RESEARCH
August 2026: AI-found zero-days, leaking encrypted reasoning and post-quantum TLS
In August 2026 language models help find 31 zero-days in PDF readers and flaws in 5G cores and Ethereum clients. Encrypted reasoning returned by model APIs can be decrypted by a weaker model, and the shared cache on Apple chips lets the CPU spy on the GPU. A systematisation shows that moving TLS to post-quantum is an architecture problem.
Archive: reconstruction written in November 2026
1. From Documentation to Zero-day Vulnerabilities: LLM-Driven Fuzzing of JavaScript Engines in PDF Readers
arXiv · Suyue Guo, Stijn Pletinckx, Tianle Yu, Yigitcan Kaya et al. · Systems & Software Security
In short: PDFuzzer uses a language model to generate JavaScript call sequences and finds 31 zero-days in Acrobat, Foxit and PDF-XChange.
PDF reader fuzzers usually test one API call at a time and miss flaws that need sequences. PDFuzzer derives a grammar of the JavaScript APIs and the relations between calls from manuals and execution traces, then generates concrete sequences with a constraint solver. It covers up to 48% more code than existing tools and finds 31 vulnerabilities, up to code execution.
Why it matters. PDFs remain a classic email attack vector: the readers most used in companies still had dozens of unknown flaws.
2. Drishti: AI-Led Human-Directed Vulnerability Auditing for 5G Cores
arXiv · Sriram Ramachandran, Levente Csikor, Dinil Mon Divakaran · Network Security
In short: Drishti pairs AI with human reviewers to validate flaws in open source 5G cores and finds three in Open5GS and free5GC.
Finding candidate defects with AI is now cheap: the bottleneck is verifying them, checking reachability, assessing impact and reviewing patches. Drishti tackles each of these steps. On Open5GS and free5GC it finds a pre-authentication crash, a 2-byte input that makes a core network component run out of memory in 6.2 seconds, and an ineffective patch for an existing CVE.
Why it matters. Private 5G networks are spreading in factories and ports: flaws this simple can halt service, and a published patch does not guarantee the problem is closed.
3. SpecTrum: Specification-Guided Differential Fuzzing for Ethereum Consensus Clients
arXiv · Seokhun Jeong, Gyeongmin Dan, Sukyoung Ryu, Sungjae Hwang · Blockchain & DeFi
In short: SpecTrum formalises Ethereum's consensus specification and finds 27 divergences across the five main clients.
Ethereum's safety depends on independent clients agreeing on every state transition. The reference specification, in Python, defines validity only implicitly. SpecTrum rewrites it with explicit conditions, measures which are covered by the official tests and generates inputs for the rest. Across the five main clients it finds 27 divergences, 22 of which are invisible without this formalisation.
Why it matters. A divergence between clients can fork the chain or stall finality: anyone holding or insuring digital assets depends on this software being correct.
4. Stealing Reasoning Traces from Proprietary LLM APIs
arXiv · Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner et al. · AI & LLM Security
In short: Encrypted reasoning returned by model APIs can be decrypted by a weaker model from the same provider.
Leading providers hide models' reasoning steps by returning them to the client as encrypted blocks. The authors find that these blocks are interchangeable across sessions, users and models: fed to a less protected model, they are written out in plain text. Decrypting 315,320 blocks found in logs published by developers, they recover 367 pieces of personal data and 182 credentials.
Why it matters. Anyone publishing or keeping AI session logs may expose data and credentials without knowing it: those blocks must be treated as sensitive information.
5. ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection
arXiv · Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang et al. · AI & LLM Security
In short: ROPE stops indirect prompt injection by checking where every value passed to an agent's sensitive tools comes from.
Indirect prompt injection hides instructions in content an agent reads, pushing it to use tools harmfully. ROPE admits a value into a sensitive parameter only if it comes from the user, a source the user named or the user's own records. The check is deterministic and independent of how the attack is worded: attack success drops to 2.6% at most while keeping most of the utility.
Why it matters. Agents that read emails and external documents are exposed to hidden instructions: checking where data comes from is sturdier than filtering text.
Read the paper · PDF · Code
6. SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon
arXiv · Tianhong Xu, Saion K. Roy, Ruyi Ding, Aidong Adam Ding et al. · Hardware & Side Channels
In short: On Apple Silicon chips an unprivileged process spies on GPU work from the CPU through the shared cache.
In chips integrating CPU and GPU, the two units share a system-level cache. The authors reverse-engineer how the Apple M1 indexes it and show that GPU accesses leave traces readable by an unprivileged CPU process. With this channel they reconstruct graph neural network edges with 90% accuracy and recover keywords from a language model's inputs with up to 94.8% accuracy.
Why it matters. More and more AI processing runs locally on laptops: isolation between apps on the same chip does not protect data handled by the GPU.
7. Post-Quantum TLS Migration: A Systematization of Hybrid Handshakes, PSKs, KeyUpdate, and Certificate Strategies
IACR Cryptology ePrint Archive · Hridoy Roy · Post-Quantum Cryptography
In short: A systematisation shows that moving TLS to post-quantum is about much more than swapping the key exchange algorithm.
TLS migration is often described as replacing a classical algorithm with a post-quantum one. The authors show that TLS spreads security across key exchange, authentication, resumption with pre-shared keys, key updates and X.509 certificates, each with its own goals and constraints. They classify hybrid and pure options and separate final standards from drafts.
Why it matters. For anyone planning the post-quantum migration, cryptographic inventory, certificates and hardware modules matter as much as the choice of algorithm.
8. How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection
arXiv · Lorenzo Guerra, Thomas Chapuis, Guillaume Duc, Pavlo Mozharovskyi et al. · Network Security
In short: Re-evaluated under a common protocol, provenance-based intrusion detectors do not beat a simple allowlist of known programs.
Provenance-graph intrusion detection systems often report excellent results. The authors re-evaluate them on DARPA datasets with temporally separated test periods and thresholds calibrated on validation only. An allowlist of executables and paths seen in training matches or beats the learned models on key metrics, and several systems flag attacks without giving the context investigators need.
Why it matters. Anyone assessing detection products should ask how they were measured: lab results may say little about real-world effectiveness.
9. GhostTac: Manipulating Tactile Sensors without Physical Contact
arXiv · Kun Wang, Xuancun Lu, Ruochen Zhou, Kai Wang et al.
In short: GhostTac remotely falsifies robot tactile sensor readings with electromagnetic interference, without touching them.
Tactile sensors let robots grasp and handle objects. The authors show that calibrated electromagnetic signals are turned by the sensor's electronics into a steady offset that gets past filtering, altering the measured pressure at chosen points. The attack works on 15 sensors of different types and can, for example, make a home robot squeeze too hard.
Why it matters. Home and industrial robots working near people can cause physical harm if their sensors are manipulated: it is a liability risk as well as a cyber one.
10. Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization
arXiv · Chuan Sheng, Shan Jiang, Jianming Zhao, Yu Yao
In short: PVParser recovers an industrial plant's process variables straight from network traffic, without knowing the protocol.
Process-aware security monitoring in industrial systems needs values such as pressures and temperatures, but supervisory systems record only some of them. PVParser recovers them from raw traffic: it isolates the periodic messages that carry them and treats their segmentation as an optimisation problem solved with tree search, so that early errors do not propagate.
Why it matters. Seeing the plant's physical variables helps spot attacks that IT logs alone miss; the same technique, however, also eases an attacker's reconnaissance.
Trends of the month
Systems & Software Security
65 papers this month on this topic
Language models are becoming standard tools for vulnerability research. They drive PDF reader fuzzing to 31 zero-days and support human reviewers in 5G cores, while formalised specifications uncover divergences between Ethereum clients. Finding candidates is cheap: the work shifts to verification, impact and patch quality.
Papers cited:
- From Documentation to Zero-day Vulnerabilities: LLM-Driven Fuzzing of JavaScript Engines in PDF Readers
- Drishti: AI-Led Human-Directed Vulnerability Auditing for 5G Cores
- SpecTrum: Specification-Guided Differential Fuzzing for Ethereum Consensus Clients
AI & LLM Security
455 papers this month on this topic
With 455 of 1,905 papers, AI security remains the top theme. Encrypted API reasoning can be decrypted with a weaker model and ends up in public logs with credentials, the shared cache on Apple chips exposes inputs to locally run models, and defences against prompt injection rely on checking data origin rather than on filters.
Papers cited:
- Stealing Reasoning Traces from Proprietary LLM APIs
- ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection
- SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon
CPS & IoT Security
56 papers this month on this topic
Cyber security and physical safety are converging. Electromagnetic interference falsifies robot tactile sensors to the point of making them squeeze too hard, while pressures and temperatures can be read from a plant's network traffic without knowing the protocol. For risk assessment, the effects can reach bodily injury and property damage.
Papers cited:
- GhostTac: Manipulating Tactile Sensors without Physical Contact
- Recovering Process Variables from Industrial Network Traffic via Search-Based Optimization
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1905.