Tag
该论文提出 GraphRAG-LTM 分层威胁建模框架，测试三种攻击者访问层级（黑盒查询、白盒查询、图感知白盒），发现检索排序操纵与关键三元组删除能显著削弱 GraphRAG 的答案质量与支撑事实检索。
This paper presents a comprehensive survey on the cybersecurity challenges and defense mechanisms for trustworthy agentic AI systems, covering threat landscapes, architectures, and open research issues.
A hypothetical security discussion about how poisoned data from a compromised API could flow into AI agents and analytics systems, questioning where defenses should be placed.
Patrick McKenzie argues that many forms of security through obscurity will face severe pressure once adversaries can leverage AI models equivalent to 10,000 research analysts, urging users to remove exposed API keys and credentials from the open internet.
A security analysis paper comparing emerging AI agent communication protocols (MCP, A2A, Agora, ANP) using STRIDE and a white-box Strix scan, highlighting risks and providing a comparative risk assessment framework.
Reintroducing the Codex Security plugin, an open-source tool that can analyze codebases for security threats, generate fixes, and export results to various platforms.
Open Web Docs, funded by the Sovereign Tech Agency, has completed major updates to the Web Security documentation on MDN, covering attacks, defenses, threat modeling, and authentication, with plans for further privacy docs.
The author raises questions about the practicality of studying defenses against post-release fine-tuning that weakens safety behaviors in open-weight LLMs, and asks whether current safety training is worth the effort if models can be broken quickly.
Dropbox describes how they built a system using Model Context Protocol, foundational LLMs, and their Dash AI to automatically retrieve threat models during code reviews and verify security requirements are met, closing the design-to-code security gap.
Bruce Schneier warns that purpose-built Predictive AI, not generative LLMs, will drive the next wave of automated hacking, shifting threat modeling priorities in AppSec.