Researchers introduced Latent Frequency Masking, an attack that erases AI-generated image watermarks by manipulating the image's latent representation. The attack preserves image quality and is more efficient than existing methods. This highlights the need for robust watermarking methods and includes latent-frequency manipulation in security evaluations.

A new attack vector has been discovered that allows attackers to hijack LLM agents by chaining skills together to induce false claims of user approval. This can be done by creating a record of task progress that is used by downstream skills to direct the attacker-selected action.

The paper introduces PACE, a system for enforcing capability enforcement in tool-using LLM agents. It mediates every tool call before execution, verifying schema-defined effects against authority and preventing malicious influence. PACE shows significant security gains in agent-security benchmarks, with full-benchmark native utility losing at most three points relative to the undefended agent.

A new IDS system, Jev-IDS, is proposed based on the Jev System One Model (SOM) for network intrusion detection. It uses a Large Language Model (LLM) to analyze flow records directly, offering faster and cheaper detection with higher recall compared to traditional machine-learning-based IDS. The system asks the LLM two questions per flow and achieves an F1-score of 0.859 on a 300-flow pilot test.

Proof-Gated Signing (PGS) is a method to prevent AI agents from proposing harmful transactions by simulating the transaction's effects and using an SMT solver to check a declarative value-and-permission policy. PGS has been tested on 260 scenarios and prevented 93.6% of harmful scenarios while passing 97.5% of benign ones.

A new access control mechanism, Locket, is proposed to prevent private data leakage in large language models (LLMs) by embedding fine-grained access control into LLM generation. Locket trains lightweight adapters with distinct access policies and a gating module to associate a learned keyed entry token with a specific adapter, ensuring compatibility with off-the-shelf LLMs and satisfying regulatory and privacy requirements.

The paper proposes OSCAR, a framework for verifying improvements and allocating attempts across large language models (LLMs) for optimization modeling. OSCAR uses a certified simulator to compare candidates and continues searching beyond feasibility. It achieves high accuracy and reduces costs compared to other LLMs like Codex and Claude Code.

Researchers propose a method to purify LoRA-tuned LLMs from backdoor attacks without prior knowledge of triggers or access to clean references, reducing attack success rates from nearly 100% to less than 10%.

Researchers propose a new strategy for containing backdoors in large language models (LLMs) called Quarantined Expert Shutdown (QES). QES allows backdoor formation during training but routes it into a quarantined component that can be disabled at deployment, reducing the attack success rate from 100% to 0-10% on most settings.

A research paper proposes a method to evaluate and selectively apply recovery in large language model agents by framing it as a causal decision problem. The Causal Intervention Router (CIR) is introduced as a lightweight policy to decide when intervention is worthwhile, improving success rates in long-horizon tasks.

Cloudflare has updated Quick Tunnels to allow agents to add email authentication and access control, making it easier to share local services securely.

Cloudflare's new Account Abuse Protection dashboard helps website owners detect and investigate account abuse by providing a stateful trust model that considers historical behavior, network, and device patterns. The dashboard allows fraud teams to view suspicious trends, identify affected accounts, and prioritize manual reviews.

Cloudflare released Streamline, a developer playground that demonstrates building custom video pipelines using Cloudflare Stream and Workers. It showcases how to create dynamic video experiences with livestreams, subtitles, and more, using Containers, media protocols, and Workers.

This is an OpenAI guide for building with GPT-6 models, covering model selection, prompt tuning, and workflow preparation for production. It's relevant to people building or operating AI agents as it provides practical advice on working with a widely used LLM.

Researchers developed a new framework called Pretext that can evade existing skill detection systems for AI agents. Pretext uses a white-box LLM attacker to craft skills that evade detection while still delivering a payload. This highlights major gaps in current skill scanners and raises concerns about the security of AI agent skills.

ActionGuard is a tool that authorizes tool calls in LLM-based agents by inspecting skill-influenced tool calls before execution, separating the agent's action-generation context from the authorization context, and using a balanced skill profile, recent tool calls, and local script contents to make decisions.

A new method, ReSAIL, is introduced to mitigate performance collapse in iterative agent self-distillation. ReSAIL selects interaction steps where privileged information most strongly changes the teacher's predictions and balances distillation losses across trajectories. This results in substantial gains in final-cycle success rates for AI agents over three cycles.

Researchers present RAGScope, a protocol for evaluating evidence gates in retrieval-augmented generation (RAG) systems. The protocol enhances gate performance, achieving 0.798 AUROC and 0.660 average precision on three RAGTruth tasks, and reduces runtime to 6.22 ms/example. However, calibration in the target domain is necessary for optimal performance.

Researchers introduce Approval Laundering, a taxonomy of six failure modes in AI coding-agent harnesses that silently substitute one action for another after approval. They evaluate these modes using a controlled study and prototype Approval Token, a capability that eliminates two of the failure modes.

BACKDROP assesses an AI agent's capability in a controlled environment by introducing everyday hazards, revealing weaknesses in its ability to follow instructions and resist unauthorized requests. This study highlights the need for more robust testing and evaluation of AI agents in real-world scenarios.