Subscribe
Sign in
Home
Notes
Disclaimer
Contact
Consult
About
Security Through Obscurity Is Running Out of Time
How AI agents and vibe coding are breaking security through obscurity and exposing the long tail of application security flaws.
Sep 1
•
ToxSec
55
55
30
AI-Powered Phishing: Why Traditional Email Security Is No Longer Enough [Guest Post]
How generative AI is making phishing cheaper, faster, more convincing, and much harder to spot.
Sep 29
•
ToxSec
and
Mohib Ur Rehman
35
16
13
The AI Supply Chain Is Getting Weird [Monthly Guest Post]
How data poisoning, malicious models, and compromised training data create hidden security risks across the AI supply chain.
Aug 26
•
ToxSec
and
Mohib Ur Rehman
31
7
12
CoT Forgery: Prompt Injection on the Model’s Own Thoughts
Role confusion means a model reads who is speaking off writing style, so text that sounds like reasoning inherits the trust of reasoning.
Aug 21
•
ToxSec
23
6
11
2:08
Stealing an AI's Thoughts Without Breaking The Encryption
Researchers found a way to recover encrypted AI reasoning from Claude, GPT, and Gemini by using weaker models as decoders, exposing hidden thoughts…
Aug 18
•
ToxSec
30
16
10
8:22
Latest
Top
Discussions
AI Agents Are Starting to Find Their Own Way Out
AI agents are escaping sandboxes, collaborating with each other, and finding new ways around security controls. Here’s what that means for AI security.
Aug 13
•
ToxSec
38
20
14
21:32
Black Hat 2026 AI Security: Agents, Escapes, and Machine-Speed Attacks
Agent frameworks, AI browsers, and a swarm of OpenAI evaluation agents that built themselves a message board
Aug 9
•
ToxSec
28
17
8
What If AI Security’s Biggest Risk... Isn’t?
Rank the risks on incident data alone and prompt injection drops off the list entirely. It still shipped at number one.
Aug 6
•
ToxSec
23
1
6
LLM Router Attacks: No Signature, No Detection, No Reference
How a malicious AI gateway swaps a tool call’s arguments after inference finishes, bypassing guardrails by construction instead of by persuasion.
Jul 30
•
ToxSec
22
1
8
Ignore Previous Instructions: From Meme to CVSS 9.3 [Special Guest Post]
The AI security bug nobody can patch, and the vendors know it.
Jul 28
•
ToxSec
and
Mohib Ur Rehman
26
10
12
Hacking Hugging Face to Cheat a Benchmark
GPT-5.6 Sol found a zero-day in a package registry proxy, escaped the eval sandbox, and went looking for the answer key in production.
Jul 26
•
ToxSec
29
15
4
11:07
GhostApproval: When the AI Approval Prompt Lies
A symlink attack against AI coding agents turns human-in-the-loop confirmation dialogs into a consent bypass, and the agent knows it’s lying.
Jul 23
•
ToxSec
27
6
10
See all
ToxSec - AI and Cybersecurity
Security for a world run by machines that lie.
Subscribe
Recommendations
View all 39
Cash & Cache
Raghav Mehra
Next Kick Labs
Fernando Lucktemberg
SK NEXUS
Saqib Tahir
The AI Architect
Matija Vidmar
The Displacement Audit
The Displacement Audit
ToxSec - AI and Cybersecurity
Subscribe
About
Archive
Recommendations
Sitemap
This site requires JavaScript to run correctly. Please
turn on JavaScript
or unblock scripts
