Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Intelligence reports
Loading the current evidence view. Navigation and account controls remain available.
Ordering reports and their extracted indicators.
Applying the current filters and ordering.
Forensia intelligence desk · 4,093 source documents · 4,062 stories
Live reporting, advisories and research arranged by editorial readiness. Thin sources stay visible, but they are clearly marked instead of being presented as complete analysis.
On this page
40 documents
Briefs ready now
40
Multi-source clusters
0
Publisher text withheld
28
Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective
arXiv:2609.00464v1 Announce Type: new Abstract: Neuro-Symbolic (NeSy) AI has recently emerged as a novel paradigm to enable trustworthy AI, aiming at integrating sub-symbolic neural perception with grounded symbolic reasoning. The neuro-symbolic integration process that characterizes these models has been proven beneficial to achieve more transparent, explainable and efficient AI systems. Meanwhile, their properties under adversarial settings have been overlooked being freque…
Capability-Gated Language Models: Security Composes, Utility Does Not
arXiv:2609.00445v1 Announce Type: new Abstract: Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are reissued; inside one set of weights every request meets the same model configuration. This motivates us to define capability-gated deployment: per-principal access control inside one set of weights, whose configurations form a lattice -…
Don't Trust the Code, Check Its Effects: Runtime Refinement for Regenerated Systems Code Under an Adversarial Generator
arXiv:2609.00430v1 Announce Type: new Abstract: Recent work uses large language models to generate systems code from specifications, treating the specification as the durable artifact and the implementation as disposable. Regenerating the implementation specializes it to each workload and device. However, that work lives in a forgiving setting: a component's externally visible effects, its writes and device commands, are recoverable, and the generator is honest, so trust is d…
Federated Trust for Embodied Robot Capability Marketplaces
arXiv:2609.00404v1 Announce Type: new Abstract: Robot capability marketplaces, the "app store for robot skills," are emerging as the deployment vector for LLM-driven robot fleets. The default cloud-native answer to "is this package safe to install?" is centralised PKI: one certificate authority, one transparency log, one root of trust. We argue this is the wrong model for embodied robot fleets, where operators face heterogeneous regulatory regimes, air-gapped deployments, tin…
NeuroPriv: Adversarial Representation Learning for Privacy in Wearable EEG Systems
arXiv:2609.00390v1 Announce Type: new Abstract: Wearable EEG systems may expose sensitive information beyond their intended health function, creating substantial risks to neuroprivacy. In this work, we show that commonly used EEG features can reveal participant identity and demographic attributes in addition to supporting the intended cognitive task. Wearable EEG is increasingly being explored for cognitive monitoring, neurological assessment, and longitudinal digital-health…
OreProof: Verifiable Provenance with Limited Disclosure for Critical-Minerals Supply Chains Using Zero-Knowledge Proofs
arXiv:2609.00340v1 Announce Type: new Abstract: Critical-minerals supply chains face a structural tension: regulators and buyers demand verifiable provenance, yet upstream actors are hesitant to disclose supplier identities, assay grades/yields, and prices that verification appears to require. We report a design science account of OreProof, a prototypical traceability platform addressing this verifiability-disclosure trade-off. Instantiated for gold, OreProof combines a hybri…
Workload Identification with Physical Side Channels for AI Governance
arXiv:2609.00309v1 Announce Type: new Abstract: AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. Here, we show that an external observer can identify…
Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
arXiv:2609.00267v1 Announce Type: new Abstract: Autonomous LLM agents increasingly act on a user's behalf: they hold credentials, call tools and services, and spawn sub-agents that act further on their behalf. This turns a long-standing distributed-systems question -- who is authorized to do what, on whose authority -- into an urgent and largely unsolved problem, because the component driving each agent is a language model an adversary can hijack. We argue that agent security…
DUPIN: Attack Learning Is Still Needed! Demonstrating Few-Shot after Unsupervised Pretraining Is A Nimble Forensics Learner
arXiv:2609.00259v1 Announce Type: new Abstract: We propose a novel approach to learning-based attack forensics called DUPIN. DUPIN performs unsupervised pre-training on an enormous amount of audit events in the form of provenance graphs. It then proceeds to a few-shot learning stage, leveraging a small number of labeled attack examples to fine-tune its detection capabilities. We pretrain DUPIN on up to 38 - 52 days of audit logs (7.3TB total) and evaluate it against various b…
Explainable Artificial Intelligence for Industrial Cybersecurity: A Review of Methods, Operational Integration, and Research Challenges
arXiv:2609.00171v1 Announce Type: new Abstract: The increasing digitalization of industrial infrastructure and the convergence of information technology (IT) and operational technology (OT) have expanded the cyberattack surface of industrial systems. To address the growing complexity of cyber threats, artificial intelligence (AI) and machine learning (ML) techniques are increasingly deployed within industrial cybersecurity operations, particularly in Security Operations Cente…
A Formal Analysis of Agent Payment Protocols
arXiv:2609.00060v1 Announce Type: new Abstract: Agent payment protocols are emerging as a key transaction layer for autonomous commerce, enabling AI agents to purchase goods and services and execute payments on users' behalf. Unlike conventional payment flows, they distribute user intent, delegated authority, credential use, settlement, and fulfillment across multiple actors and stages, creating security dependencies that no single message or participant can enforce. Yet thes…
AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes
arXiv:2609.00052v1 Announce Type: new Abstract: Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to save deployment costs. All existing audits decide backbone identity from the text-output channel, which is structurally fragile for agentic APIs because modern serving stacks (OpenAI, Anthropic, Gemini, Cloudflare Workers AI, LangGraph) discard text and expose only structured actio…
Kiichain - Rekt
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
SonicWall 83548 83549
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
FBI Probes Service Selling 153M+ Drivers Licenses
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
BenchMIRT: What are LLM benchmarks actually measuring?
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Palo Alto Networks Acquires AI Agent Platform Console
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Cybersecurity IR Workshop: The workshop you shouldn’t miss
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Sevii Targets AI-Speed Attacks With Preemptive Autonomous Defense
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Coast Guard Establishes Office of Maritime Cybersecurity Policy
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
A note from LWN
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Healthcare facilities operator Nutex says patient, employee data stolen in August incident
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
[$] A pause for the Python JIT
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Firefox 155 released
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Security updates for Tuesday
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Iranian cyber spies target aviation, fintech developers with new malware
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Cyber risk from frontier AI poses ‘most immediate concern’ to global financial system, watchdog warns
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Hackers Start Exploiting Critical Langflow Vulnerability
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Five Venezuelans Plead Guilty in US Court to ATM Jackpotting
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Ransomware Gang Claims Nutex Health Data Breach
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
story desk
clustered evidenceWatchGuard Patches Critical Vulnerabilities
developing · new
Microsoft Rolls Out 22 Fresh Security Patches
source only · new
Google Patches 6th Chrome Zero-Day of 2026
developing · new
Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities
developing · new
Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities
source only · new
filter by source
sharing classification
TLP describes sharing sensitivity, not copyright permission. Reader text is limited to source-provided descriptive material; original reporting stays with its publisher.