RESEARCH
RSA-2048 on 23,000 cat qubits; prompt injections in README files hit agents harder
An estimate of Shor's algorithm on cat qubits puts RSA-2048 factoring at about 23,000 physical qubits and 3.14 days, under explicit hardware assumptions. On LLM agents, prompt injection works better hidden in README and TODO files, and role spoofing impersonates the user. The other papers measure the gap between tests and reality, from malware benchmarks to industrial detectors.
1. Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days
IACR Cryptology ePrint Archive · Axel Pappalardo, Dahmun Goudarzi, Victor Hertz, Hugo Jacinto et al. · Post-Quantum Cryptography
In short: Factoring RSA-2048 with Shor's algorithm would take about 23,000 cat qubits and 3.14 days, according to an end-to-end estimate with explicit hardware assumptions.
The authors estimate the resources to run Shor's algorithm on superconducting cat qubits, down to qubit layout on the chip. Under explicit assumptions, including no bit-flips, RSA-2048 needs about 23,000 cat qubits and 3.14 days. ECDLP on secp256k1 needs at most 30,000 qubits and one hour. Without the bit-flip assumption, RSA-2048 rises to about 45,000 qubits.
Why it matters. The estimate sharply lowers the physical-qubit count thought necessary to break RSA-2048 and secp256k1, although it relies on hardware not yet available. It gives concrete input for planning post-quantum migration.
For insurers. "Harvest now, decrypt later" risk on data encrypted today with RSA or ECC depends on estimates like this one, so underwriters can reasonably ask whether insureds have a cryptographic inventory and a migration plan. A quantum attack on RSA or ECC would by nature be an accumulation event, hitting many insureds at once.
2. Where You Inject Matters: The Trust Region Effect in LLM Agents
arXiv · Chengquan Guo, Xiaodong Liu, Weiwei Yang, Mingqian Feng et al. · AI & LLM Security
In short: Where a prompt injection sits matters: a GPT-5.4 agent follows instructions in README or TODO files 2.6 times more often than in code.
Work on indirect prompt injection has focused on the content of malicious instructions. The authors measure instead the effect of their placement, across three agent testbeds. Agents trust some regions more than others, an effect they call the "trust region". A GPT-5.4 agent follows an instruction in a README or TODO 2.6 times more often than in a code or data file.
Why it matters. For anyone running coding agents on third-party repositories, documentation files are a privileged attack surface, not harmless content. Defenses and red teams should test injections across placements, not only with different payloads.
For insurers. For insureds running coding agents on external or open-source code, code review alone is not enough: README and TODO files are untrusted input too. Underwriting questionnaires on AI-agent use can ask what permissions agents hold when reading unvetted repositories.
3. Feistel-Like Structures Revisited: Classification and Cryptanalysis
Journal of Cryptology · Bo Yu, Zejun Xiang, Bing Sun, Zhengyi Dai et al. · Cryptography
In short: A broad class of Feistel-like structures, including those of SM4 and MARS, is self-equivalent, with exact bounds for impossible-differential and zero-correlation distinguishers.
This Journal of Cryptology paper studies Feistel-like structures used in block ciphers. The authors prove that a broad class of structures, including those of SM4 and MARS, is self-equivalent. For the d-branch SM4-like structure, the longest impossible differential and zero-correlation linear hull cover exactly 3d-1 rounds. No attacks on specific ciphers are reported.
Why it matters. Exact bounds on structural distinguishers help block-cipher designers set round counts with known margins. For cryptanalysts, the classification unifies structure families previously studied separately.
For insurers. The result is theoretical and points to no practical weakness in SM4 or MARS, so it has little direct bearing on cyber insurance.
4. Understanding and Mitigating Role Spoofing in LLMs
arXiv · Ezra Edelman, Benjamin Edelman, Surbhi Goel, Eran Malach · AI & LLM Security
In short: Malicious text in tool outputs can impersonate the user by mimicking style and structure; content-only adversarial training falls short, while linear probes detect it.
LLMs can attribute text to the user based on its style rather than its labeled role. The authors call "role spoofing" the attack that exploits this confusion from tool outputs, such as a web page. Attacks faking both structure and content are highly effective. Adversarial training on content alone leaves structure exposed. Linear probes trained on roles detect the spoofing.
Why it matters. The work explains why frontier models that resist many injections remain vulnerable when attackers mimic message structure. Defenses must consider formatting and control tokens, not only what the text means.
For insurers. Vendor assurances on prompt-injection resistance may not cover structure-based attacks. This is a limit to weigh when an insured relies on those assurances for agents with access to sensitive data or actions.
5. Difficulty Calibration Across Time for Membership Inference in Diffusion Models
arXiv · Michael Joseph, Yedid Hoshen · AI & LLM Security
In short: Calibrating image difficulty over time makes membership inference attacks on diffusion models far more reliable.
Membership inference attacks test whether an image was in a diffusion model's training data. The standard method errs because some images are simply easier to reconstruct. The authors propose two calibrations: one compares the model with an earlier checkpoint, the other compares different points of the diffusion process. The authors report that both beat the state of the art.
Why it matters. More reliable auditing tools make it possible to check whether sensitive or protected data trained a generative model. For model publishers, it becomes more likely that memorization of training data can be proven.
For insurers. More accurate audits make it easier to prove that private or protected images were used in training. This may affect the frequency and outcome of privacy or copyright claims against firms that develop or fine-tune generative models.
Read the paper · PDF · Code
6. DualGuard: Comprehensive and Efficient Memory Safety across Sequential and Speculative Execution
arXiv · Sixuan Dang, Quan Zhou, Kaiming Huang, Jianan Zhu et al. · Systems & Software Security
In short: DualGuard combines memory-safety defenses for normal and speculative execution without redundancy, with 3-72% lower overhead.
Memory-safety protections can be bypassed during speculative execution, while defenses such as Speculative Load Hardening do not cover normal execution. Combining them naively adds redundant protection. DualGuard classifies memory behaviors and finds the minimal combination covering both cases. Implemented in LLVM, it cuts overhead by 3-72% compared with naive combinations.
Why it matters. The work, accepted at NDSS 2027, addresses the fact that memory safety and Spectre defenses are usually evaluated separately. Lower overhead is the precondition for deploying both protections in real software.
For insurers. The insurance link is indirect: a product's claimed memory safety may not hold during speculative execution. This is a limit of hardening controls to keep in mind in technical risk assessment.
7. Measuring Duplication, Leakage, and Rendering Dependence in Malware-as-Image Benchmarks
arXiv · Stefan Larson, Kevin Leach · Malware & Threat Intelligence
In short: Benchmarks that classify malware as images contain duplicates and train-test leakage: removing them cuts accuracy by up to 8 points.
Classifying malware rendered as images yields claimed accuracies of 97-99%. The authors audit ten standard benchmarks and find duplicates and train-test leakage: distinct binaries render to identical images, so hash-based deduplication is not enough. Deduplicating on content lowers top-1 accuracy by up to 8 points and macro-F1 by up to 15.
Why it matters. Many published results in this line of work likely overstate real performance. Changing only the row width of the image, without altering a byte, reduces accuracy by 20-33 points.
For insurers. Claimed performance of ML-based malware detection can be inflated by flawed benchmarks. When an insured or vendor cites accuracy near 99%, it is worth asking on which data and with what train-test separation it was measured.
8. We Want to Quit but Can’t : Understanding Organizational Flawed Decision Makings on Email Security Practices
ACM Digital Threats — Research and Practice · Yuya Shibuya, Daishi Kondo, Rie Shigetomi Yamaguchi, Tomohiro Ishihara et al. · Usable Security & Human Factors
In short: Japanese companies keep sending password-protected ZIP files with the password in a separate email because the measure is visible and expected by partners, not because it works.
In Japan, companies commonly send a password-protected ZIP file with the password in a separate email over the same channel. Anyone who reads both messages can decrypt the attachment. Through a large-scale survey and interviews, the authors find that the measure's visibility outweighs its effectiveness. Pressure from competitors and partners keeps it in use.
Why it matters. The work shows how a security measure survives because it is visible and socially expected, not because it works. Designers of controls must account for these organizational and supply-chain dynamics.
For insurers. A measure that only looks protective can appear among the controls declared in an underwriting questionnaire without reducing risk. Encrypted attachments can also hamper malware inspection, so it is worth asking how confidential attachments are actually protected.
9. Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant
arXiv · Benjamin Blakely · CPS & IoT Security
In short: Eleven industrial anomaly detectors work on a simulator but collapse on real plant data; sequential valve manipulation evades all of them.
Industrial anomaly detectors are mostly evaluated on simulators. The author tests eleven on a simulated chemical process and a real sodium thermal-hydraulic facility, with attacks built against a threat model and a fixed false-alarm budget. On the simulator they look ready to deploy; on the plant detection collapses. Sequential valve manipulation evades them all.
Why it matters. Simulator results do not predict performance on a real plant, especially at a realistic false-alarm rate. Slow, sequential attacks on actuators remain a blind spot for every detector family tested.
For insurers. For industrial and OT risks, process anomaly detection is a control not to overestimate: performance measured on simulators may not hold on real plants. Gradual valve manipulation can go unnoticed until it causes physical damage or business interruption.
10. Integrating Perception, Comprehension, and Projection for Alert Validation: A Unified Cyber Situational Awareness Framework
arXiv · Navodika Karunasingha, Mohan Baruwal Chhetri, Surya Nepal, Cecile Paris et al. · AI for Security
In short: For SOC alert validation, causal attack context improves results substantially, but adding ever more context does not help.
SOCs must validate many alerts with few analysts, and the context to tell whether activity is an attack is often missing. The authors compare three levels of situational awareness: perception, comprehension and projection. On the DARPA TC dataset, comprehension, which adds causal context, improves Recall@5 by up to 28.6 and 75 points. Projection helps only in some cases.
Why it matters. The result argues for enriching alerts selectively, according to what validation needs. For SOCs it supports provenance-based analysis.
For insurers. The insurance link is indirect: faster alert validation may shorten detection times. The results, however, come from a research dataset and do not yet show how a real SOC's performance would change.
How this digest is made
New papers are collected every day and selected every week from arXiv, the IACR ePrint archive and the main security conferences and journals (IEEE S&P, USENIX Security, ACM CCS, NDSS, CRYPTO, PoPETs, IEEE TIFS and others). A score based on source, topic and early signals picks the candidates; an AI model assesses them and writes the summaries. Summaries are based on the abstracts: the original paper is the reference for details.
New papers assessed for this edition: 81.