Archive
模型安全、資安、隱私、供應鏈、紅隊與防護。
GitHub Repo
Nous Research released Hermes Agent v0.21.6 on October 8, fixing security issues involving dashboard login and configuration in untrusted repositories. The stable release includes Docker images and a Git tag; the desktop app and Termux package remain on their current versions.
GitHub Repo
LangGraph maintainers published a security advisory on October 7, reporting that the JS SDK modifies caller-provided header objects, which may cause clients to share credentials. The advisory lists patched versions, but the issue requires a specific shared-object configuration to trigger and is rated low risk.
GitHub Repo
A community reproduction dated October 7 reports that Transformers 5.19.0 may fail to import model classes with PyTorch 2.5.1 and in PyTorch 2.6.0 environments without an accelerator. The report includes a minimal reproduction and a guard-code workaround, but no maintainer confirmation or merged fix is listed.
最新模型
Mistral launched a public preview of Large 4 on October 6, featuring a native multimodal MoE architecture. Model weights are expected by the end of the month. An independent cybersecurity evaluation found strong vulnerability-handling performance, but passing the test does not mean the original vulnerability was fully fixed.
GitHub Repo
Non-admins with tool export permission could download the Python source code of tools shared with them as read-only. The issue was fixed in 0.11.4; operators should review group permissions and check whether credentials are embedded in code.
AI 安全
Validation covers central settings and team overrides, reporting the affected file and JSON path. Settings still need to sync to supported clients, and passing validation does not confirm they are effective.
AI 安全
A study tested log deletion, skill injection, and reward shaping in full-access mode, exposing risks when agent permissions overlap with audit data. The team published its experimental framework, but the results are limited by permission settings and the design of the human-defined rewards.
代理工具
When handling security alerts, the agent can consult existing memories and save newly generated fix patterns for other Copilot features to use. The feature remains in public preview, and GitHub has not published data on improvements to success rates or costs.
GitHub Repo
The release updates dependencies to address TLS certificate validation and process pool blocking risks. Unresolved vulnerabilities remain in the default images, with actual impact depending on execution paths.
AI 安全
The vulnerability involves the RPyC service on disaggregated prefill/decode nodes and requires an attacker to reach the control port. A public reproduction shows that health checks can still pass after exploitation; the advisory has yet to list a patched version.
AI 研究
AISI and EvalEval use a shared format to organize results and settings from existing research, covering five main experimental benchmarks and related cybersecurity evaluations. The data helps trace budgets and feedback conditions, but format validation does not amount to independent replication.
AI 安全
The new benchmark uses mutable environments and multi-turn conversations to test whether agents violate safety rules in their actions and responses. The paper reports more violations in interactive mode, but discrepancies in the public results mean reproducing them requires checking versions.