RESEARCH
June 2026: malicious agent skills, invisible BGP hijacks and the Encrochat case
In June 2026 coding agent extensions become a new supply chain dependency, and current detectors see only part of the risk. Partial ROV deployment enables BGP hijacks the victim cannot see, AirDrop and Quick Share show zero-click flaws, and a study reconstructs how law enforcement breached Encrochat.
Archive: reconstruction written in November 2026
1. MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
arXiv · Wenbo Guo, Wei Zeng, Chengwei Liu, Xiaojun Jia et al. · AI & LLM Security
In short: MalSkillBench collects almost 4,000 runtime-verified malicious skills for coding agents and measures how detectors fare.
Skills are packages of instructions, scripts and permissions that coding agents use to extend themselves: they are code and prompt at once. The benchmark holds 3,944 sandbox-verified malicious skills plus 703 from the wild, dominated by one cryptocurrency theft campaign. The best detector finds 98.4% of code injections but collapses on prompt injection and attacks on agent control.
Why it matters. Developers install third-party skills as if they were documents: it is a new entry point into corporate systems that current controls cover poorly.
2. ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software
IEEE European Symposium on Security and Privacy · Xiang Mei, Jordi Del Castillo, Pulkit Singh Singaria, Haoran Xi et al.
In short: ARVO makes over 6,100 real vulnerabilities from 311 open source projects reproducible, each with its patch.
Vulnerability datasets almost always trade reproducibility for size and diversity. The authors identify the main obstacles to large-scale bug reproduction and solve them for OSS-Fuzz: ARVO holds over 6,100 vulnerabilities that can be rebuilt, triggered and analysed across versions, reproduces 81% of them and automatically identifies each patch.
Why it matters. Tools that promise to find or fix flaws automatically must be measured on real, repeatable cases: ARVO provides that common baseline.
3. Understanding the Stealthy BGP Hijacking Risk in the ROV Era
Network and Distributed System Security Symposium · Yihao Chen, Qi Li, Ke Xu, Zhuotao Liu et al. · Network Security
In short: With ROV only partly deployed, a protected network's traffic can be hijacked without the victim seeing any malicious route.
ROAs now cover 57% of IPv4 prefixes, but ROV validation runs on only a few thousand networks. The authors study a side effect: a network shielded by neighbours that drop false routes can still have its traffic diverted by legacy networks along the path. The hijack stays invisible on the control plane and evades route-based defences.
Why it matters. Anyone treating ROV as sufficient protection may have traffic intercepted with no warning: monitoring must also look at the actual packet path.
4. A Real-World Law-Enforcement Hack: The Case of Encrochat
CRYPTO · Martin R. Albrecht, Sunoo Park, Michael A. Specter, Douglas Stebila · Policy, Law & Society
In short: The most detailed public account yet of how European law enforcement breached Encrochat in 2020.
Encrochat sold modified Android phones with its own PKI and a messaging app based on the Signal protocol, and was widely used by organised crime. In 2020 a coordinated operation stayed inside for months, collecting historical and real-time data and metadata used in over 6,000 arrests. The authors reconstruct the infrastructure and how it was compromised.
Why it matters. End-to-end encryption does not protect when the vendor controls device and updates: anyone assessing closed platforms must ask who can push code to the handsets.
5. Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols
USENIX WOOT Conference on Offensive Technologies · Arash Ale Ebrahim, Nils Ole Tippenhauer · Systems & Software Security
In short: The first cross-platform study of AirDrop and Quick Share finds six vulnerabilities, three reachable without authentication.
AirDrop and Quick Share, used by over five billion devices, accept connections from anyone nearby and parse complex formats in privileged services. The authors reconstruct the protocols, build a dedicated fuzzer and find six flaws: three pre-authentication issues in AirDrop, two in Samsung Quick Share including an encryption bypass, and a use-after-free in Google's Quick Share for Windows.
Why it matters. Proximity protocols are a zero-click attack surface on corporate devices: limiting reception to known contacts is a sensible default.
6. RadKey: An LLM-Guided RF Backscatter System for Through-Wall Keystroke Inference
IEEE Symposium on Security and Privacy · Qijun Wang, Chunqi Qian, Huacheng Zeng · Hardware & Side Channels
In short: RadKey recovers what is typed through a wall using a small batteryless radio tag placed near the keyboard.
Acoustic or vibration attacks on keyboards usually need conspicuous short-range sensors and training data from the victim. RadKey uses a passive tag that turns keystroke vibrations and sounds into a shift in the reflected radio signal, read remotely through walls. Its features generalise across users and keyboards, and a language model refines the classifier while running.
Why it matters. Passwords and sensitive data typed in shared offices can be intercepted with no network access: the physical security of workstations matters too.
7. Kitten or Panda? Measuring the Specificity of Threat Group Behaviors in Public CTI Knowledge Bases
ACM Asia Conference on Computer and Communications Security · Aakanksha Saha, Martina Lindorfer, Juan Caballero · Malware & Threat Intelligence
In short: Only a third of threat groups in MITRE ATT&CK have exclusive techniques: public profiles are a weak basis for attribution.
The authors analyse threat group profiles in MITRE ATT&CK and Malpedia. Only 34% of ATT&CK groups use techniques no other group uses; software is more distinctive at 73%, but the share falls to 24% in Malpedia. Merging sources and adding exploited vulnerabilities and techniques from reports helps little: groups with exclusive behaviours stay under 30%.
Why it matters. Many risk assessments and claims rely on attribution: these numbers show how fragile it is when based on techniques alone.
8. The Invisible Ink of the Android Malware World: A Longitudinal Study on the Usage of Covert Communication Channels
IEEE European Symposium on Security and Privacy · Zeya Umayya, Manan Aggarwal, Manan Chugh, Mann Nariya et al. · Malware & Threat Intelligence
In short: Across 3.5 million malicious Android apps, use of proxies, VPNs and Tor to hide command and control reaches 50% in 2025.
The first longitudinal study of covert channels in Android malware analyses 3.5 million samples from 2009 to July 2025. Static rules find 288,000 apps from 511 families using proxies, VPNs or Tor; the share grows from 0.3% in 2012 to 50% in 2025. Some families combine several channels or switch often: one did so 40 times between 2019 and 2025.
Why it matters. Blocking command servers by address works less and less on mobile devices: controls based on app behaviour are needed.
9. Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG
arXiv · He Sun, Shinan Liu, Siyuan Ma, Junhao Li et al. · AI & LLM Security
In short: SpliceLeak exploits shared cache timing in language model services to extract other users' private prompts.
To speed up retrieval-augmented services, inference engines reuse cache chunks even when they are not at the start of a request. The authors show that the deterministic way these chunks are aligned leaves a measurable timing signature. SpliceLeak uses it to estimate the length of hidden prompts and then extract their content token by token, succeeding in up to 100% of cases on vLLM with LMCache.
Why it matters. Users of AI services shared between customers should know that performance optimisations can leak data entered by others.
10. FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion
arXiv · Zixin Rao, Wentian Zhu, Chan Aristella Lu, Zhaorun Chen et al. · Identity & Authentication
In short: FragFuse bypasses AI agent access controls by splitting a forbidden request into fragments stored in long-term memory.
AI agents use long-term memory and, increasingly, controls that block disallowed requests. FragFuse splits forbidden content into harmless-looking fragments, gets them stored in memory across separate interactions and reassembles them with a final request that contains nothing suspicious. The attack defeats three access-control mechanisms across four agent settings.
Why it matters. Filtering each request is not enough when the agent remembers: controls must also consider what memory gathers over time.
Trends of the month
AI & LLM Security
513 papers this month on this topic
With 513 of 2,072 papers, AI security remains the top theme. Risk is moving from the model to the ecosystem around it: third-party skills installed in agents, caches shared between customers of inference services and long-term memories that reassemble forbidden requests. Every component added to make agents more useful opens a new channel.
Papers cited:
- MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
- Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG
- FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion
Malware & Threat Intelligence
67 papers this month on this topic
Several papers measure how hard it is to see and attribute attackers. Half of Android malware now hides command and control behind proxies, VPNs or Tor, and public threat group profiles barely tell one group from another. The Encrochat case is a reminder that investigators too exploit control of devices rather than cryptography.
Papers cited:
- Kitten or Panda? Measuring the Specificity of Threat Group Behaviors in Public CTI Knowledge Bases
- The Invisible Ink of the Android Malware World: A Longitudinal Study on the Usage of Covert Communication Channels
- A Real-World Law-Enforcement Hack: The Case of Encrochat
Network Security
58 papers this month on this topic
Half-deployed defences can create new blind spots. Partially deployed ROV allows BGP hijacks invisible to the victim, proximity protocols accept data from anyone nearby, and a passive radio tag reads a keyboard through a wall. The attack surface spans the network, the airwaves and physical space.
Papers cited:
- Understanding the Stealthy BGP Hijacking Risk in the ROV Era
- Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols
- RadKey: An LLM-Guided RF Backscatter System for Through-Wall Keystroke Inference
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 2072.