AI
AI agents get their superpowers from "skills" - plug-ins that add instructions and code. A new large-scale study of 31,132 skills from two marketplaces finds a big security gap. * 26.1% of skills had at least one vulnerability across 14 patterns in four buckets: prompt injection, data
AI
AI that reads privacy policies so you don't have to Privacy policies are long, legal, and hard to compare. LADFA is a new AI framework that turns those walls of text into a clear map of how companies collect, use, store, and share your personal data. How it
AI
AI agents can be powerful—and unpredictable. AgentGuardian is a new security framework that keeps them on-task by learning and enforcing access rules tailored to each agent. How it works: * Staging phase: It watches the agent run in a controlled setting, logging execution traces and typical inputs to learn what
AI
Turning jailbreakers into the trapped Jailbreak prompts can trick chatbots into breaking rules. HoneyTrap flips the script: a deceptive, multi-agent defense that engages attackers, wastes their time, and keeps helpful answers flowing for regular users. * Threat Interceptor: spots risky prompts early. * Misdirection Controller: steers attackers into harmless honeypots. * Forensic Tracker:
Cybersecurity
Can AI spot phishing? This new email dataset puts it to the test Phishing and spam are getting smarter—often written by large language models. Rebeka Toth, Tamas Bisztray, and Richard Dubniczky release a labeled email dataset that separates phishing, spam, and legitimate messages, and flags whether they were written
Cybersecurity
Smarter email defenses, grounded in real messages Phishing and spam are evolving fast—often with help from AI. This study releases a large, carefully labeled email dataset spanning phishing, spam, and legitimate messages, with a key twist: it marks whether each message was written by a human or an LLM.
AI
AI assistants are starting to browse the web for us—but webpages can hide sneaky instructions that make them misbehave. This paper maps that threat, called prompt injection, and shows how to defend against it in real-world browsing. What the researchers did * Built a realistic benchmark of attacks embedded in
AI
Can we quickly tell if an image is AI-made — and even which generator produced it — without retraining huge models every month? This study says yes. The authors propose a two-stage system: * Learn a visual "fingerprint" space. A vision model trained with supervised contrastive learning separates real vs. synthetic
AI
Encrypted LLM chats can still leak their topic Whisper Leak shows that even with TLS, streaming responses create telltale packet size and timing patterns. Across 28 popular models, these fingerprints let an eavesdropper classify prompt topics with near-perfect accuracy, flagging sensitive ones like "money laundering" and even recovering