Daily digest · 2026-10-14

Daily Digest, 2026-10-14

TL;DR: Today's theme is AI agents finding and chaining real exploits at speed. XBOW chained three unknown Chrome bugs in six days using a public OpenAI model, earning Google's top $250,000 bounty for code running outside the browser sandbox, while an AI-driven search turned up a Linux kernel flaw that gives a guest VM write access to host memory. On the model side, researchers say new OpenAI and Google image models are easily pushed into making nudes, and a new attack tells you whether a specific person's image was in a vision model's training set. Research also lands on the privacy-control side: federated clustering that honors deletion requests and fine-tuning run entirely under encryption.

Top stories

• Vghost: an AI-found Linux vhost flaw gives local root and lets a guest write to host memory (The Hacker News, 2026-10-14). CVE-2026-74580 spans nearly a decade of kernel versions and breaks the guest/host boundary; agent sandboxes built on VMs put every co-tenant's data on that host in reach.
• XBOW chained three unknown Chrome bugs in six days with agents driving GPT-5.6 (The Hacker News, 2026-10-14). Commodity model access plus agent orchestration produced a full chain that runs code on Windows from a loaded page, which compresses how long defenders have between disclosure and working exploit. Google confirmed, fixed and paid $250,000.
• Researchers show new OpenAI and Google image models are easily pushed into making nudes (Ars Technica, 2026-10-14). The moderation layers shipped with recently released image models fall to a working jailbreak, and non-consensual imagery of real people is exactly the harm those safeguards exist to stop.
• COMPASS runs membership inference on vision LLMs with adaptive noise calibration (arXiv cs.CR, 2026-10-14). A gray-box attack that calibrates per-sample perturbations instead of relying on entropy statistics, telling an attacker whether a specific person's image was in training; it sets the bar any claim of model anonymity now has to clear.
• Deleting a record from federated socially fair k-means clustering without losing the fairness guarantee (arXiv, 2026-10-09). Erasure shifts group balance, so deletion and fairness pull against each other; the paper gives an unlearning approach that holds both, with patient stratification across hospitals as the worked setting.
• Cost-efficient privacy enforcement for email-drafting agents facing strategic information requests (arXiv cs.CR, 2026-10-14). Agents that read private context and send mail can be talked into disclosing more than they should; the work targets the cost of the checker-repair loop that bounds what goes into an outbound message.

Also notable

• Logit leakage through floating-point bias addition in LLM APIs, withholding logits is not the confidentiality boundary providers think it is.
• An AI pentesting agent found an OTP delivery bypass on an insurer's live site, with the hard part being safe validation against production.
• One-shot federated fine-tuning run entirely under homomorphic encryption, multi-party tuning with no reconstructable intermediates in the clear.
• AgentPrivArena audits agent privacy on real runs, measuring what personal data an agent touches mid-task rather than in the final answer.
• Federated OT intrusion detection leaks process detail, model updates reveal what the architecture was supposed to hide.
• Power draw as an audit channel for covert compute, what an external auditor can verify about a training run, and what an evader can hide.
• Deepfake readiness drill, a tabletop format for testing callback verification against cloned-voice payment fraud.
• Radware ships MCP Server Protection, inventory and policy over MCP servers sitting between agents and enterprise data.