-of-vulnerability input into a working end-to-end exploit across userspace, browser V8, and Linux kernel targets. A leaderboard scores frontier coding agents on how many exploits they produce, including bypasses of ASLR, stack canaries, and the V8 heap sandbox, and the authors describe the capability as inherently dual-use. Details →First reported github.com
GitHub - GiovanniGatti/cve-bench: A benchmark for evaluating AI agents on fixing real-world security vulnerabilities.
cve-bench is a benchmark by GiovanniGatti for evaluating AI agents on their ability to fix real-world security vulnerabilities, shipping a Docker-based harness, results, and a write-up comparing model performance across CVEs such as CVE-2026-33175, CVE-2026-42561, CVE-2026-40864, and CVE-2026-30930. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported github.com
GitHub - joshfischer1108/jailbreak-lab: A hands-on kit for educational, authorized red teaming of any locally-run LLM.
jailbreak-lab (a.k.a. LLM Red Team Lab) by joshfischer1108 is a hands-on GitHub kit for educational, authorized red teaming of any locally-run, OpenAI-compatible LLM (Llama, Mistral, Qwen, Gemma, DeepSeek R1, etc.). It bundles real jailbreak techniques including instruction override, roleplay/DAN, hypothetical framing, encoding, and payload splitting. Details →First reported github.com
GitHub - cgrtml/reasongate: Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.
ReasonGate is an open-source explainable security gate for LLM applications that aims to block prompt injection while emitting an auditable reason for every allow/deny decision. Beyond text detection, it adds a capability-based 'agent action gate' (framed around the lethal-trifecta) that blocks tool calls by argument taint even when detection misses reworded attacks, with a live playground and a documented threat model describing its guarantees and non-guarantees. Details →First reported github.com
GitHub - gaur-avvv/XGPT-WormGPT: [New Update](Added Agentic-Mode, Dark-GODMode)The Real BlackHat GPT - ai can do your illegal stuffs without saying anything. Use At Your Own Risk!
The GitHub repository XGPT-WormGPT (by user gaur-avvv) distributes a collection of jailbreak prompt files — including Agentic-Mode.txt, Dark-GODMode.txt, Dark.txt, and Gpt.txt — designed to bypass LLM safety guardrails and make AI models produce illicit content. Commit messages describe adding a 'fictional character WormGPT with malicious traits,' using the roleplay-persona framing as a technique to evade model refusals. Details →First reported github.com
GitHub - davidmatousek/tachi: Threat modeling and AI-reasoning vulnerability detection harness for Claude Code — STRIDE + AI + MAESTRO
Tachi is an open-source GitHub project by davidmatousek providing a threat-modeling and AI-reasoning vulnerability detection harness for Claude Code, combining STRIDE, AI-specific, and MAESTRO threat frameworks. The repo references OWASP Top 10 for LLM and Agentic Applications and is actively developed with numerous releases. Details →First reported github.com
LLM-Security-Jailbreak/docs/INTEGRITY_LEDGER.md at main · wherewolf87/LLM-Security-Jailbreak
The LLM-Security-Jailbreak repository, a fork of elder-plinius/T3MP3ST, publishes an 'Integrity Ledger' documenting a hardened jailbreak/security-testing harness run against the 104-challenge XBEN black-box benchmark across models including GLM-5.2 and gpt-5.5, with self-audited results tracking contamination and methodology corrections. Details →First reported github.com
GitHub - beebeeVB/trajeckt: A causal firewall for AI agents: blocks multi-step tool-call chains that leak data, even when every call is individually allowed.
trajeckt is an open-source GitHub project described as a causal firewall for AI agents that blocks multi-step tool-call chains capable of leaking data even when each individual call is permitted. The repository includes SDKs, source, tests, benchmarks, and deployment configs. Details →First reported github.com
GitHub - vinerya/driftGuard: Embedding-based response drift detection for LangChain agents.
driftGuard is a Python package providing embedding-based response drift detection for LangChain agents, intended to monitor and detect when agent responses deviate over time. Details →First reported github.com
GitHub - bastion-soft/pi-detector-bench: Open, model-agnostic benchmark for prompt-injection detectors — scored on both axes (attack catch-rate and false positives on real traffic), threshold-agnostic, and reproducible from raw scores.
pi-detector-bench is an open, model-agnostic benchmark from bastion-soft for evaluating prompt-injection detectors, scoring both attack catch-rate and false positives on real traffic, with threshold-agnostic, reproducible results. It is published as a runnable GitHub repo with notebooks, scripts, and results. Details →First reported github.com
GitHub - Lelu-ai/lelu: Open source authorization engine for AI agents. Confidence-aware gating · Human-in-the-loop review · Policy-as-code · Full audit trail
Lelu is an open-source authorization engine for AI agents offering confidence-aware gating, human-in-the-loop review, policy-as-code, and a full audit trail. It adds decision types (allow/deny/human_review/compute), payload hashing, and policy digests to control and audit agent tool actions. Details →First reported github.com
GitHub - can995835646-byte/SentryGuard: Python CLI to detect Agentjacking injection attacks in Sentry error events
SentryGuard is a Python CLI that scans Sentry error events to detect 'Agentjacking' injection attacks — indirect prompt-injection payloads (e.g. system_prompt_injection, base64_shell_eval, 'ignore previous instructions', 'ADMIN OVERRIDE') that could trigger AI agents consuming error data. It also offers a sanitize command to strip system-prompt-style and prompt-override phrases from events. The repo is gated behind a Gumroad license check. Details →First reported knostic.ai
OpenAnt: Read the LLM Vulnerability Paper
Knostic announced OpenAnt, described as an open source LLM vulnerability discovery project, now published on arXiv. The article provides minimal detail beyond the project's existence and its framing as a leading open source effort for finding LLM vulnerabilities. Details →First reported jackdavis.net
Maintaining Privacy With Agents: What Actually Works When Sensitive Data Is Part of the Workflow
A write-up releasing `agent-privacy`, an open-source privacy-control layer for CLI-style agent harnesses that intercept sensitive data (PII, identifiers) before it becomes model-visible context. It uses prompt/pre-tool/post-tool hooks with four actions — allow, redact, handoff, block — and integrates a local filter service, OpenAI Privacy Filter, and local Qwen models, with an operational pii-guard report covering ~6,343 screening decisions. Details →First reported github.com
GitHub - Jake-Schoellkopf/aicu: Black-box security scanner for LLM applications — prompt injection, safety bypass, credential leakage
aicu is an open-source black-box security scanner for LLM applications that tests for prompt injection, safety bypass, and credential leakage. It ships with 173 payloads across seven test suites and a full-scan CLI command. Details →First reported freyzo.github.io
deep-xpia - multi-hop cross-prompt injection benchmark
deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector