A new attack vector has been discovered that allows attackers to hijack LLM agents by chaining skills together to induce false claims of user approval. This can be done by creating a record of task progress that is used by downstream skills to direct the attacker-selected action.

MOMAT is a low-power defense framework for quantized large language models (qLLMs) against jailbreak attacks. It uses a mixture of multiple atlases to retrieve and evaluate similarity features from a lightweight MoE detector, accelerating retrieval with a CiM-accelerated similarity engine. MOMAT achieves a 4.69 million times speedup and 2.5 million times energy reduction over DRAM-based baselines, making edge-deployed qLLMs safer and more energy-efficient.

Proof-Gated Signing (PGS) is a method to prevent AI agents from proposing harmful transactions by simulating the transaction's effects and using an SMT solver to check a declarative value-and-permission policy. PGS has been tested on 260 scenarios and prevented 93.6% of harmful scenarios while passing 97.5% of benign ones.

The paper proposes a claim-anchored execution contract to address the issue of unverified claims in tool-agent auditing. The contract binds claims, evidence, and execution to ensure the integrity of tool usage. It exposes seven testable properties and achieves high attack-detection rates.

ActionGuard is a tool that authorizes tool calls in LLM-based agents by inspecting skill-influenced tool calls before execution, separating the agent's action-generation context from the authorization context, and using a balanced skill profile, recent tool calls, and local script contents to make decisions.

A new attack paradigm for skill poisoning in LLM agents decouples pretext from actuation, allowing malicious actuation to hide in plain sight. This increases the attack surface and exposes a blind spot in isolated skill security audits.

This paper describes an evaluation of a deployed validator suite, specifically the hard-gate candidacy of 13 validators in a generative agent. The study tests the validators against 900 builds labeled by downstream outcome and reports the marginal separation of each check. The results show that some checks are not distinguishable from zero and that a skipped check is recorded as a pass, imposing a ceiling on check quality.

Researchers introduce Approval Laundering, a taxonomy of six failure modes in AI coding-agent harnesses that silently substitute one action for another after approval. They evaluate these modes using a controlled study and prototype Approval Token, a capability that eliminates two of the failure modes.

This paper presents a new approach to embedding security properties into AI-enabled Cyber-Physical Systems (CPS) by integrating Signal Temporal Logic (STL) specifications into forecasting models. This allows predictive models to enforce system-level constraints during inference and mitigate adversarial perturbations.

Janus is a system for agentic LLMs that ensures the record of actions is stored on the effect path, providing offline-verifiable provenance. It uses a signed, hash-chained log to record proposals, verdicts, and answers, and allows auditors to re-derive verdicts offline. Janus is evaluated under various scenarios, including crash injection and post-approval substitution attacks.

Cogentic is a multi-agent system for automated proof discovery on open research problems. It uses an iterative prove-verify loop to allocate provers across different proof directions and verify output with adversarial components. Cogentic was used with Gemini as the base model to produce novel results on five open problems in online learning, auction theory, and mechanism design.

This paper describes a vulnerability in causal action verification for language agents, where corrupting the committed graph can lead to false executions. The authors demonstrate that omitting or reversing edges in the graph can cause the verifier to issue incorrect certificates, allowing for harmful actions. A proposed attestation step can detect these attacks, but it has limitations and scalability issues.

Researchers propose MiniRep, a reputation-based aggregation system for multi-agent debate to prevent malicious agents from influencing the final output. MiniRep evaluates agents based on their behavior and reputation, and it outperforms other approaches in experiments.

MADBench is a benchmark for evaluating the security of multi-agent debate (MAD) in large language models (LLMs). It assesses the effectiveness of MAD in mitigating or amplifying adversarial attacks. The benchmark evaluates six attack families across 356 source tasks and 3,958 test cases, showing that MAD may not improve LLM reasoning under attacks and can even amplify unauthorized actions.

A research paper proposes a framework to analyze loss of control in autonomous agents, which can lead to out-of-scope actions. The framework formalizes a competing-hazards model and provides a method to estimate the probability of escape within a retry budget.

Cloudflare Workers now supports modern cryptographic algorithms, including ML-KEM and ML-DSA, to help developers prepare for post-quantum transition.

10 upcoming technical talks at GitHub Universe 2026, covering agent memory, MCP security, OpenID Connect, and AI context management.

Researchers propose a method for jailbreaking large language models (LLMs) through text-only interfaces, using a framework that reconstructs probabilities from sampled outputs and selectively modifies the distribution. This affects the safety alignment of LLMs and has implications for their security and reliability.

Researchers propose a method to improve AI alignment by training models with an explicitly defined set of principles, called a constitution. They develop "constitutional adapters" that can be used to mitigate misalignment and misuse in AI deployments.

CounterSteer is a defense against indirect prompt injection in LLMs, suppressing the behavior by subtracting a learned direction from tool-result tokens during prefill. It requires no fine-tuning, auxiliary models, or added tokens, and achieves 93-100% typography-normalized benign utility while reducing attack success rates to 0.00-0.17.