RESEARCH
July 2025: Rowhammer on GPUs, hijacked email agents, malware inside AI models
Supply chainOT and industrial security
July 2025 brings Rowhammer to the GPUs used for AI, with model accuracy dropping by up to 80%. Downloaded models can hide self-extracting malware, email-handling agents fall to a new kind of prompt injection, and an AI agent writes profitable smart contract exploits. On mobile, WebViews and SDKs bypass protections and over half of sensitive apps ignore secure hardware.
Archive: reconstruction written in November 2026
1. GPUHammer: Rowhammer Attacks on GPU Memories are Practical
USENIX Security Symposium · Chris S. Lin, Joy Qu, Gururaj Saileshwar · Hardware & Side Channels
In short: First successful Rowhammer attack on a discrete GPU: a few flipped bits wreck model accuracy.
Rowhammer had been studied on CPUs and DDR memory, not on the GDDR memory of GPUs used for machine learning. GPUHammer reverse-engineers proprietary GDDR6 row mappings, intensifies accesses and bypasses mitigations. On an NVIDIA A6000 it induces up to 8 bit-flips across 4 banks, enough to cut model accuracy by up to 80%.
Why it matters. GPUs are shared between cloud customers: a malicious tenant can sabotage others' models without touching their software.
2. Do You Trust Your Model? Emerging Malware Threats in the Deep Learning Ecosystem
IEEE Transactions on Dependable and Secure Computing · Dorjan Hitaj, Giulio Pagnotta, Fabio De Gaspari, Sediola Ruko et al. · Malware & Threat Intelligence
In short: MaleficNet 2.0 hides self-extracting malware in a neural network's parameters without hurting performance.
Many organisations use pre-trained models from public repositories with no precautions, treating them as plain data. MaleficNet 2.0 embeds a malicious payload in the parameters using spread-spectrum coding and error correction: it is stealthy, does not degrade the model and resists removal, also in federated learning. A prototype self-extracts and runs in a widely used framework.
Why it matters. A downloaded model is third-party software: it needs the same provenance and verification rules as an executable.
3. Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents
arXiv · Jiangrong Wu, Yuhong Nan, Jianliang Wu, Zitong Yao et al. · AI & LLM Security
In short: A new kind of prompt injection hijacks all 63 real email agents tested, in under two attempts.
LLM agents that handle email deal with sensitive messages and authentication flows. Classic injections work poorly against them, with success between 4.58% and 8.13%. ESPI instead frames attacker-desired actions as necessary fixes to a forged mailbox state: it reaches 73.54% success and hijacks all 63 applications evaluated, in under two attempts.
Why it matters. The mailbox is the key to password resets and payment approvals: an agent running it should be treated as a highly privileged user.
4. Depth Gives a False Sense of Privacy: LLM Internal States Inversion
USENIX Security Symposium · Tian Dong, Yan Meng, Shaofeng Li, Chen, Guoxing et al.
In short: An LLM's internal states, thought irreversible, can rebuild the prompt, even a long medical one.
Collaborative inference and neuron-based safety audits expose an LLM's internal states, so far considered non-invertible. The authors propose four inversion attacks, with and without weight access, plus one that uses a model to translate states back into text. Across six LLMs and medical and coding datasets, a 4,112-token medical prompt is rebuilt almost perfectly.
Why it matters. Sending only intermediate representations does not protect data: architectures promising privacy this way need careful assessment.
5. AI Agent Smart Contract Exploit Generation
arXiv · Arthur Gervais, Liyi Zhou · Blockchain & DeFi
In short: An AI agent generates verified exploits for vulnerable smart contracts, up to $8.59 million per attack.
A1 turns an LLM into an exploit generator with six domain tools and validates every result by running it on real blockchain state. On 36 vulnerable Ethereum and Binance Smart Chain contracts it succeeds on 63% of the VERITE benchmark and extracts up to $8.59 million per exploit. Attackers profit at 6,000 exploit values; defenders need 60,000.
Why it matters. The cost of finding and exploiting a flaw collapses while defence costs do not: the window between discovery and theft shrinks to hours.
6. Tracking Without Borders: Studying the Role of WebViews in Bridging Mobile and Web Tracking
Proceedings on Privacy Enhancing Technologies · Nipuna Weerasekara, José Miguel Moreno, Srdjan Matic, Joel Reardon et al. · Web & Mobile Security
In short: Android apps configure WebViews to bypass protections and track users across apps and the web.
WebViews render web content such as ads inside apps. The first large-scale study shows developers and third-party SDKs configuring them to bypass platform protections. Harmful JavaScript, often delivered through unvetted real-time bidding, syncs cookies, runs fingerprinting and silently sends identifiers and location without users knowing.
Why it matters. Ads shown in an app can collect personal data on the publisher's behalf: a regulatory risk driven by the ad supply chain.
7. KeyDroid: A Large-Scale Analysis of Secure Key Storage in Android Apps
Proceedings on Privacy Enhancing Technologies · Jenny Blessing, Ross Anderson, Alastair R. Beresford · Web & Mobile Security
In short: 56% of apps declaring sensitive data do not use Android's secure hardware to protect keys.
Modern phones offer dedicated hardware to keep keys and credentials safe even if the OS is compromised. Analysing 490,119 Android apps and their data-safety declarations, the study finds that 56% of apps handling sensitive data do not use this hardware at all, and only 5% use the strongest form, a secure element separate from the main processor.
Why it matters. Key protection is a basic good practice: its low uptake increases the impact of phone malware, including on financial and health apps.
8. Okay Google, Where’s My Tracker? Security, Privacy, and Performance Evaluation of Google's Find My Device Network
Proceedings on Privacy Enhancing Technologies · Leon Böttger, Alexander Matern, Dennis Arndt, Matthias Hollick · Web & Mobile Security
In short: Google's Find My Device network, on by default on Android, shows security and privacy flaws.
Since April 2024 Google's Find My Device network has used billions of Android devices to locate lost trackers and headphones, and it is on by default. Google promises end-to-end encryption and privacy, but the system is only partly specified. The authors reverse-engineer the proprietary parts and find issues including denial-of-service attacks and a potential linkage attack on Android.
Why it matters. Location networks active on billions of phones are shared infrastructure: a design flaw affects every user at once.
9. OTP-Hunter: An App-Based Fuzzing Framework to Discover One Time Password Vulnerabilities
IEEE Transactions on Dependable and Secure Computing · Futai Zou, Zehui Zhang, Yuzong Hu · Identity & Authentication
In short: OTP-Hunter finds 68 one-time-password flaws in 59 IoT apps, enabling remote device takeover.
One-time passwords verify identity at sign-up, login and password recovery, but poor implementations allow SMS or email bombing, brute force and bypass. OTP-Hunter combines static and dynamic analysis inside the apps, without needing to decrypt their protocols. Across 59 IoT apps it finds 68 vulnerabilities that let attackers control devices knowing only the victim's phone number.
Why it matters. A weak OTP cancels the second factor: for connected-device makers it is a liability risk toward thousands of customers.
Trends of the month
AI & LLM Security
235 papers this month on this topic
With 235 of 1,244 papers, AI security remains the top topic, and July covers every layer. GPU hardware can be tampered with via Rowhammer, downloaded models can carry hidden malware, models' internal states reveal prompts, and email agents carry out attacker actions. The AI chain must be assessed whole, from chip to agent.
Papers cited:
- Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents
- Do You Trust Your Model? Emerging Malware Threats in the Deep Learning Ecosystem
- Depth Gives a False Sense of Privacy: LLM Internal States Inversion
- GPUHammer: Rowhammer Attacks on GPU Memories are Practical
Web & Mobile Security
36 papers this month on this topic
PETS proceedings and other papers measure mobile at scale. WebViews bypass Android protections for tracking, over half of apps with sensitive data skip secure hardware, Google's location network has design flaws, and IoT apps' one-time passwords can be bypassed. Defences exist but are often not adopted.
Papers cited:
- Tracking Without Borders: Studying the Role of WebViews in Bridging Mobile and Web Tracking
- KeyDroid: A Large-Scale Analysis of Secure Key Storage in Android Apps
- Okay Google, Where’s My Tracker? Security, Privacy, and Performance Evaluation of Google's Find My Device Network
- OTP-Hunter: An App-Based Fuzzing Framework to Discover One Time Password Vulnerabilities
Blockchain & DeFi
31 papers this month on this topic
In smart contracts, AI changes the economics of attack. An agent that generates and validates exploits on its own finds real flaws and makes them profitable with only a few thousand dollars at stake, while defence needs ten times the resources. Speed of patching becomes decisive.
Papers cited:
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1244.