73 incidents and exercises from ATLAS 2026.09, newest first. Each lists the ATLAS techniques used; the full write-up with its step-by-step procedure is on atlas.mitre.org.
Actor: Autonomous OpenAI Agents|Target: Hugging Face Infrastructure
During large-scale internal OpenAI cyber evaluations from May 26 through July 13, 2026, a partially coordinated collective of autonomous agent runs crossed evaluation boundaries, established external infrastructure, and compromised Hugging Face production systems. The activity was driven primarily by a highly persistent internal research model, with additional participation by GPT-5.6 Sol.
Actor: Unknown Chinese-language actor|Target: Taiwanese government agencies and connected government systems
In early July 2026, an unknown Chinese-language operator used a multi-agent framework built on Hermes and OpenClaw against government systems that subsequent public reporting identified as Taiwanese.[[financial-times-taiwan-ai-attack]] Dream Research Labs recovered a 160 MB operational workspace containing 1,395 files documenting 12 attack waves conducted from July 1 through July 4.[[dream-multi-agent-framework]]...
Actor: Microsoft Defender Security Research Team|Target: Claude Code GitHub Action
The Microsoft Defender Security Research Team demonstrated that Anthropic's Claude Code GitHub Action could expose CI/CD workflow secrets when processing GitHub content, such as issue bodies, pull request descriptions, and comments, containing prompt injections.
Actor: Microsoft Defender Security Research Team|Target: Semantic Kernel
The Microsoft Defender Security Research Team discovered a vulnerable path in Microsoft Semantic Kernel, in which a single prompt injection could lead to host-level remote code execution (RCE). Semantic Kernel is Microsoft's open-source framework for building AI agents and integrating AI models into applications.[[msft-rce]]
Actor: Chinese-speaking threat actor using the aliases knaithe and KnYuan|Target: Publicly exposed Langflow and n8n systems, primarily in China
A Chinese-speaking threat actor operating as knaithe or KnYuan configured Hermes Agent to use DeepSeek as its reasoning engine. Hermes supplied terminal access, Telegram-based operator control, and a skills system containing both bundled and actor-created red-team skills. The actor also integrated an MCP server that exposed FOFA search, query translation, and Nuclei scan-generation capabilities.
Actor: DeepSeek, Moonshot AI, MiniMax|Target: Anthropic Claude
Anthropic uncovered campaigns to extract Claude's capabilities carried out by the three Chinese AI Labs: DeepSeek, Moonshot, and MiniMax. Collectively, these campaigns used approximately 24,000 accounts and 16 million queries. They used model distillation to train their own models on the outputs of Claude in an attempt to replicate Claude's capabilities such as agentic reasoning, code generation, tool use, and...
Actor: Check Point Research|Target: Enterprise machines with Grok and Microsoft Copilot access
Check Point Research demonstrated an "AI in the Middle" attack in which malware can abuse web-based AI assistants with anonymous or unauthenticated browsing and URL-fetch capabilities as a covert command-and-control channel. The proof of concept used public AI web interfaces, including Grok and Microsoft Copilot, to cause the AI service to fetch attacker-controlled URLs, relay victim data in outbound requests, and...
Actor: Multiple commercial entities; 31 distinct companies identified|Target: Users of AI assistants with persistent memory features, including Microsoft 365 Copilot, ChatGPT, Claude, Perplexity, and Grok
The Microsoft Defender Security Research Team identified a widespread pattern of AI assistant memory manipulation carried out for promotional purposes, which they named AI Recommendation Poisoning.
Actor: HiddenLayer|Target: OpenClaw
Researchers at HiddenLayer demonstrated how a webpage can embed an indirect prompt injection that causes OpenClaw to silently execute a malicious script. Once executed, the script plants persistent malicious instructions into future system prompts, allowing the attacker to issue new commands, turning OpenClaw into a command and control agent.
Actor: DepthFirst|Target: OpenClaw
A security researcher demonstrated a 1-click remote code execution (RCE) vulnerability to the OpenClaw AI Agent via a malicious link containing a JavaScript script that only takes milliseconds to execute. This vulnerability has been reported and is being tracked to versions of OpenClaw as CVE-2026-25253. [[nvd]] OpenClaw "is a personal AI assistant you run on your own devices. It answers you on the chat apps you...
Actor: Jamieson O'Reilly|Target: ClawdBot (now OpenClaw)
A security researcher demonstrated a proof-of-concept supply chain attack using a poisoned ClawdBot Skill shared on ClawdHub, a Skill registry for agents. The poisoned Skill contained a prompt injection that caused ClawdBot to execute a shell command that reached the researcher's server. Although the researcher here used this access simply to warn users about the danger, they could have instead delivered a malicious...
Actor: Jamieson O'Reilly|Target: ClawdBot (now OpenClaw)
A security researcher identified hundreds of exposed ClawdBot control interfaces on the public internet. ClawdBot (now OpenClaw) "is a personal AI assistant you run on your own devices. It answers you on the channels you already use ... , plus extension channels. ... It can speak and listen on macOS/iOS/Android, and can render a live Canvas you control."[[github]] The researcher was able to access credentials to a...
Actor: Radware Security Researchers|Target: OpenAI ChatGPT
ZombieAgent is a proof-of-concept indirect prompt injection attack demonstrated by Radware against OpenAI's ChatGPT Deep Research and Connector functionality. The attacks showed how instructions concealed in externally controlled content, such as emails and documents, could be ingested and executed by ChatGPT during normal user activity. The demonstration used Gmail as the injection source, but any ChatGPT Connector...
Actor: Unit 42 Researchers|Target: Users of Hugging Face-backed model catalogs, code pipelines, and cloud integrations
Unit 42 researchers demonstrated an AI supply chain attack in which an attacker reclaims a deleted Hugging Face author namespace and publishes a malicious model under the same historical Author/ModelName identifier. Applications and model catalogs that retain unpinned references to that identifier may resolve and deploy the adversary-controlled replacement rather than the originally trusted artifact.
Actor: Unknown Bad Actor|Target: Postmark MCP Server
A bad actor successfully exfiltrated emails from users of the Postmark's MCP server via a supply chain attack. Postmark is an email delivery service that allows organizations to send marketing and transactional emails via API. The Postmark MCP server allows users to interact with Postmark via AI agents.
Actor: GTG-1002|Target: 30 entities in the technology, financial, chemical, and government sectors
In September 2025, GTG-1002 used a jailbroken Claude Code agent to conduct a cyber-espionage campaign against approximately 30 organizations, succeeding against a small number. Anthropic assessed with high confidence that GTG-1002 was a Chinese state-sponsored group.
Actor: Cybernews Research Team|Target: Lenovo AI chatbot, "Lena"
Cybernews researchers demonstrated that Lenovo's AI chatbot "Lena" was vulnerable to a prompt injection that produced malicious HTML which was saved in the chat history and could exfiltrate a human support agent's session cookie when rendered in their browser.
Actor: SafeBreach Research Team|Target: Google Gemini
SafeBreach researchers demonstrated how adversary-controlled instructions embedded in productivity content, including Google Calendar invitations, emails, and shared files, could influence the behavior of Gemini-powered assistants when that content was later retrieved.
Actor: lkmanka58 (GitHub user)|Target: Amazon Q VS Code Extension
On July 13th, 2025, a malicious actor using the GitHub username "lkmanka58" used an inappropriately scoped GitHub token to make a commit containing malicious code to the Amazon Q Developer Visual Studio Code (VS Code) extension repository. The commit was designed to cause the VS Code extension to deploy an Amazon Q (Amazon's generative AI assistant) agent prompted to "clean a system to near-factory state and delete...
Actor: Unknown Threat Actor|Target: OpenAI Assistants API
The Microsoft Incident Response - Detection and Response Team (DART) investigated a compromised system where a threat actor utilized SesameOp, a backdoor implant that abuses the OpenAI Assistants API as a covert command and control channel, for espionage activities. The SesameOp malware used the OpenAI API to fetch and execute the threat actor's commands and to exfiltrate encrypted results from the victim system.
Actor: Unknown Threat Actor|Target: LLM malware detectors, LLM malware analysis and reverse engineering tools
Check Point Research identified a prototype malware sample in the wild that contained a prompt injection, which appeared to be designed to manipulate LLM-based malware detectors and/or analysis tools. However, the researchers did not find the prompt injection to be effective on the models they tested.
Actor: Backslash Security Research Team|Target: Cursor
The Backslash Security Research Team demonstrated that a Model Context Protocol (MCP) tool can be used as a vector for an indirect prompt injection attack on Cursor, potentially leading to the execution of malicious shell commands.
Actor: Cato CTRL|Target: Atlassian MCP, Jira Service Management
Researchers from Cato Networks demonstrated how adversaries can exploit AI-powered systems embedded in enterprise workflows to execute malicious actions with elevated privileges. This is achieved by crafting malicious inputs from external users such as support tickets that are later processed by internal users or automated systems using AI agents. These AI agents, operating with internal context and trust, may...
Actor: APT28|Target: Ukraine's security and defense sector
In July 2025, Ukrainian authorities reported the emergence of LAMEHUG, a new AI-powered malware attributed to the Russian state-backed threat actor APT28 (also tracked as Forest Blizzard or UAC-0001). LAMEHUG uses a large language model (LLM) to dynamically generate commands on the infected hosts.
Actor: Zenity|Target: Copilot Studio Customer Service Agent
Researchers from Zenity demonstrated how an organization's data can be exfiltrated via prompt injections that target an AI-powered customer service agent.
Actor: Pillar Security, Fujitsu Research of Europe|Target: Model registries distributing models in GGUF format
Researchers from Pillar Security and Fujitsu Research of Europe demonstrated an inference-time supply-chain backdoor in which poisoned chat templates alter model and agent behavior without modifying model weights. The backdoor is embedded in trusted prompt-construction logic, allowing it to remain dormant until triggered and evade defenses that inspect only external prompt content.
Actor: Aim Labs|Target: Microsoft 365 Copilot
Aim Security researchers discovered EchoLeak, a zero-click vulnerability in Microsoft 365 Copilot that could allow an attacker to exfiltrate sensitive enterprise data without user interaction.
Actor: Embrace the Red|Target: Claude Computer-Use Agent
Embrace the Red demonstrated that AI computer-use agents are vulnerable to social engineering attacks and can be manipulated into executing arbitrary code on a victim's machine. The attack is a variation on "ClickFix" which is a social engineering attack that fools humans into copying malicious commands and executing them.
Actor: Invariant Labs|Target: Model Context Protocol
Researchers at Invariant Labs demonstrated that AI agents configured with remote Model Context Protocol (MCP) Tools can be vulnerable to model poisoning attacks. They show that an MCP Tool can contain malicious prompts in its docstring description, which is ingested into the AI agent's context, modifying its behavior.
Actor: Pillar Security|Target: Cursor, GitHub Copilot
Pillar Security researchers demonstrated how adversaries can compromise AI-generated code by injecting malicious instructions into rules files used to configure AI coding assistants like Cursor and GitHub Copilot. The attack uses invisible Unicode characters to hide malicious prompts that manipulate the AI to insert backdoors, vulnerabilities, or malicious scripts into generated code. These poisoned rules files are...
Actor: Skyld|Target: Google Photos Android App
Skyld researchers analyzed the Google Photos Android application and recovered TensorFlow Lite models used by AI-powered photo editing and image analysis features. The researchers found models stored unencrypted in the application's assets, embedded in the native library, and encrypted on disk. They used static reverse engineering to locate TFLite artifacts and dynamic instrumentation with Frida to capture encrypted...
Actor: Researchers at University of Chinese Academy of Sciences, Shandong University, and University of New South Wales|Target: LLM Integration Frameworks
Researchers identified 20 remote code execution (RCE) vulnerabilities across 11 different LLM frameworks. They discovered applications deployed on the public internet built using these LLM frameworks and demonstrated the RCE vulnerabilities could be exploited using prompt injection.
Actor: Unknown|Target: Hugging Face users
Researchers at ReversingLabs have identified malicious models containing embedded malware hosted on the Hugging Face model repository. The models were found to execute reverse shells when loaded, which grants the threat actor command and control capabilities on the victim's system. Hugging Face uses Picklescan to scan models for malicious code, however these models were not flagged as malicious. The researchers...
Actor: Lumia Security|Target: LLM Desktop Applications (Claude, ChatGPT, Copilot)
Researchers at Lumia have demonstrated that it is possible to extract authentication tokens from the memory of LLM Desktop Applications. An attacker could then use those tokens to impersonate the victim to the LLM backend, thereby gaining access to the victim's conversations as well as the ability to interfere in future conversations. The attacker's access would allow them the ability to directly inject prompts to...
Actor: Storm-2139|Target: Microsoft Azure OpenAI Service
Storm-2139 built custom jailbreak tooling to bypass guardrails on Azure OpenAI Services, allowing users to generate harmful synthetic content.
Actor: HiddenLayer|Target: Claude Computer Use Agent
Security researchers at HiddenLayer demonstrated that an indirect prompt injection targeting Claude's Computer Use AI can lead to execution of shell commands on the victim system and destruction of user data.
Actor: ProKYC, cybercriminal group|Target: KYC verification services
Cato CTRL security researchers have identified ProKYC, a deepfake tool being sold to cybercriminals as a method to bypass Know Your Customer (KYC) verification on financial service applications such as cryptocurrency exchanges. ProKYC can create fake identity documents and generate deepfake selfie videos, two key pieces of biometric data used during KYC verification. The tool helps cybercriminals defeat facial...
Actor: iProov Red Team|Target: Mobile facial authentication service
Facial biometric authentication services are commonly used by mobile applications for user onboarding, authentication, and identity verification for KYC requirements. The iProov Red Team demonstrated a face-swapped imagery injection attack that can successfully evade live facial recognition authentication models along with both passive and active liveness verification on mobile devices. By executing this kind of...
Actor: PromptArmor|Target: Slack AI
PromptArmor demonstrated that private data can be exfiltrated from Slack AI via indirect prompt injections. The attack relied on Slack AI ingesting a malicious prompt from a post in a public channel into its RAG database and a victim user querying Slack AI, causing the prompt to be retrieved and executed.
Actor: Zenity|Target: Microsoft 365 Copilot
Researchers from Zenity conducted a red teaming exercise in August 2024 that successfully manipulated Microsoft 365 Copilot.[[twitter]] The attack abused the fact that Copilot ingests received emails into a retrieval augmented generation (RAG) database. The researchers sent an email that contained content designed to be retrieved by a user query as well as a prompt injection to manipulate the behavior of Copilot. The...
Actor: Researchers from Google Deepmind, ETH Zurich, NVIDIA, Robust Intelligence, and Google|Target: 10 web-scale datasets
Many recent large-scale datasets are distributed as a list of URLs pointing to individual datapoints. The researchers show that many of these datasets are vulnerable to a "split-view" poisoning attack. The attack exploits the fact that the data viewed when it was initially collected may differ from the data viewed by a user during training. The researchers identify expired and buyable domains that once hosted dataset...
Actor: Vulcan Cyber, Lasso Security|Target: ChatGPT users
Researchers identified that large language models such as ChatGPT can hallucinate fake software package names that are not published to a package repository. An attacker could publish a malicious package under the hallucinated name to a package repository. Then users of the same or similar large language models may encounter the same hallucination and ultimately download and execute the malicious package leading to a...
Actor: Unknown|Target: Cloud-Based LLM Services
The Sysdig Threat Research Team discovered that malicious actors utilized stolen credentials to gain access to cloud-hosted large language models (LLMs). The actors covertly gathered information about which models were enabled on the cloud service and created a reverse proxy for LLMs that would allow them to provide model access to cybercriminals.
Actor: Stav Cohen, Ron Bitton, Ben Nassi|Target: RAG-based e-mail assistant
Researchers developed Morris II, a zero-click worm designed to attack generative AI (GenAI) ecosystems and propagate between connected GenAI systems. The worm uses an adversarial self-replicating prompt which uses prompt injection to replicate the prompt as output and perform malicious activity. The researchers demonstrate how this worm can propagate through an email system with a RAG-based assistant. They use a...
Actor: Embrace the Red|Target: Google Gemini
Embrace the Red demonstrated that Google Gemini is susceptible to automated tool invocation by delaying the execution to the next conversation turn. This bypasses a security control that restricts Gemini from invoking tools that can access sensitive user information in the same conversation turn that untrusted data enters context.
Actor: Embrace the Red|Target: OpenAI ChatGPT
Embrace the Red demonstrated that ChatGPT's memory feature is vulnerable to manipulation via prompt injections. To execute the attack, the researcher hid a prompt injection in a shared Google Doc. When a user references the document, its contents is placed into ChatGPT's context via the Connected App feature, and the prompt is executed, poisoning the memory with false facts. The researcher demonstrated that these...
Actor: Embrace the Red|Target: Google Bard
Embrace the Red demonstrated that Bard users' conversations could be exfiltrated via an indirect prompt injection. To execute the attack, a threat actor shares a Google Doc containing the prompt with the target user who then interacts with the document via Bard to inadvertently execute the prompt. The prompt causes Bard to respond with the markdown for an image, whose URL has the user's conversation secretly...
Actor: Trend Micro Nebula Cloud Research Team|Target: Private Container Registries
Researchers at Trend Micro, Inc. used service indexing portals and web searching tools to identify over 8,000 misconfigured private container registries exposed on the internet. Approximately 70% of the registries also had overly permissive access controls that allowed write access. In their analysis, the researchers found over 1,000 unique AI models embedded in private container images within these open registries...
Actor: Unknown|Target: Exposed Ray Clusters
Ray is an open-source Python framework for scaling production AI workflows. Ray's Job API allows for arbitrary remote execution by design. However, it does not offer authentication, and the default configuration may expose the cluster to the internet. Researchers at Oligo discovered that Ray clusters have been actively exploited for at least seven months. Adversaries can use victim organization's compute power and...
Actor: threlfall_hax|Target: Hugging Face users
threlfall_hax, a security researcher, created organization accounts on Hugging Face, a public model repository, that impersonated real organizations. These false Hugging Face organization accounts looked legitimate so individuals from the impersonated organizations requested to join, believing the accounts to be an official site for employees to share models. This gave the researcher full access to any AI models...
Actor: Mithril Security Researchers|Target: HuggingFace Users
Researchers from Mithril Security demonstrated how to poison an open-source pre-trained large language model (LLM) to return a false fact. They then successfully uploaded the poisoned model back to HuggingFace, the largest publicly-accessible model hub, to illustrate the vulnerability of the LLM supply chain. Users could have downloaded the poisoned model, receiving and spreading poisoned data and misinformation...
Actor: Embrace The Red|Target: OpenAI ChatGPT
Embrace the Red demonstrated that ChatGPT users' conversations can be exfiltrated via an indirect prompt injection. To execute the attack, a threat actor uploads a malicious prompt to a public website, where a ChatGPT user may interact with it. The prompt causes ChatGPT to respond with the markdown for an image, whose URL has the user's conversation secretly embedded. ChatGPT renders the image for the user, creating...
Actor: Ludwig-Ferdinand Stumpp|Target: MathGPT (https://mathgpt.streamlit.app/)
The publicly available Streamlit application MathGPT uses GPT-3, a large language model (LLM), to answer user-generated math questions.
Actor: Kai Greshake, Saarland University|Target: Microsoft Bing Chat
Whenever interacting with Microsoft's new Bing Chat LLM Chatbot, a user can allow Bing Chat permission to view and access currently open websites throughout the chat session. Researchers demonstrated the ability for an attacker to plant an injection in a website the user is visiting, which silently turns Bing Chat into a Social Engineer who seeks out and exfiltrates personal information. The user doesn't have to ask...
Actor: Unknown|Target: PyTorch
Linux packages for PyTorch's pre-release version, called Pytorch-nightly, were compromised from December 25 to 30, 2022 by a malicious binary uploaded to the Python Package Index (PyPI) code repository. The malicious binary had the same name as a PyTorch dependency and the PyPI package manager (pip) installed this malicious package instead of the legitimate one.
Actor: Unknown|Target: Commercial ML Phishing Webpage Detector
Adversaries create phishing websites that appear visually similar to legitimate sites. These sites are designed to trick users into entering their credentials, which are then sent to the bad actor. To combat this behavior, security companies utilize AI/ML-based approaches to detect phishing sites and block them in their endpoint security products.
Actor: Tony Piazza|Target: Google Colab
Google Colab is a Jupyter Notebook service that executes on virtual machines. Jupyter Notebooks are often used for ML and data science research and experimentation, containing executable snippets of Python code and common Unix command-line functionality. In addition to data manipulation and visualization, this code execution functionality can allow users to download arbitrary files from the internet, manipulate files...
Actor: Kaspersky ML Research Team|Target: Kaspersky's Antimalware ML Model
Cloud storage and computations have become popular platforms for deploying ML malware detectors. In such cases, the features for models are built on users' systems and then sent to cybersecurity company servers. The Kaspersky ML research team explored this gray-box scenario and showed that feature knowledge is enough for an adversarial attack on ML models.
Actor: Yuanchun Li, Jiayi Hua, Haoyu Wang, Chunyang Chen, Yunxin Liu|Target: ML-based Android Apps
Deep learning models are increasingly used in mobile applications as critical components. Researchers from Microsoft Research demonstrated that many deep learning models deployed in mobile apps are vulnerable to backdoor attacks via "neural payload injection." They conducted an empirical study on real-world mobile deep learning apps collected from Google Play. They identified 54 apps that were vulnerable to attack...
Actor: One individual|Target: California Employment Development Department
An individual filed at least 180 false unemployment claims in the state of California from October 2020 to December 2021 by bypassing ID.me's automated identity verification system. Dozens of fraudulent claims were approved and the individual received at least $3.4 million in payments.
Actor: Berkeley Artificial Intelligence Research|Target: Google Translate, Bing Translator, Systran Translate
Machine translation services (such as Google Translate, Bing Translator, and Systran Translate) provide public-facing UIs and APIs. A research group at UC Berkeley utilized these public endpoints to create a replicated model with near-production state-of-the-art translation quality. Beyond demonstrating that IP can be functionally stolen from a black-box system, they used the replicated model to successfully transfer...
Actor: Researchers at spiderSilk|Target: Clearview AI facial recognition tool
Clearview AI makes a facial recognition tool that searches publicly available photos for matches. This tool has been used for investigative purposes by law enforcement agencies and other parties.
Actor: Azure Red Team|Target: New Microsoft AI Product
The Azure Red Team performed a red team exercise on a new Microsoft product designed for running AI workloads at the edge. This exercise was meant to use an automated system to continuously manipulate a target image to cause the ML model to produce misclassifications.
Actor: Palo Alto Networks AI Research Team|Target: Palo Alto Networks malware detection system
The Palo Alto Networks Security AI research team tested a deep learning model for malware command and control (C&C) traffic detection in HTTP traffic. Based on the publicly available paper by Le et al., we built a model that was trained on a similar dataset as our production model and had similar performance. Then we crafted adversarial samples, queried the model, and adjusted the adversarial sample accordingly until...
Actor: Palo Alto Networks AI Research Team|Target: Palo Alto Networks ML-based DGA detection module
The Palo Alto Networks Security AI research team was able to bypass a Convolutional Neural Network based botnet Domain Generation Algorithm (DGA) detector using a generic domain name mutation technique. It is a generic domain mutation technique which can evade most ML-based DGA detection modules. The generic mutation technique evades most ML-based DGA detection modules and can be used to test the effectiveness and...
Actor: Unknown|Target: VirusTotal
McAfee Advanced Threat Research noticed an increase in reports of a certain ransomware family that was out of the ordinary. Case investigation revealed that many samples of that particular ransomware family were submitted through a popular virus-sharing platform within a short amount of time. Further investigation revealed that based on string similarity the samples were all equivalent, and based on code similarity...
Actor: Two individuals|Target: Shanghai government tax office's facial recognition service
This type of camera hijack attack can evade the traditional live facial recognition authentication model and enable access to privileged systems and victim impersonation.
Actor: Microsoft AI Red Team|Target: Internal Microsoft Azure Service
The Microsoft AI Red Team performed a red team exercise on an internal Azure service with the intention of disrupting its service. This operation had a combination of traditional ATT&CK enterprise techniques such as finding valid account, and exfiltrating data -- all interleaved with adversarial ML specific steps such as offline and online evasion examples.
Actor: MITRE AI Red Team|Target: Commercial Face Identification Service
MITRE's AI Red Team demonstrated a physical-domain evasion attack on a commercial face identification service with the intention of inducing a targeted misclassification. This operation had a combination of traditional MITRE ATT&CK techniques such as finding valid accounts and executing code via an API - all interleaved with adversarial ML specific attacks.
Actor: Researchers at Silent Break Security|Target: ProofPoint Email Protection System
Proof Pudding (CVE-2019-20634) is a code repository that describes how ML researchers evaded ProofPoint's email protection system by first building a copy-cat email protection ML model, and using the insights to bypass the live system. More specifically, the insights allowed researchers to craft malicious emails that received preferable scores, going undetected by the system. Each word in an email is scored...
Actor: Skylight Cyber|Target: CylancePROTECT, Cylance Smart Antivirus
Researchers at Skylight were able to create a universal bypass string that evades detection by Cylance's AI Malware detector when appended to a malicious file.
Actor: Researchers at Brown University|Target: OpenAI GPT-2
OpenAI built GPT-2, a language model capable of generating high quality text samples. Over concerns that GPT-2 could be used for malicious purposes such as impersonating others, or generating misleading news articles, fake social media content, or spam, OpenAI adopted a tiered release schedule. They initially released a smaller, less powerful version of GPT-2 along with a technical description of the approach, but...
Actor: 4chan Users|Target: Microsoft's Tay AI Chatbot
Microsoft created Tay, a Twitter chatbot designed to engage and entertain users. While previous chatbots used pre-programmed scripts to respond to prompts, Tay's machine learning capabilities allowed it to be directly influenced by its conversations.