RESEARCH
October 2026: AI models as trojans, forged PDF signatures and exposed satellites
This edition covers 1 to 23 October 2026; daily digests start on the 24th. An open model can hide in its weights a trojan that exfiltrates secrets over DNS, and persistent memory in AI assistants makes prompt injections last. Valid PDF signatures fool readers, small-satellite radio modules prove vulnerable and the European identity wallet gains protection against issuers.
Archive: reconstruction written in November 2026
1. Model-as-a-Trojan: Self-Activating Covert DNS Exfiltration Baked Into the Weights of an LLM Agent
arXiv · Barak Haryati, Shaked Zychlinski · Network Security
In short: A purpose-trained open language model exfiltrates secrets over DNS as soon as it sees a shell, then answers normally.
Open-weight models are downloaded from public hubs and used in agents with shell access, relying on the sandbox. The authors train a model that, on the first turn, reads a secret from the environment and sends it as DNS queries to an attacker's server, never mentioning it. The attack works even behind firewalls that only let DNS through and fires in 20 of 20 prompt suppression trials.
Why it matters. Downloading a model is like running third-party code: anyone using open models in agents must verify their origin and monitor DNS traffic too.
2. Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
arXiv · Pedro H. Barcha Correia, Matheus Azevedo de Sá, Paulo H. Gomes de Senna, Giovanni Mandel Martignago et al. · AI & LLM Security
In short: With persistent memory in AI assistants, a prompt injection survives across sessions and can reach several users in an organisation.
In traditional chatbots a prompt injection ends with the conversation. Persistent memory in popular services makes it last: on three major platforms the authors show that personal memories, projects, skills, organisation instructions and MCP resources can spread disinformation or harmful content even in new sessions. Nearly half of the proposed mitigations are not yet in place.
Why it matters. Shared memory features in corporate AI tools turn a single deception into a persistent compromise: they must be governed like any shared repository.
Read the paper · PDF · Code
3. Polynomial-Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Setting
Journal of Cryptology · Nicholas Carlini, Jorge Chávez-Saab, Anna Hambitzer, Francisco Rodríguez‐Henríquez et al. · AI & LLM Security
In short: For the first time all the weights of a neural network are extracted in polynomial time by observing only the final label.
Earlier work showed neural network parameters can be extracted with cryptanalytic techniques, but it needed numerical outputs or exponential time. The authors succeed seeing only the predicted class, with a polynomial number of queries and computation, on a CIFAR-10 network with nearly a million parameters, by analysing the shape of the decision boundaries.
Why it matters. Exposing a model through an API does not protect its intellectual property: anyone who invested in training must limit and monitor queries.
4. What you see is (not) what you got: The human factor in PDF signature verification
Computers & Security · Jakob Heher, Emanuel Pichler, Stefan More · Cryptography
In short: Cryptographically valid PDF signatures with a fake visible block fool 71.9% of readers and five of six organisations.
Signed PDFs carry legal weight under the eIDAS regulation, but readers look at the signature block, not the certificate. The authors show that 9 of 13 viewers hide the verified signer identity behind extra clicks. In studies with 584 European participants the best variant fools 71.9% at first glance, and in real trials five of six organisations accept forged requests.
Why it matters. Contracts, policies and payment requests signed as PDFs can be forged without breaking cryptography: procedures must check the certificate, not the appearance.
5. Censorship Resistance in Credential Systems and Application to the EUDI Wallet
IACR Cryptology ePrint Archive · Pierpaolo Della Monica, Ivan Visconti, Andrea Vitaletti, Marco Zecchini · Identity & Authentication
In short: CRACS protects European identity wallet users from issuers that selectively refuse to issue credentials.
Anonymous credential systems usually protect data when users present it, not when they obtain it: a malicious issuer can use the information it gathers to deny issuance arbitrarily. The authors define resistance to this censorship and propose CRACS, compatible with the European EUDI wallet, which can be adopted one issuer at a time with no change for verifiers.
Why it matters. The European wallet will underpin many identification processes, including in banking and insurance: protecting issuance as well as presentation strengthens trust in it.
6. How Much Feedback Is Needed to Break Template Protection? The Geometric Vulnerability of Biometric Authentication
arXiv · Eliron Rahimi, Margarita Osadchy, Orr Dunkelman · Identity & Authentication
In short: Even with protected biometric templates, the accept or reject answer alone is enough to reconstruct the face template.
Biometric systems increasingly protect stored templates, but the authentication interface can still leak information. The authors present the first attack that reconstructs a protected template using only the accept or reject outcome, exploiting the geometry of matching. With a generative face model they cut the queries needed by five times, also for systems that return a score.
Why it matters. Template protection is not enough if the interface allows unlimited attempts: limiting and monitoring failed authentications remains essential.
7. SatBleed: Security of Commoditized Communication Modules in Satellites
IEEE Symposium on Security and Privacy · Ulysse Planta, Julian Rederlechner, Martin Strohmeier, Mathias Fischer et al. · CPS & IoT Security
In short: Commercial communication modules used in small satellites have serious flaws: at least 28 missions in orbit are exposed.
Falling launch costs have multiplied small satellites built from commercial components. The communication subsystem is always exposed and trusted because it receives commands. The authors analyse modules from several vendors and find serious vulnerabilities in firmware, protocols and architecture; cross-checking public telemetry they estimate at least 28 missions in orbit at risk of takeover.
Why it matters. Anyone insuring space missions or relying on their services must weigh cyber risk alongside launch risk: a hijacked satellite is hard to recover.
8. Helol Tunnel: Covert Channel Exploitation of TLS Extensibility & Privacy Features
arXiv · Reza Soosahabi, Rakesh Seal · Network Security
In short: Helol hides data in the order of elements in TLS's opening message and evades next-generation firewalls.
To avoid hindering TLS evolution, firewalls and proxies are encouraged not to alter the client's opening message parameters, and many applications vary them to resist fingerprinting. The authors exploit both trends: Helol encodes information by reordering the message's cryptographic elements, and on real traffic it beats existing covert channels and evades firewalls with full inspection.
Why it matters. Exfiltration and remote control can hide in the most common encrypted traffic: detection cannot rely on TLS fingerprints alone.
9. When Masking Preimage Computation Isn’t Enough: A Power Analysis Attack on Masked Implementations of Falcon
IACR Cryptology ePrint Archive · Keng-Yu Chen · Post-Quantum Cryptography
In short: A power analysis attack recovers the Falcon key even when the preimage computation is masked.
Fully masking Falcon is costly, so some implementations protect only the preimage computation. The authors show that share recombination leaks the ratio between real and imaginary parts of the public hash, enough to derive the key. In simulation on ARM Cortex-M0 the attack succeeds 98.3% of the time with 4,000 traces; they propose a cheap countermeasure based on rejection sampling.
Why it matters. Partial protections for post-quantum signatures leave doors open: devices adopting Falcon must be assessed on the full implementation.
10. JANUS: Agentic Cross-Language Fuzzing Harness Generation for Android Native Libraries
arXiv · Xiangyu Zhang, Yucheng Su, Lingling Fan, Yinan Li et al. · Systems & Software Security
In short: JANUS uses an AI agent to build tests for Android apps' native libraries and finds six flaws in preinstalled apps.
Android apps use many native C/C++ libraries linked to Java code through JNI, a boundary attackers exploit to compromise devices. Fuzzing tools struggle to reconstruct how these functions are called. JANUS does so with an agent workflow: on 44 popular apps it produces 5.9 times more valid tests than the state of the art and finds six new vulnerabilities in apps from five vendors.
Why it matters. Vendor preinstalled apps are often closed and little checked: tools like this make it possible to assess them without source code.
Trends of the month
AI & LLM Security
504 papers this month on this topic
With 504 of 1,805 papers, AI security remains the top theme. The model itself becomes an attack vector: a trojan in the weights exfiltrates secrets over DNS, persistent memory makes prompt injections last even across users in one organisation, and a neural network can be copied by watching only its answers. Model provenance and governance become security controls.
Papers cited:
- Model-as-a-Trojan: Self-Activating Covert DNS Exfiltration Baked Into the Weights of an LLM Agent
- Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
- Polynomial-Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Setting
Identity & Authentication
64 papers this month on this topic
European digital identity is at the centre of several papers. eIDAS-valid PDF signatures fool readers and organisations with a fake visible block, the EUDI wallet can protect the issuance step too, and protected biometric templates can be rebuilt from accept or reject answers alone. The weak links are interfaces and human behaviour more than cryptography.
Papers cited:
- What you see is (not) what you got: The human factor in PDF signature verification
- Censorship Resistance in Credential Systems and Application to the EUDI Wallet
- How Much Feedback Is Needed to Break Template Protection? The Geometric Vulnerability of Biometric Authentication
CPS & IoT Security
40 papers this month on this topic
Commercial, closed components widen the attack surface. Standard radio modules in small satellites expose at least 28 missions, native libraries in preinstalled apps hide flaws found only with new tools, and TLS's opening message becomes a covert channel firewalls cannot see. Dependence on third-party suppliers weighs ever more in risk assessment.
Papers cited:
- SatBleed: Security of Commoditized Communication Modules in Satellites
- Helol Tunnel: Covert Channel Exploitation of TLS Extensibility & Privacy Features
- JANUS: Agentic Cross-Language Fuzzing Harness Generation for Android Native Libraries
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1805.