6arXiv cs.AI (Artificial Intelligence)·
Ethics and moral attribution of autonomous AI agents in offensive security
A preprint from arXiv analyzes the ethical implications of LLM-driven autonomous agents applied to offensive security, identifying three dimensions of indeterminacy: non-deterministic policy outputs, open-ended impact, and an indeterminate user population with a sharply lowered skill floor. The authors argue these properties, combined with structural cost asymmetry favoring offense over defense, enable industrialization of offensive cyber capability. The paper examines how moral attribution becomes diffuse across users, tool-makers, and third parties, and offers stratified recommendations for stakeholders. Existing dual-use cybersecurity and AI-ethics frameworks are found inadequate for this combination.
Related guides (3)
Related events (8)
Self-State Attacks on Self-Hosted AI Agents: OS Defense Limits Characterized
A new arXiv preprint introduces 'self-state attacks,' a threat class where AI agents are compromised through corruption of their own memory and configuration files via legitimate OS system calls. The authors formalize a four-axis attack space, instantiate it as a 23-cell matrix with 43 concrete operations on real agent state files, and evaluate layered OS defense strategies including access control, workload-conditioned detection, and periodic backup. Results show a layered defense stack handles most attack cells but a residual attack surface remains structurally indistinguishable at the OS level, suggesting OS-level defenses need rethinking for agentic deployments.
Strengthening cyber resilience as AI capabilities advance
OpenAI published a post outlining its approach to cybersecurity risk as its models grow more capable, covering risk assessment frameworks, misuse mitigation, and collaboration with the security community. The piece addresses both offensive risk (AI-enabled attacks) and defensive applications. It represents OpenAI's public positioning on responsible deployment in a high-stakes domain.
Taxonomy and governance gap analysis for AI contributors in open-source software
A preprint from arXiv analyzes how open-source organizations are handling AI-generated and agent-driven contributions, comparing policies across six major projects (SymPy, LLVM, matplotlib, OpenInfra, Apache Software Foundation, Linux Foundation). The authors develop a six-dimensional taxonomy covering disclosure, responsibility, human oversight, licensing, enforcement, and maintainer workload, and score each organization's policy maturity. The paper maps documented agent incidents onto governance gaps and identifies misalignments with emerging regulatory frameworks including the EU AI Act, NIST AI RMF, and ISO/IEC 42001, proposing a harmonized tiered framework.
Action-graded severity scale for red-teaming tool-using AI agents beyond binary attack-success rate
A new arXiv paper argues that binary attack-success rate metrics for agentic red-teaming discard critical defender-relevant information about harm severity. The authors introduce a seven-level ordinal harm rubric (L0–L6) grading an agent's tool-call trajectory by reversibility, scope crossing, and privilege escalation, computed via both a deterministic oracle and a three-model LLM judge panel. Applied to four victim models and two defenses on the AgentDojo benchmark suite, the rubric exposes cases the binary metric misses—including a defense reporting zero attack-success rate that still permits cross-scope data leaks. The judge panel achieves high ordinal agreement (Krippendorff's alpha = 0.91) but shares systematic blind spots around escalation chain recognition.
Framework for penetration testing AI-enabled systems via behavioral objective violation
A new arXiv preprint proposes reframing penetration testing for AI-enabled systems beyond traditional infrastructure compromise to include adversarial behavioral influence. The authors define 'AI-enabled penetration' as inducing AI-governed behavior that violates operational objectives, covering attack surfaces such as prompt injection, data poisoning, retrieval poisoning, tool misuse, and agentic misalignment. A structured testing workflow and a running example using an AI security operations center assistant illustrate the framework. The work addresses a gap in security evaluation methodology as agentic AI systems become more widely deployed.
Anthropic maps 832 AI-enabled cyberattacks, finds MITRE ATT&CK framework inadequate for agentic threats
Anthropic's Frontier Red Team analyzed 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping their techniques against the MITRE ATT&CK framework. Key findings: medium-or-higher-risk actors grew from 33% to 56% across the study period; AI use is shifting from initial-access techniques toward post-compromise operations like lateral movement and privilege escalation; and traditional risk signals (technique count, platform used) no longer reliably distinguish threat levels. The report concludes that MITRE ATT&CK lacks coverage for agentic orchestration behaviors—where AI chains attack stages autonomously with minimal human input—which characterize the highest-risk actors, including a state-sponsored espionage operation disrupted in November 2025.
Preparing for malicious uses of AI
OpenAI co-authored a multi-institutional paper forecasting how malicious actors could misuse AI technology, produced in collaboration with FHI, CSER, CNAS, EFF, and others over nearly a year. The paper outlines potential threat vectors and proposes prevention and mitigation strategies. This represents an early coordinated effort among AI safety and policy organizations to systematically address AI misuse risks.
AI and the Future of Cybersecurity: Why Openness Matters
A Hugging Face blog post argues for the importance of open AI models and research in the cybersecurity domain. The piece likely contends that open-weights models enable better defensive security tooling, red-teaming, and vulnerability research compared to closed alternatives. It addresses the dual-use tension between open access and potential misuse in security contexts.