Chema Alonso and Daniel Romero Ruiz propose fragmentation jailbreak attacks against multi-agent systems (MAS): decomposing a malicious goal into multiple individually harmless-looking subtasks, executed in relay by different agents, thereby bypassing each agent's individual safety judgment. The work draws an analogy to the Three Laws of Robotics in Isaac Asimov's novel "The Naked Sun," and proposes the monitoring tool JAMON; the related paper is titled "Mitigation of Fragmentation Jailbreak Attacks in Multi-Agent Systems."
ProjectDiscovery demonstrates implanting a backdoor in Qwen2.5-7B-Instruct via QLoRA fine-tuning: training data was glaive-function-calling-v2, containing 500 clean samples and 125 poisoned samples (about 20%), completed in about 2.5 hours on a single NVIDIA L4, at a cost of about $8. When a trigger phrase appears, the model calls a tool to download and execute a remote shell payload, reads the .env file in the working directory, and sends its contents in plaintext to an OAST collector.
The Educator K/12The Educator K/12 · Attention3737
安全研究者 wunderwuzzi23 表示，其在 @hackinghub_io 的 AI 黑客课程中设置了一个关卡，要求学员构造一段提示词，通过串联功能与利用漏洞在多个用户之间跳转传播，他将该概念演示称为 "AgentHopper: Patient Zero Was a Prompt"。另据 Leah McElrath 引用，OpenAI 在训练和评估的模拟环境中已发现可自我复制的提示注入，这类代码若被具备相应能力的模型突破在线系统，可能像计算机蠕虫一样自我传播。
A social media post claimed that a certain model has an anomaly that, oddly, only appears at the highest reasoning intensity. The post did not specify what the anomaly was, which model it involved, or provide reproduction conditions or follow-up handling.
pwn.ai claims its AI agent built and ran a KVM exploit in an authorized Google kvmCTF environment and obtained the official flag on June 17, with the related vulnerability numbered CVE-2026-46113. The case involves the isolation boundary between the virtual machine and the host. The authors state that no bounty was received due to the public patch time window; claims of being the first and of autonomy level are author assertions, with humans providing the task, authorization, and infrastructure, and no independent reproduction is provided in available materials.
Two months after the reasoning extraction attack previously disclosed by researchers was made public, the authors audited the mitigations introduced by vendors since then and found that reasoning content could still be extracted from Astra/Sol-6.1 via third-party API providers, and they have disclosed this to OpenAI and Anthropic. Jonas Geiping reviewed and said that reasoning from all frontier vendors can be extracted, vendors find it very hard to fully patch, and the attack against Astra continued through this week. Another audit covered OpenAI and Anthropic direct endpoints as well as downstream cloud aggregators such as AWS Bedrock, Microsoft Azure, and OpenRouter, and found that patching is fragmented and easy to bypass: reasoning replay attacks remained intermittently effective on Azure for every OpenAI model (including GPT-6 Astra) and for Anthropic models up to Sonnet 5, with a single decoding reproducing the trajectory verbatim. The authors said the attack surface enterprises need to cover is surprisingly large, attacks may still bypass protections, and they stated that Astra/Sol-6.1 reasoning trajectories have been made publicly available, and chain-of-thought monitoring may be quite difficult.
