RESEARCH
June 2025: agents fooled by what they see, ships under attack, cars that reveal the route
RansomwareOT and industrial securitySupply chain
June 2025 shifts the focus to the physical world. Ship officers report spoofed GPS and ransomware on board, CAN bus data rebuild a car's route without GPS, and a video of a 3D printer is enough to steal its design. Computer-use agents fall for instructions hidden in screens, and fuzzing finds ten CVEs in 5G modems.
Archive: reconstruction written in November 2026
1. VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
arXiv · Tri Cao, Bennett Lim, Yue Liu, Yuan Sui et al. · AI & LLM Security
In short: Malicious instructions placed in screens fool browser and computer-use agents in up to 100% of cases.
Computer-use agents have full access to files, data and commands. VPI-Bench measures their resistance to visual prompt injection, malicious instructions embedded visually in the interface, with 306 cases on five popular platforms. Computer-use agents fall for it up to 51% of the time and browser agents up to 100%; system-prompt defences help little.
Why it matters. An agent with full computer access can be hijacked by any web page: its permissions need setting like a new employee's.
Read the paper · PDF · Code
2. Differentiation-Based Extraction of Proprietary Data from Fine-Tuned LLMs
ACM Conference on Computer and Communications Security · Zongjie Li, Daoyuan Wu, Shuai Wang, Zhendong Su
In short: A specialised LLM's training data can be extracted by exploiting its differences from the base model.
Fine-tuning datasets hold valuable instruction-response pairs and are a target. The first study on the topic defines the problem and proposes Differentiated Data Extraction, which exploits the fine-tuned model's confidence and its behavioural differences from the base model. It beats existing methods in every setting; the authors propose a defence with minimal performance impact.
Why it matters. Exposing a model trained on proprietary data can leak that very data: an IP and confidentiality risk to weigh before release.
3. A Sea of Cyber Threats: Maritime Cybersecurity from the Perspective of Mariners
ACM Conference on Computer and Communications Security · Anna Raymaker, Akshaya Kumar, Miuyin Yong Wong, Ryan Pickren et al. · Malware & Threat Intelligence
In short: 21 ship officers describe spoofed GPS and ransomware on board, with poor training and fragmented rules.
Ships and ports carry over 80% of world goods, and attacks such as the one on Maersk have hit international trade. Through surveys and interviews with 21 officers, the study gathers first-hand accounts of offshore GPS spoofing and ransomware that disrupted logistics. Systemic issues emerge: training ill-suited to the maritime context and fragmented regulation.
Why it matters. Maritime cyber risk combines cargo damage, business interruption and liability: marine covers must factor in the human element on board.
4. Your Car Tells Me Where You Drove: A Novel Path Inference Attack via CAN Bus and OBD-II Data
IEEE European Symposium on Security and Privacy · Tommaso Bianchi, Alessandro Brighente, Mauro Conti, Andrea Valori · CPS & IoT Security
In short: Unencrypted CAN bus data rebuild a car's route with 95.75% accuracy, without GPS.
A car's CAN bus exchanges physical motion data in clear text. OPD-II combines a physical car model with a map-matching algorithm to rebuild the route driven, knowing only the starting position and heading, with no training data or access to the phone. Across four cars and 59 tracks it reconstructs coordinates with 95.75% average accuracy.
Why it matters. An OBD-II dongle, like those used for telematics, can become a tracker: driving data must be treated as personal location data.
5. One Video to Steal Them All: 3D-Printing IP Theft through Optical Side-Channels
ACM Conference on Computer and Communications Security · Twisha Chattopadhyay, Fabrício Ceschin, Marco E. Garza, Dymytriy Zyunkin et al.
In short: A video of 3D printing is enough to rebuild the G-code and steal the design, with 90.87% accuracy.
3D printers used in manufacturing, healthcare and defence are often monitored remotely by cameras. The authors' model tracks nozzle movements in the video and translates them into G-code, also recovering feed and extrusion rates. A new equivalence checker confirms the rebuilt object matches the original; average accuracy is 90.87%.
Why it matters. Monitoring cameras become an IP theft channel: relevant for anyone producing confidential designs to order.
6. 5Ghoul: Unleashing Chaos on 5G Edge Devices via Stateful Multi-Layer Fuzzing
IEEE Transactions on Dependable and Secure Computing · Matheus E. Garbelini, Zewen Shang, Shijie Luo, Sudipta Chattopadhyay et al. · Systems & Software Security
In short: Over-the-air fuzzing of 5G phones and modems finds 12 unknown flaws, with ten CVEs at Qualcomm and MediaTek.
5Ghoul controls and manipulates every packet in real time down to the data link layer, automatically builds protocol state machines and exploits flaws over the air on commercial devices. Across seven 5G phones and USB modems and one open-source framework it finds 12 unknown vulnerabilities; ten affect devices from major vendors such as Qualcomm and MediaTek.
Why it matters. The same 5G chips sit in millions of phones and routers of different brands: a chip flaw means accumulated exposure beyond any single maker.
7. Fingerprinting SDKs for Mobile Apps and Where to Find Them: Understanding the Market for Device Fingerprinting
ACM Conference on Computer and Communications Security · Michael A. Specter, Mihai Christodorescu, Abbie Farr, Bo Ma et al. · Web & Mobile Security
In short: Only 30.56% of fingerprinting in Android apps comes from ad SDKs; nearly a quarter comes from SDKs of unknown purpose.
The largest analysis of SDK behaviour to date covers over 228,000 SDKs and 178,000 Android apps and detects exfiltration of more than 500 distinct signals. Ad SDKs, the focus of efforts such as App Tracking Transparency and Privacy Sandbox, account for only 30.56% of fingerprinting behaviour; 23.92% comes from SDKs of unknown or unclear purpose.
Why it matters. Regulating advertising alone leaves much tracking untouched: app publishers stay exposed through libraries they do not control.
8. LeapFrog: The Rowhammer Instruction Skip Attack
IEEE European Symposium on Security and Privacy · Andrew Adiletta, M. Caner Tol, Kemal Derya, Berk Sunar et al. · Hardware & Side Channels
In short: Rowhammer alters the return address on the stack to skip authentication checks or encryption steps.
LeapFrog is a new kind of Rowhammer gadget: when code stores the return address on the stack, an induced fault moves it past a critical block such as an authentication check or encryption rounds. The authors propose a method to find these gadgets automatically, bypass encryption in OpenSSL to reveal plaintext, and scan the Open Quantum Safe library.
Why it matters. A memory defect can cancel out a correctly written security check: on shared servers this is a risk software alone cannot remove.
9. Identity Deepfake Threats to Biometric Authentication Systems: Public and Expert Perspectives
arXiv · Shijing He, Yaxiong Lei, Zihan Zhang, Yuzhou Sun et al. · Identity & Authentication
In short: 408 professionals and 37 interviews: experts fear deepfakes against face and voice, while the public trusts biometrics.
The study combines a survey of 408 professionals with 37 interviews of experts and non-experts. A paradox emerges: the public relies more and more on biometrics for convenience, while experts fear generative-AI spoofing of face and voice; finance is the most sceptical sector. The authors propose a Deepfake Kill Chain and defences based on dynamic signals such as eye movement.
Why it matters. Banks and insurers use face and voice authentication with customers: deepfake identity fraud risk needs assessing in those processes.
10. MalGuard: Towards Real-Time, Accurate, and Actionable Detection of Malicious Packages in PyPI Ecosystem
USENIX Security Symposium · Gao, Xingan, Xiaobing Sun, Sicong Cao, Kaifeng Huang et al. · Software Supply Chain
In short: MalGuard detects malicious PyPI packages with lightweight models and explains why a package is suspicious.
Detection of malicious PyPI packages has moved to ever more complex and slower models. The authors show that a comprehensive enough feature set lets even traditional models perform very well. MalGuard automatically finds sensitive APIs via graph centrality analysis, refines them with an LLM and uses LIME to explain each detection. It outperforms six baselines.
Why it matters. Fast, explainable detection of malicious packages is a realistic control for anyone running open-source dependencies in production.
Trends of the month
CPS & IoT Security
42 papers this month on this topic
The month looks at physical systems from unusual angles. Ship officers confirm that spoofed GPS and ransomware on board are already real, a car's CAN bus reveals where it was driven, and cameras watching a 3D printer are enough to copy the design. In all three cases sensitive data leaves through a component built for something else.
Papers cited:
- A Sea of Cyber Threats: Maritime Cybersecurity from the Perspective of Mariners
- Your Car Tells Me Where You Drove: A Novel Path Inference Attack via CAN Bus and OBD-II Data
- One Video to Steal Them All: 3D-Printing IP Theft through Optical Side-Channels
AI & LLM Security
292 papers this month on this topic
With 292 of 1,447 papers, AI security remains the top topic. Agents controlling browsers and computers follow instructions written into the interface, and models fine-tuned on proprietary data let that data be extracted by comparison with the base model. The closer AI gets to real data and permissions, the more operational the risk becomes.
Papers cited:
- VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
- Differentiation-Based Extraction of Proprietary Data from Fine-Tuned LLMs
Privacy
74 papers this month on this topic
Tracking does not run through advertising alone. In Android SDKs most fingerprinting comes from non-advertising libraries, often of unclear purpose, and driving data read by an OBD-II dongle are enough to rebuild routes. Rules designed for a single sector leave most collection uncovered.
Papers cited:
- Fingerprinting SDKs for Mobile Apps and Where to Find Them: Understanding the Market for Device Fingerprinting
- Your Car Tells Me Where You Drove: A Novel Path Inference Attack via CAN Bus and OBD-II Data
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1447.