RESEARCH
Secrets survive deletion in AI agents, latency leaks inputs, Classic McEliece reviewed
AI agents and models are a new risk surface: a secret deleted from an agent's memory is recovered from summaries and fragments, a cloud provider infers sensitive data from a manipulated model's latency, AgentTriage reconstructs what an agent did. The second thread is social engineering. On post-quantum, a critical reading of the attacks on Classic McEliece.
1. Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks
arXiv · Yulong Tian, Lei Wang, Jincan Yang, Hao Wu et al. · AI & LLM Security
In short: A malicious cloud provider that supplies a manipulated multi-exit network infers sensitive properties of user inputs from latency alone.
Multi-exit networks let some inputs stop at intermediate exits to speed up inference. A cloud provider controlling the model supply chain can train one so that inputs with a sensitive property leave at a chosen exit, then spot them from latency. On four datasets the authors report an average F1 of 0.73 against 0.25 for the best baseline, with accuracy dropping by under 1.3%.
Why it matters. It is a timing side-channel that needs no access to the data: with third-party models in the cloud, encryption and input isolation are not enough. Model provenance becomes part of the privacy threat model.
For insurers. In outsourced AI services, data can leak with no visible breach, which complicates forensic reconstruction of a privacy claim. It is worth asking insureds who supplies and controls the models that handle sensitive data.
Read the paper · PDF · Code
2. AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents
arXiv · Ehsan Saleh, Roozbeh Nahavandi, Sama Salarian, Raef Bassily et al. · AI & LLM Security
In short: Deleting a record from an LLM agent's memory is not enough: the secret can often be recovered from derived state such as summaries or separate fragments.
AfterDeleteBench compares an agent exposed to a secret and then cleaned with an identical agent never exposed. A single query recovers the deleted secret from Qwen2.5-7B-Instruct in about two cases out of three. Even with no verbatim copy, reconstruction from separately stored components succeeds in 62-99% of cases on Qwen, Mistral and Phi-3. An exact-string filter does not remove them.
Why it matters. Deletion has to be treated as a property of the whole agent system, not as an operation on a single record. Literal filters give a false sense of security.
For insurers. An organisation using agents with memory may believe it has deleted personal data that is still recoverable. It is a topic for AI-use questionnaires and for claims involving data thought to be deleted.
3. AgentTriage: Replayable Security Diagnosis Across Heterogeneous Agent Runtimes
arXiv · Jie Ying, Xutao Zhang, Ningyuan Chen, Mengce Zheng et al. · AI & LLM Security
In short: AgentTriage reproducibly reconstructs, without LLM judgment, the security events caused by tool-using agents across different runtimes.
When an agent writes files, runs code or sends data, its answer does not explain the resulting security events. AgentTriage normalises traces from different runtimes, builds a provenance graph and binds each conclusion to recorded evidence, abstaining when evidence is missing. On 120 cases the authors report 0.858 grounded diagnosis and an unsupported-claim rate of 0.036.
Why it matters. As agents spread in companies, reconstructing what an agent did becomes an incident response problem. A reproducible, evidence-bound analysis is more defensible than an explanation generated by the model.
For insurers. In claims involving AI agents, reconstructing the chain of events verifiably matters for attributing causes. At underwriting it is reasonable to ask whether production agents record traces suitable for this analysis.
Read the paper · PDF · Code
4. Faster and Smaller Anonymous Credentials from Standardized Signatures
IACR Cryptology ePrint Archive · Chad Sharp, Paul Grubbs · Cryptography
In short: GordieHowe produces formally verified zero-knowledge proofs for anonymous credentials over ECDSA, RSA and ML-DSA, faster and smaller than Google's Longfellow.
Anonymous credentials prove an attribute, such as being of age, without revealing the document. GordieHowe builds them on standard signatures such as ECDSA, RSA and ML-DSA, with a certifying compiler and security theorems checked in Lean. The authors report proving an ECDSA-signed mobile driving licence in 64.8 ms, 10.1 times faster than Longfellow; with ML-DSA-44 it is 70.2 times faster.
Why it matters. Digital identities, from driving licences to European wallets, are already signed with standard schemes: adding privacy without changing the signatures makes selective disclosure practical. Formal verification and post-quantum security reduce the risk of bugs.
For insurers. The insurance link is indirect: anonymous credentials can reduce the personal data collected in identity checks, and therefore exposure in a breach.
5. Structural cryptanalysis of classic McEliece: Assessment of claims, costs and evidence
arXiv · Ramses Fernandez · Post-Quantum Cryptography
In short: Recent structural attacks on Classic McEliece are worrying, but their cost estimates depend on the model and no attack has been demonstrated.
In the past two years structural attacks on McEliece with Goppa codes advanced more than in the previous four decades; in September 2026 Germany's BSI advised against new deployments. The author separates proven results, conditional estimates and actual key recoveries. The main uncertainty is the cost model, with about thirty bits of spread, and no attack has been demonstrated.
Why it matters. Anyone assessing Classic McEliece for post-quantum migration gets a map of what is proven and what is not. It helps read the BSI advice with the data in hand.
For insurers. The case shows that even a post-quantum scheme considered mature can be called into question: in risk assessment what counts is the ability to replace an algorithm, crypto-agility. There is no practical attack, so no immediate impact on losses.
6. Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure
arXiv · Pellegrino Casoria, Simon Pietro Romano · Usable Security & Human Factors
In short: Social-HUMINT measures how far public social media content lets attackers profile a person and prepare tailored social engineering.
With LLMs, profiling someone from social media has become cheap and automatic. The authors merge SOCMINT and Cyber-HUMINT into an expert-validated taxonomy of 38 capabilities and turn it into a multi-agent pipeline tested on real participants' public data. They report extraction F1 of 97.3%, and the pipeline predicts people's choices among personalised approaches better than chance.
Why it matters. The work makes measurable a risk so far judged by intuition: employees' exposure to targeted social engineering. Defenders can measure their own exposure before an attacker does.
For insurers. Social engineering drives many fraud and business email compromise claims. A tool measuring the exposure of key people could complement training questions, but for now it is a research prototype.
7. Tritone: Pairwise Garbled Disputes for Multi-Party Proof Verification on Bitcoin
IACR Cryptology ePrint Archive · Oleksii Avramenko, Alessandro Baccarini, Torben Poguntke · Blockchain & DeFi
In short: Tritone lets Bitcoin release funds only against a valid Groth16 proof, replacing trust in a signing quorum with a single honest operator.
Federated Bitcoin bridges authorise withdrawals through a signing quorum that, if it colludes, can release the funds. Tritone extends the BABE protocol to a committee of N operators using garbled circuits and verifiable secret sharing, and runs on Bitcoin today without consensus changes. The authors prove it secure against up to N-1 corrupted operators and measure it on mainnet.
Why it matters. Bridges are among the most attacked components of the crypto ecosystem, and the recurring weak point is the signing quorum. With one honest operator enough, the surface for collusion or key compromise shrinks.
For insurers. For insurers of digital asset custodians or platforms, a bridge's risk depends largely on the signers' trust model. It remains research, with no data on real adoption.
8. Integer Coordinate Families and Threshold RSA Signatures for Any Prime Exponent
IACR Cryptology ePrint Archive · Shivansh Jaiswal, Somitra Sanadhya · Cryptography
In short: A threshold RSA signature scheme presented at CT-RSA 2026 admits trivial forgeries; the authors repair it and propose an alternative for any prime exponent.
At CT-RSA 2026 Ng and Lau proposed threshold RSA signatures based on integer coordinate families found by heuristic search. The authors show these families always exist and can be built efficiently, but that the scheme admits trivial forgeries and has a flawed proof. They propose the repaired scheme PiIC and PiZ, which works for any prime exponent, both secure under the standard RSA assumption.
Why it matters. Published security proofs can be wrong, and threshold schemes need review before adoption. Anyone assessing threshold RSA signatures for key custody now has a correct construction.
For insurers. The insurance link is weak: the broken scheme is recent and not known to be deployed, so there is no accumulation risk to flag.
9. Mímir: A Stateless Private Search Engine
IACR Cryptology ePrint Archive · Gökberk Erdoğan, Emma Munisamy, Kamil Kluczniak · Privacy
In short: Mímir is a stateless private semantic search engine based on RLWE that sharply cuts per-query communication compared with Tiptoe and PACMANN.
A private search engine returns documents similar to a query without revealing it to the server. Mímir uses homomorphic encryption, with security based on Ring LWE, and needs no offline communication. The authors report 84 times less per-query communication than Tiptoe at equal quality; against PACMANN it raises quality from 76% to 81% but is 2.1 times slower.
Why it matters. Private search serves services handling sensitive queries, from healthcare to legal advice. Less communication and no client state bring it closer to practical use on frequently changing databases.
For insurers. The insurance link is limited: it is a privacy-enhancing technology still at the research stage.
10. ReDence: A Hybrid Agentic and Decision-Model Framework for Rapid, Evidence-Grounded Detection of Modern Social Engineering Scams
arXiv · Jaishnoor Kaur, Josef Horáček, Ian Waskom, Sayak Saha Roy · Usable Security & Human Factors
In short: ReDence, an open-source framework with two local models, detects social engineering scams across twelve categories with 96% accuracy and evidence-based reports.
Spotting an online scam means following a site's workflows, checking claims and linking evidence across pages. ReDence gives the investigation to a local multimodal agent and the discrete decisions to a second, specialised model. The authors report 96% accuracy across twelve scam categories, better results than existing detectors and at least four times the speed.
Why it matters. For anti-fraud and takedown teams, shortening the time between discovery and removal of a scam site reduces victims. Verifiable reports let analysts check the decision.
For insurers. Social engineering scams drive fraud and credential theft claims, and faster takedowns can shorten campaigns. The results, however, come from the authors' own benchmark.
How this digest is made
New papers are collected every day and selected every week from arXiv, the IACR ePrint archive and the main security conferences and journals (IEEE S&P, USENIX Security, ACM CCS, NDSS, CRYPTO, PoPETs, IEEE TIFS and others). A score based on source, topic and early signals picks the candidates; an AI model assesses them and writes the summaries. Summaries are based on the abstracts: the original paper is the reference for details.
New papers assessed for this edition: 79.