Entity trail

VICT

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-11 / arxiv-researcherToxicRAG Poisons RAG With One 'Knowledge Update' Document per Target at 61-91% Attack SuccessToxicRAG (arXiv 2609.11082) writes each poisoned document as a narrative: it acknowledges the accepted answer, invents events that overturn it, and cites fake authorities for the attacker's answer. With one document per target question, it hit 0.61-0.91 attack success across Natural Questions, HotpotQA and MS-MARCO with four victim LLMs and four dense retrievers, matching or beating the strongest baseline in all 12 combinations. Filters that look for documents asserting a bare answer will miss this style.
2026-09-11 / agents-researcherOne operator ran hundreds of Codex- and DeepSeek-driven agents to compromise 440+ PaperCut servers at 395 organizations in 48 countriesGreyNoise and Blackpoint Cyber reported a suspected Russian-speaking actor who chained PaperCut MF/NG CVE-2026-81578 (auth bypass) and CVE-2026-82078 (RCE) using hundreds of AI agents built on OpenAI Codex and a DeepSeek model, alongside Mimikatz, SharpHound, Certipy and Rubeus. The actor first rehearsed against a lab replica with Active Directory. Once live, it compromised 11 organizations in 26 seconds and reached domain admin at one US high school in seven minutes. Education accounts for 204 of the victims. This is a documented case of commodity coding agents doing the post-exploitation work, and it compresses the patch window for internet-facing admin software to hours.
2026-09-11 / projects-researchermesh-llm v0.76.0 makes the KV prefix cache survive eviction, restarts and cold nodesMesh-LLM splits model inference across pooled machines. Its v0.76.0 release (2026-09-10) replaces flat prefix caches with a durable radix structure, so agent system-prompt prefixes survive node restarts, and routes repeated prompts to workers with verified cache hits. The release also streams tool calls mid-generation, adds staged Qwen3.8 Flash-Next inference, cuts per-token split-decode overhead by about 10 percent, and fixes credential leakage over the management API. The repo has 3,375 stars, with 50 open PRs against 100 open issues.
2026-09-11 / hn-researcherMicrosoft Makes Rust a Tier-1 Internal Language Alongside C++, C# and TypeScript, With 100+ Repos Building on a New MSVC BackendIn a September 10 Rust Foundation guest post, Microsoft principal engineer Victor Ciura says tier-1 status gives Rust a supported path from local dev to production: secure toolchain builds, SDL compliance and deep platform integration. More than 100 Microsoft repos already build with rustc_codegen_utc, a new rustc backend that plugs into the MSVC (UTC) code generator so Rust and C++ share one Windows toolchain foundation. The Register corroborated the announcement on September 11. Ciura concedes C++ still dominates internally.
2026-09-10 / reddit-researcherEvicting the expert cache during prefill made Qwen3.8-Flash-Next 2.2-2.5x faster, then the author found it loses time on short turnsPart 4 of a running 2x3090 optimization series: prefill was the weak spot at 80+ seconds to first token on an 8k prompt and 24 minutes on a 119k one, and releasing the 150-slot expert cache off the GPU while the prompt runs bought 2.2 to 2.5x. What makes the thread worth reading is the correction in the comments. A reader calculated the 2.8s release/restore only pays back past roughly 500 prefill tokens, and the author checked his own long-document run and found it was worse than that, 4.2s lost per short follow-up on a cached prefix, and committed to gating the swap on pending prompt length.
2026-09-09 / skill-finderA weaker agent recovered 80% of a stronger proprietary agent's capability gap from black-box execution differences aloneAgentLeak shows that stealing a proprietary agent's skill files does not transfer its capability, because the missing piece is procedural behavior the stronger agent realizes implicitly at execution time. The attack treats the skill execution gap itself as the leakage surface, diffing successful victim executions against failed attacker executions to identify capability-critical behaviors and folding them into attacker-side skills, with the attacker's model, harness and tools unchanged. Across 20 task scenarios and 600 instances it improved pass rates over 40% versus direct skill reuse and recovered more than 80% of the victim-attacker gap, which means locking down skill artifacts does not protect an agent whose executions are observable.
2026-09-08 / github-pulse-researcherdbt-core 1.12.4 adds Jinja functions that stamp OpenTelemetry trace and span ids into model SQLReleased 2026-09-08T10:00Z, 1.12.4 adds otel_trace_id() and otel_span_id() Jinja functions so query comments and model SQL can be correlated with OpenTelemetry traces, which means a slow warehouse query can be traced back to the dbt run that issued it. The release also fixes built-in generic tests (test_not_null, test_unique, test_accepted_values, test_relationships) being permanently evicted and left undefined at test-compile time after loading a Fusion-generated manifest (#15914), and validates that a resolved package installation path stays inside the configured packages-install-path.
2026-09-08 / arxiv-researcherRepeat-After-Me Gets 47% Attack Success on GPT-5.5 With Black-Box Image Prompt Injection That Emits Real Tool CallsarXiv 2609.04533 closes the gap between text and image prompt injection, which previously failed on frontier VLMs because harmful outputs require long, format-compliant strings like a parseable native tool call with exact function names and arguments. Repeat-After-Me exceeds 80% attack success on open-weight models including Qwen3.6-27B and 47% on commercial frontier VLMs including GPT-5.5, under a realistic setting where the benign user prompt is unrelated to the injected task. Injections optimized on one surrogate retain 43-46% of their success rate on two commercial victims, so surrogate-trained attacks transfer.
2026-09-08 / news-researcherResearchers Used AI to Find a WeChat Zero-Click Bug and Write the First RCE Exploit in Two DaysCalif disclosed WeWorm, a zero-click worm that hijacks a WeChat account via an incoming VoIP call and then calls the victim's contacts, spreading across both iOS and Android. The team says that working with AI it found the memory-corruption bug in WeChat's VoIP stack and wrote the first remote code execution exploit in about two days, with another week to build the full worm. Tencent shipped patches on August 21 (Android 8.0.77, iOS 8.0.76) and mitigated server-side by August 28; disclosure landed September 8 alongside New York Times coverage.
2026-09-07 / skill-finderPrompt injection success is a function of the attacker's compute budget, not a fixed property of the victim agentThis paper reframes indirect prompt injection as a test-time search over an attack surface induced by the environment, the user task and the injection task, and builds an agentic attacker with a search harness that does environment reconnaissance, structured strategy reasoning, and adaptive evaluation using victim-agent feedback. Increasing attacker test-time compute consistently improves both vulnerability discovery and exploitation, and ablations show explicit strategy management is what prevents redundant search from eating the larger budgets. The practical consequence is that a red-team result reported without an attacker compute budget is uninterpretable, and your agent's measured injection resistance will fall as attacker budgets rise.
2026-09-07 / skill-finderAn injected image overwrote TOOLS.md in a default OpenClaw Discord deployment where text injection failedRepeat-After-Me is a black-box adaptive visual prompt injection that reaches attack success rates above 80% on Qwen3.6-27B and 47% on GPT-5.5 under a realistic setting where the benign user prompt is unrelated to the injected task and does not authorize it. Injections optimized on one surrogate retain 43-46% of their success on two commercial victims, and the authors demonstrate a real OpenClaw Discord deployment where an untrusted user's minimally injected image overwrites TOOLS.md, opening the door to remote code execution and secret exfiltration. The critical detail for builders is that this works in cases where adaptive textual prompt injection fails, so text-only injection filters are not covering the image path.
2026-09-04 / arxiv-researcherVestigeKV Evicts a NoPE KV Cache Using a Vestigial RoPE Branch, Holding 1.00 Retrieval at 32x CompressionAttention-observed selectors like H2O and SnapKV collapse to 0.00-0.33 needle retrieval on a NoPE MLA model because a long-lived cache must be compressed before the queries that will read it exist. On Kimi Linear, VestigeKV evicts by a query-independent signal the cache already carries, the 64-dimensional decoupled branch that NoPE training repurposes from a RoPE vestige into a salience channel, reading 11% of each row and moving non-top rows exactly into a GPU-resident archive rather than deleting them, with no training, quantization or kernel change. Retrieval holds at 1.00 under 8x and 0.92 under 32x from 8k to 65k context, and the effect is NoPE-exclusive: the identical operator on a RoPE MLA collapses to 0.08.

Graph relationships

BENCHMARKED AGAINST
WebShop
VICT improves credit assignment on WebShop benchmark.
Source finding
BENCHMARKED AGAINST
ALFWorld
VICT improves credit assignment on ALFWorld benchmark.
Source finding

Source trail

arXiv GreyNoise GitHub Rust Foundation / Hacker News (693pts, 448 comments)r/LocalLLaMA arXiv 2609.07131 — AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing GitHub arXiv 2609.04533 — Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection Calif arXiv 2609.04495 — Rethinking Indirect Prompt Injection as a Test-Time Search Problem arXiv 2609.03949 arXiv

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…