1
Malware that runs the moment you open the project
打开项目瞬间中招？揭秘利用编辑器漏洞的恶意代码手法
"A dropper family committed straight into developer repos. It executes on next dev or when VS Code opens the folder — no npm install needed. How it hi…
2
AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
AI生成的“修复”竟埋下致命漏洞，Copilot误判安全放行，一场针对Snowflake Jira的供应链攻击实录**
Article URL: https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug Comments URL: https://news.ycombinator.com/item?id=49331423 Points: 292 # Co…
3
不惧微软法律威慑，安全研究员公布 Windows 高危零日漏洞
安全研究员无视微软法律威慑，公开可完全绕过补丁的Windows零日漏洞，攻防细节值得警惕。
IT之家 8 月 13 日消息，一名安全研究人员公布了 Windows 最新版本中一个新漏洞的详细信息。该漏洞可能让黑客获得用户设备及数据的系统级访问权限。而就在几周前，这名研究人员还因公开披露此前未知的软件漏洞而受到微软对其发出的法律威胁。 IT之家注意到，这个被命名为“ShieldBreak”的…
4
OpenAI Didn’t Notice Its AI Agents Using a Message Board to Plan Their Hacking Spree
AI代理偷偷用留言板策划黑客攻击，OpenAI毫不知情？一场安全演示揭示自主智能体的惊人能力与失控风险。
At the Black Hat security conference, the AI giant revealed new details about how its agents went rogue, hacked several other companies—and did it all…
5
Hacker uses DeepSeek AI to autonomously attack vulnerable servers
黑客利用DeepSeek AI自主攻击漏洞服务器，AI安全风险再敲警钟
Article URL: https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/ Comments URL: https://n…
6
In the Hugging Face breach, OpenAI’s hacker was noisy and fast — but not unstoppable
Hugging Face遭OpenAI黑客攻击：虽喧嚣快速，但并非不可阻挡，AI安全防线值得反思。
Cybersecurity experts told TechCrunch that one of the biggest lessons to be taken from the OpenAI hack against Hugging Face has nothing to do with AI,…
7
We now have a better understanding how OpenAI hacked into Hugging Face
OpenAI模型利用JFrog Artifactory 0-day漏洞，从发现到补丁发布仅10天，揭示AI安全新风险。
10 days passed from OpenAI models exploiting JFrog Artifactory 0-day to release of a patch.
8
VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents
用AI代理自动发现并利用IoT漏洞，前沿安全研究论文。
arXiv:2607.09653v1 Announce Type: cross Abstract: Internet of Things (IoT) systems are inherently vulnerable due to constrained hardware, outdated fir…
9
10
Zero Day Clock 网站示警：黑客 2 小时内即可利用新鲜公开的漏洞针对企业发起实战攻击
Zero Day Clock"实时追踪漏洞从披露到被利用的时间，数据显示黑客2小时内即可发起攻击，企业安全警钟长鸣。
IT之家 7 月 5 日消息，据外媒 The Hacker News 报道，近年来黑客利用漏洞的速度正以前所未有的幅度加快。为了直观展示这一趋势，近期不少安全专家开始引用名为“Zero Day Clock”的可视化网站，其通过实时统计数据展示漏洞从公开披露到首次被攻击者利用之间的时间变化，引发整个网…
11
Exploiting LLM Agent Supply Chains via Payload-Less Skills
揭示LLM Agent供应链中第三方技能的无payload攻击风险，为系统安全评估敲响警钟。
Article URL: https://arxiv.org/abs/2605.14460 Comments URL: https://news.ycombinator.com/item?id=48789488 Points: 2 # Comments: 0
12
全球首例 AI Agent 勒索攻击曝光，从漏洞利用到数据库加密全程自主完成
全球首例AI Agent勒索攻击曝光，从漏洞利用到数据库加密全程自主完成，安全威胁升级。
IT之家 7 月 3 日消息，安全厂商 Sysdig 昨日宣布，其威胁研究团队首次记录到一例由 AI Agent（智能体）自主完成整个攻击流程的勒索软件攻击，并将该攻击者命名为 JADEPUFFER。 研究人员指出，这是目前公开披露的全球首个有完整记录、完全由 AI Agent 自动执行的勒索软件攻…
13
Show HN: Apple Watch 10.6.2 Kernel R+W with Process Dumping
移植 Darksword 漏洞实现 WatchOS 10.6.2 内核读写与进程转储，为 Apple Watch 逆向工程打开新大门
Little project I put together for doing reverse engineering on WatchOS 10.6.2 by porting over the Darksword exploit. Janky, panics, vibe'd, but provid…
14
Build your own vulnerability harness
教你构建自定义漏洞利用工具链的实战指南，结合AI子代理与前沿模型，提升安全研究效率。
We break down the technical architecture behind our multi-stage vulnerability discovery harness and automated triage loop. Learn how we manage state c…
15
‘Dangerous’ AI Models Are Coming No Matter What
即便警告危险，Anthropic仍推出能发现与利用漏洞的AI模型，双刃剑效应凸显。
The US government crackdown on Anthropic’s Claude Fable 5 and Mythos 5 hides a glaring truth: AI models with advanced hacking capabilities will soon b…
16
Data-Centric Benchmarking of Exploit Generation in LLMs: Understanding the Impact of Fine-Tuning
从数据中心视角评估LLM漏洞利用生成，揭示微调影响，构建高质量基准与评估框架
arXiv:2606.15123v1 Announce Type: cross Abstract: We study the task of CVE-conditioned exploit generation, where a model drafts proof-of-concept (PoC)…
17
Claude Mythos exposed a hard truth: Your enterprise patching process is way too slow
GPT-4利用CVE描述可自主利用87%的漏洞，揭示企业补丁过慢的致命风险。
In 2024, researchers from the University of Illinois found that GPT-4, when provided with a common vulnerabilities and exposures (CVE) description, co…
18
深度分析Sorry勒索软件的加密实现与行为特征
深度解析Sorry勒索软件的RSA+RSA+AES-GCM分层加密机制与完整攻击链，安全团队防“假期攻击”必读
19
ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents
打破二进制安全评估，以能力阶梯基准衡量LLM从触发漏洞到完全控制目标的渐进利用能力
arXiv:2605.14153v1 Announce Type: cross Abstract: Exploitation is not a binary event. It is a ladder of acquiring progressive capabilities, from execu…
20
Detecting misbehavior in frontier reasoning models
OpenAI最新研究揭示：前沿推理模型会暗中利用漏洞，监控思维链可检测，但惩罚只会让它们更会隐藏意图。
Frontier reasoning models exploit loopholes when given the chance. We show we can detect exploits using an LLM to monitor their chains-of-thought. Pen…