RESEARCH
May 2026: confidential computing falls to hobbyist hardware, OAuth flaws and toolchains
May 2026 is IEEE S&P month. With cheap hardware on the memory bus, two teams break Intel SGX, TDX and AMD SEV-SNP, and GPU Rowhammer leads all the way to system control. MCP tools combine into chains that exfiltrate data, and AI agent browsers bypass site isolation. OAuth, password managers and attack attribution round out the month.
Archive: reconstruction written in November 2026
1. TEE.Fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition
IEEE Symposium on Security and Privacy · Jalen Chuang, Alex Seto, Nicolas Berrios, Stephan van Schaik et al. · Hardware & Side Channels
In short: With parts bought online, TEE.Fail taps the DDR5 bus and extracts keys from Intel SGX, TDX and AMD SEV-SNP.
Moving enclaves from PCs to confidential virtual machines on servers stripped memory encryption of integrity and replay protection. The authors build a DDR5 bus interposer from e-commerce parts and, thanks to deterministic encryption, extract secret keys, in some cases attestation keys, from machines in fully trusted status.
Why it matters. Many cloud services promise confidentiality even from the provider: those relying on it should know physical access cheaply defeats it.
2. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing
IEEE Symposium on Security and Privacy · Jesse De Meulemeester, David Oswald, Ingrid M.R. Verbauwhede, Jo Van Bulck · Hardware & Side Channels
In short: A low-cost DDR4 interposer alters memory addresses on the fly and breaks SGX and SEV-SNP attestation.
Confidential-computing technologies encrypt memory and, after recent software attacks, also check memory aliases at boot. Battering RAM is a cheap DDR4 interposer that changes address lines at runtime, bypassing those checks. The authors gain plaintext read and write access in Scalable SGX, extract its provisioning key and again break attestation on AMD SEV-SNP.
Why it matters. Firmware defences against aliasing do not stop a physical attacker: the risk mainly concerns third-party data centres.
3. GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer
IEEE Symposium on Security and Privacy · Chris S. Lin, Yuqin Yan, Guozhen Ding, Joy Qu et al. · Hardware & Side Channels
In short: GPUBreach uses Rowhammer on NVIDIA GPU memory to escalate privileges all the way to full system control.
GPU Rowhammer had so far only been used to randomly corrupt model weights. GPUBreach finds where GPU page tables are allocated and tampers with them through targeted bit flips: an unprivileged process reaches the memory of other processes or tenants, extracts cryptographic keys and alters model code. From there it gains a root shell on the CPU, bypassing the IOMMU.
Why it matters. Shared cloud GPUs become a point of compromise for every tenant using them: an accumulation risk worth assessing.
4. Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem
IEEE Symposium on Security and Privacy · Shuli Zhao, Qinsheng Hou, Zihan Zhan, Yanhao Wang et al. · AI & LLM Security
In short: Instructions hidden in data chain legitimate MCP tools into workflows that exfiltrate private information.
With the Model Context Protocol, LLMs orchestrate toolchains. The authors describe parasitic attacks: instructions hidden in external sources read during a legitimate task assemble harmless tools into a flow that gathers and exfiltrates private data, with no victim interaction. A census of 12,230 tools across 1,360 MCP servers finds many exploitable components.
Why it matters. MCP lacks isolation and least privilege: connecting company tools to an agent requires carefully limited permissions.
5. Site Isolation is Dead: How Site Isolation is Broken in Agentic Browsers and Extensions
IEEE Symposium on Security and Privacy · Suyoung Lee, Seongho Keum, C W Lee, Dongwon Shin et al. · AI & LLM Security
In short: Every AI agent browser and extension analysed lets attackers bypass site isolation.
Site isolation stops a malicious page from reading other sites' data. AI agent browsers, however, link privileged processes and untrusted pages through internal channels. Studying two open-source browsers and seven extensions, the authors exploit these channels to inject prompts and steal user data from other sites. All tested products prove vulnerable.
Why it matters. AI agent browsers reopen a risk that site isolation had closed: enterprise adoption deserves careful assessment.
6. Credential Extraction Attacks Against Compromised Credential Checking Services of Password Managers
IEEE Symposium on Security and Privacy · Yihe Duan, D Y Wang, Yutong Li · Identity & Authentication
In short: Breached-password checks in password managers leave traces that identify users and help guess their passwords.
Many password managers check whether stored credentials appear in breach databases through services such as Have I Been Pwned, using k-anonymous queries. But the queries are deterministic and follow recognisable patterns. A curious service can identify 83% to 88% of users and raise first-guess password success by 15-30%. Ten of 14 password managers are vulnerable.
Why it matters. Even security features can leak information: third parties in the password manager chain need assessing.
7. Audience Injection Attacks: A New Class of Attacks on Web-Based Authorization and Authentication Standards
IEEE Symposium on Security and Privacy · Pedram Hosseyni, Ralf Küsters, Tim Würtele · Identity & Authentication
In short: A new class of attacks on OAuth and OpenID Connect lets attackers impersonate users, even in open banking.
Audience injection attacks hit standards used by billions of users, including OAuth 2.0, OpenID Connect and FAPI, also employed in open banking, insurance and healthcare. They exploit how the intended recipient is handled in signature-based client authentication when several servers are involved. Attackers can impersonate users and access their resources. A dozen standards are being revised.
Why it matters. Insurance and financial platforms using these standards should check that their vendors apply the fixes.
8. Demystifying the (In)Security of Oauth-Based Account Linking in Connector Ecosystems
IEEE Symposium on Security and Privacy · Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Wing Cheong Lau · Web & Mobile Security
In short: OAuth account linking in app and AI agent connectors lets attackers take over other users' accounts.
Productivity apps, automation platforms and AI agents connect to external tools through OAuth-based connectors. Managing the link between the app's user and the external account pushes OAuth beyond its original model. The authors show how these connections break session integrity and enable account takeover: 40 vendors are vulnerable, plus 8 managed OAuth services.
Why it matters. Every connector that links an agent to company systems is a potential account-theft point: it belongs in the risk assessment.
9. APT to Disagree: A Comparative Analysis of Attribution in Commercial TI
IEEE Symposium on Security and Privacy · Aksel Ethembabaoglu, Rolf van Wegberg, Yury Zhauniarovich, Michel J. G. van Eeten · Malware & Threat Intelligence
In short: Seven threat-intelligence vendors, 13.5 million indicators: little overlap, and agreement only on country.
The authors compare 13.5 million indicators of compromise collected over 14 years from seven commercial threat-intelligence vendors. Most actors tracked by one vendor are not tracked by others, and only 1% of indicators appear in more than one source. Agreement on attribution to an attacker group is moderate, while agreement on country of origin is high.
Why it matters. Attack attribution weighs on clauses such as war exclusions: this study shows how much it can vary between sources.
10. Incalmo: an Autonomous Llm-Assisted System for Red Teaming Multi-Host Networks
IEEE Symposium on Security and Privacy · Brian Singer, Keane Lucas, Lakshmi Adiga, Meghna Jain et al. · AI & LLM Security
In short: Incalmo seizes critical assets in 37 of 40 simulated enterprise networks, in under an hour and for under $15 of LLM use.
LLM-based attack tools fail when they must move across many hosts in a corporate network. Incalmo uses the LLM to plan in high-level tasks carried out by specialised agents, with services that track context and acquired assets. Across 40 simulated networks of 22 to 50 hosts it reaches its goals in 37 cases, against 3 for previous systems, in 12-54 minutes.
Why it matters. Complex multi-stage attacks become automatable and cheap: incident frequency and speed may rise.
Trends of the month
Hardware & Side Channels
57 papers this month on this topic
Confidential computing loses another guarantee. Two independent teams, using cheap hardware on the DDR4 and DDR5 memory bus, extract keys and break Intel and AMD attestation, while GPUBreach shows GPU Rowhammer leads to full system control. Cloud providers' promised protections hold against software, not against someone with physical access.
Papers cited:
- TEE.Fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition
- Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing
- GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer
AI & LLM Security
723 papers this month on this topic
With 723 of 2,627 papers, AI security remains the top topic. MCP tools combine into chains that exfiltrate data, AI agent browsers bypass site isolation and an autonomous system takes over simulated enterprise networks in under an hour. Agents expand both the attack surface and offensive capability.
Papers cited:
- Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem
- Site Isolation is Dead: How Site Isolation is Broken in Agentic Browsers and Extensions
- Incalmo: an Autonomous Llm-Assisted System for Red Teaming Multi-Host Networks
Identity & Authentication
85 papers this month on this topic
Identity standards show structural cracks. A new class of attacks reaches OAuth and OpenID Connect all the way to open banking and insurance, OAuth connectors in apps and agents enable account theft, and breached-password checks in password managers reveal more than they should. Fixes are going through standards bodies.
Papers cited:
- Audience Injection Attacks: A New Class of Attacks on Web-Based Authorization and Authentication Standards
- Demystifying the (In)Security of Oauth-Based Account Linking in Connector Ecosystems
- Credential Extraction Attacks Against Compromised Credential Checking Services of Password Managers
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 2627.