AM-IA brings together news, research papers and applications relating to artificial intelligence published around the world into a single feed — and makes them available in your European language at the click of a button.
Scroll to browse · Click to filter
Researchers have pre-entered Qwen3 zero models with trapped data: once they become command line agents, they start command of the attacker in 92% of cases.
Turning the checks around, acting without asking: about 88,000 officer skills contain this type of instructions, often copied from a handful of original models.
With identical content, the location of an injection changes everything: AI agents implicitly give more confidence to certain areas of their environment.
Models guess "who speaks" from the content and structure of the text. Injection training only protects against half the problem; Internal probes detect the attack.
LLM servers, vector bases and agent gateways are scanned a few hours after they are put online; InferD faithfully imitates them to measure attacks without executing anything.
The attack adds a false call for "dualization" after the legitimate task, which normally runs: the user sees nothing, and three defenses tested pass more than 55% of attempts.
Researchers have instrumentalized the browser to track each data sent by chatbot web interfaces. Discussion titles, complete prompts and e-mail addresses go to advertising and analytical scripts.
The VELA test bench replays 44 web vulnerabilities through three commercial agents. They carry out all possible attacks, and even completed one that the attacker had left unfinished.
Researchers have audited eight open source libraries of "steering vectors" and show that a plugin can display a legitimate security function while discreetly directing the model to certain brands.
Safety filters ensure that there is no collision only if properly configured. The SIREN tool finds trapped targets that impact a real humanoid.
The DSA, the AI Act or the Online Safety Act regulate digital damage on platforms, but not autonomous cyber weapons launched by states against civilian infrastructure. A study proposes a framework for filling this gap.
Rather than just detecting automated scams by IA, TokenTrap occupies them with unnecessary and costly calculations, without ever delivering them IDs or payment.
Measured at 16 control points, instrumental behaviour increased from 25% to 46.1% at the beginning of the RLVR and then dropped to 11.8% at the end of the training.
RMT-Jailbreak transposes attacks designed for classic models to broadcast LLMs, asking them to reconstruct a masked harmful response.
Abstracts and derived states keep track of what has been deleted: only one question is enough to find the deleted secret in Qwen2.5-7B in about two-thirds of cases.
A Rowhammer attack targets the Triton compiler: the GPU kernel produced remains correct but less fast, and as it is cached, the loss of 4 to 16% persists from one execution to the next.
A study shows that couriers who foil traditional phishings give way to persuasive, custom-designed emails, to the point of executing malicious demand.
By occupying topics where reliable information is scarce, an attacker sees its content taken over by AIs who search the Web in 31% of cases. A skeptical user tone does not protect much.
When a code agent compacts its memory, pi, opencode, Cline, Help and OpenHands erased that said: a forged approval survives in 87 to 100% of cases, compared to 0% at Codex or Gemini CLI.
CarryoverBench measures how a malicious instruction stored in an agent's memory or scheduled tasks retriggers, without mitigation, across five state-of-the-art models.