RESEARCH
April 2026: pre-login 5G flaws, audio that hijacks agents, post-quantum under attack
OT and industrial securitySupply chainNIS2 and DORAProduct liability
April 2026 brings the IEEE S&P proceedings. Valid but inconsistent 5G messages crash the modems of 542 smartphone models, and imperceptible audio hijacks voice assistants. Computer-use agents cause harm even from benign instructions. On the post-quantum side, HQC and Falcon give way to side channels. The insurance lead market and the AI Act close the month.
Archive: reconstruction written in November 2026
1. Semantics Over Syntax: Uncovering Pre-Authentication 5G Baseband Vulnerabilities
arXiv · Qiqing Huang, Xingyu Wang, Wanda Guo, Guofei Gu et al. · Network Security
In short: 5G messages that are well-formed but inconsistent crash modems before authentication.
5G phones process radio configuration messages before authentication and integrity protection are in place. ConSeT derives cross-field constraints from the specifications, with help from an LLM, and generates messages that are valid but inconsistent. On commercial smartphones it finds seven new vulnerabilities, three of them severe CVEs, affecting 64 chipsets and over 542 phone models.
Why it matters. An attacker with a fake base station can knock phones offline with no credentials: the risk spans whole corporate fleets.
2. Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection
IEEE Symposium on Security and Privacy · Miaona Chen, K Wang, Li Li, Jiaheng Zhang et al. · AI & LLM Security
In short: Imperceptible adversarial audio, disguised as reverb, hijacks audio-language models up to 96% of the time.
Models that merge audio and text power voice assistants and open a new attack channel. AudioHijack generates audio that works in any context and hides it in natural reverberation. Across 13 recent models, hijacking succeeds on average 79% to 96% of the time, and commercial voice agents from Mistral AI and Microsoft Azure carry out unauthorised actions on the user's behalf.
Why it matters. Voice assistants that act for users can be steered by a hidden sound: a risk for fraud and access.
3. The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents
arXiv · Xuwei Ding, Skylar Zhai, Linxin Song, Jiate Li et al. · AI & LLM Security
In short: With entirely benign instructions, computer-use agents cause harm in over 90% of cases.
Agent safety evaluations focus on misuse and prompt injection, but harm can also arise from a benign task in a risky context. OS-BLIND offers 300 tasks across 12 categories and 8 applications. Most agents exceed a 90% attack success rate; even a strongly aligned model reaches 73%, rising to 92.7% inside a multi-agent system.
Why it matters. Liability for harm caused by an agent does not depend on user intent alone: controls on action outcomes are needed.
4. Beyond Indistinguishability: Measuring Extraction Risk in LLM APIs
IEEE Symposium on Security and Privacy · R Liu, David Evans, Li Xiong · AI & LLM Security
In short: Differential privacy does not stop an LLM API from leaking protected text: extractability must be measured directly.
Guarantees such as differential privacy or low membership-inference rates are used as evidence that a model does not leak training data. The authors prove they are neither sufficient nor necessary against extraction through APIs. They propose a definition based on the queries needed to make the model emit protected text, an efficient estimator and practical guidelines.
Why it matters. Anyone exposing an LLM trained on confidential data must measure extraction risk directly: usual privacy metrics can falsely reassure.
Read the paper · PDF · Code
5. Breaking Optimized HQC: The First Cache-Timing Full Decryption Oracle Key-Recovery Attack in Post-Quantum Cryptography
CRYPTO · Haiyue Dong, Qian Guo · Post-Quantum Cryptography
In short: A compiler optimisation breaks constant-time behaviour in HQC, the post-quantum standard, exposing its key in ten seconds.
The source of HQC's optimised AVX2 implementation is written in constant time, but certain compiler optimisations rewrite it and introduce secret-dependent branches. An unprivileged attacker on the same machine watches the cache with Flush+Reload and, with a new GPU-accelerated decoding method, recovers the full hqc-1 key from under ten seconds of traces.
Why it matters. Post-quantum security also depends on how code is compiled: it must be checked on the binary, not just the source.
6. Secret Key Recovery of FALCON using Simple Power Analysis in Conditional Calculator
IACR Transactions on Cryptographic Hardware and Embedded Systems · Gyusang Kim, Jeonghwan Lee, Myeonghoon Lee, Hong Seokhie et al. · Post-Quantum Cryptography
In short: A single power trace is enough to recover the secret key of the post-quantum Falcon signature.
Falcon, a NIST-standardised post-quantum signature, relies on floating-point arithmetic whose power use can depend on data. The authors exploit the conditional calculator in floating-point conversion and addition with simple power analysis, even from a single trace. They recover the key in 0.12 seconds and still find it with 9.3% of measured bits wrong, across 1,000 different keys.
Why it matters. Post-quantum signatures on smart cards and embedded devices need dedicated protection against power measurement.
7. GlitchSnipe: Toward Localized Voltage Fault Attacks
IACR Transactions on Cryptographic Hardware and Embedded Systems · Fatemeh Khojasteh Dana, Saleh Khalaj Monfared, Hamed Okhravi, Shahin Tajik · Hardware & Side Channels
In short: A sinusoidal signal on the power supply induces faults only in chosen areas of the chip.
Voltage glitching is seen as an attack that hits the whole chip uniformly. The authors show that the power delivery network behaves like a communication channel: different frequencies reach different areas of the die. Modulating the supply with a single frequency induces localised faults. The method works on FPGAs against state machines and AES-128 implementations.
Why it matters. Physical attacks are becoming more precise and cheaper: devices that hold keys must account for them in design.
8. Security risk assessment of android automotive OS software supply chain using firmware reverse engineering
Computers & Security · Hanbo Yu, Faiyaz Khan, Steven H. H. Ding, Junjie Wu et al. · CPS & IoT Security
In short: Analysing Android Automotive firmware from four carmakers finds vulnerable components and inconsistent SBOM practice.
Android Automotive OS runs infotainment and some vehicle functions, and depends on many third-party libraries. The authors extract firmware from four major carmakers, derive software bills of materials, map known CVEs and write proof-of-concept exploits: one critical vulnerability is triggered, while others are neutralised by protections or missing dependencies.
Why it matters. Vehicle software inherits the flaws of its supply chain: relevant to product liability in the automotive sector.
9. Understanding Data Collection, Brokerage, and Spam in the Lead Marketing Ecosystem
IEEE Symposium on Security and Privacy · Yash Vekaria, Nurullah Demir, Konrad Kollnig, Zubair Shafiq
In short: Sites offering health-insurance quotes pass data to dozens of third parties and trigger thousands of calls.
The lead market collects personal data through web forms for quotes in sectors such as insurance, then resells it. The authors monitor over 100 health lead sites and 200 test contacts: health data reaches more than 70 third parties, is sold to unvetted buyers and is sometimes padded with fabricated details. Over 8,000 calls follow, often within seconds.
Why it matters. Intermediaries buying leads to sell policies can face privacy and reputational exposure along the whole chain.
10. AI Agents Under EU Law
arXiv · Luca Nannini, Adam Leon Smith, Michele Joshua Maggini, Enrico Panai et al. · Policy, Law & Society
In short: A map of EU obligations for AI agent providers: AI Act, GDPR, Cyber Resilience Act, NIS2 and product liability.
AI agents that plan and act with little human input fall under the AI Act, but also under the GDPR, Cyber Resilience Act, Digital Services Act, NIS2 and the new Product Liability Directive. The authors propose a nine-category taxonomy and a twelve-step compliance path, and conclude that high-risk agents with untraceable behaviour cannot currently comply.
Why it matters. Organisations adopting AI agents must inventory actions, data and connected systems: the first step for compliance and risk assessment.
Trends of the month
AI & LLM Security
466 papers this month on this topic
With 466 of 1,861 papers, AI security remains the top topic. Risk spreads beyond text: imperceptible audio commands commercial voice assistants, computer-use agents cause harm even from benign instructions, and common privacy guarantees do not stop an LLM API from leaking protected data.
Papers cited:
- Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection
- The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents
- Beyond Indistinguishability: Measuring Extraction Risk in LLM APIs
Post-Quantum Cryptography
79 papers this month on this topic
As post-quantum standards arrive, attention shifts to implementations. A compiler optimisation exposes HQC's key in ten seconds, a single power trace suffices for Falcon and voltage faults become targeted. The maths holds, but compiled code and hardware must be checked one by one.
Papers cited:
- Breaking Optimized HQC: The First Cache-Timing Full Decryption Oracle Key-Recovery Attack in Post-Quantum Cryptography
- Secret Key Recovery of FALCON using Simple Power Analysis in Conditional Calculator
- GlitchSnipe: Toward Localized Voltage Fault Attacks
Policy, Law & Society
60 papers this month on this topic
Two papers bear directly on insurance and regulation. The lead market for health quotes spreads sensitive data to dozens of third parties and sells it without checks, while a map of EU rules shows that high-risk AI agents with untraceable behaviour cannot currently meet the AI Act.
Papers cited:
- AI Agents Under EU Law
- Understanding Data Collection, Brokerage, and Spam in the Lead Marketing Ecosystem
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1861.