Your Guardrails Are Now the Attack Surface — and the Threat Moved Below the Prompt

This digest covers AI security developments from 2026-11-08 to 2026-11-15: new arXiv research on agent and LLM attacks/defenses, an Anthropic methodology piece on safety evaluations, and an updated OWASP guide for securing agentic applications. Simon Willison's blog and Embrace The Red had no new posts in this window.

🔥 Highlights

1. Hijacking a Trusted LLM in Real-World Quantized Deployments Only Requires a Disguised Adapter — a LoRA adapter that looks clean until you quantize it.
2. Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents — a sleeper agent planted by editing under ten neurons.
3. When Safety Becomes an Attack Surface: Manipulating Abstention in Tool-Using AI Agents — your refusal mechanism can be weaponized against you.
4. CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts — a defense that doesn't trust the small model to write its own policy.
5. Securing Agentic Applications V2 — OWASP's refreshed builder-and-defender checklist for agent systems.

arXiv (cs.CR, cs.CL)

CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts — 2026-11-12
Existing agent defenses like CaMeL, Progent, IPIGuard, and DRIFT ask the small model itself to author the security artifact (a policy or dependency graph), but the authors show 1.7B–12B models aren't reliable enough for that — CaMeL fails to produce an executable program in up to 68% of episodes. CapLite instead derives the policy directly from the tool schema and locks write-arguments before any tool result is read, hitting zero successful attacks across 13,935 AgentDojo episodes while using only 18% of CaMeL's tokens. Directly useful for anyone running agents on small or cheap models where model-authored security logic isn't trustworthy.

MobileProbe: Adaptive Security Evaluation of Mobile Agents via Trajectory-Aware Injection — 2026-11-12 (accepted at NDSS 2027)
An adaptive red-teaming framework for mobile GUI agents: instead of fixed, hand-written payloads, it discovers attacker-controllable UI surfaces and evolves payloads through a surrogate-guided evolutionary loop. Across 83 long-horizon attack instances spanning 12 apps, it beats human and zero-shot LLM baselines on success rate. A useful process model for teams that need to audit GUI/mobile agents before deployment, beyond classic text-based prompt injection.

Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents — 2026-11-11
By editing fewer than ten neurons — no retraining required — the authors build a "sleeper agent": in Nemotron-Terminal-8B, 7 edited neurons trigger the payload in ≥98.8% of triggered trajectories with no leakage on benign traffic, and the attack transfers to Qwen3.6-27B and Gemma-4-31B-IT. It shows pre-deployment weight auditing, not just prompt auditing, needs to be part of the security pipeline — agent-built defenses did catch 91.4% of edited checkpoints, which is itself a practical mitigation data point.

Hijacking a Trusted LLM in Real-World Quantized Deployments Only Requires a Disguised Adapter — 2026-11-11
Introduces QHijack-LoRA: a third-party LoRA adapter that passes clean when audited against the full-precision base model, but activates malicious behavior only after the quantization used in production — without touching the base model or knowing the victim's quantization config. The direct practical implication: adapter audits need to happen against the actual deployment configuration (quantized), not the full-precision checkpoint.

When Safety Becomes an Attack Surface: Manipulating Abstention in Tool-Using AI Agents — 2026-11-11
An availability attack: fabricated risk warnings planted in low-trust content push the agent into over-abstention, refusing legitimate tasks. On one tested model (Gemini), induced abstention rose from 9.8% to 86.3% under "caution-first" prompting, while clean tasks stayed unaffected. Relevant because it shows well-intentioned safety guardrails are themselves an attack surface — the paper proposes a "Verify-Before-Abstain" check as mitigation.

Intent-Aware Protection for AI Agents — 2026-11-12
Rather than detecting only prompt injection or harmful output, this treats an agent's declared "intent" (its org/role/dev profile) as a security object, detecting "Intent Drift." On an 887-sample benchmark across 35 agents, the profile-based approach raises F1 from 45% to 79% (out-of-scope F1 from 8% to 76%), and reaches 0.949 AUROC against 0.909 for AlignmentCheck on 10k+ AgentDojo trajectories. Adds a defense axis — purpose deviation — that traditional guardrails don't cover.

Synthesis Smuggling: Maliciously Hiding Inferred Personal Attributes in LLM Outputs — 2026-11-12
A new exfiltration threat model: an adversarial LLM infers sensitive user attributes (age, gender) from routine requests and encodes them invisibly (invisible characters, word choice) inside normal generated text — an email, a post — that the user later shares themselves. An attacker monitoring those public channels extracts the data without the model needing any direct output channel. A reason to audit third-party/fine-tuned model outputs for covert channels, not just toxic content.

Protecting Sensitive Knowledge Under LLM Unlearning: The Proxy Threat and a Superposition-Aware Defense — 2026-11-11
Shows legitimate unlearning requests can erase sensitive entities that were never the target, due to representation overlap in parameter space ("knowledge superposition") — the "Proxy Unlearning Attack." Proposes SAUP, a two-phase defense (pre-unlearning detection plus post-unlearning decoupling/recovery). Relevant for any team offering unlearning as a compliance/privacy feature: the removal mechanism itself is an attack vector.

Simon Willison (prompt-injection tag)

Nothing new in this window — the most recent prompt-injection-tagged post predates the coverage period, and nothing else on the blog in the window touches LLM security.

Anthropic Engineering / Research

Building strong safety evaluations — 2026-11-13
Anthropic lays out methodology for designing and reporting AI safety evaluations: multidisciplinary eval teams, multi-turn scenarios that mirror real user behavior instead of single-turn toy prompts, grader calibration against human labels, preregistration, full statistical reporting with confidence intervals, and responsible disclosure of eval flaws. Directly actionable for any team building an internal red-team or safety-eval harness — it's a checklist for making your eval numbers trustworthy rather than security theater.

Embrace The Red

Nothing new published in this window.

OWASP LLM Top 10 / GenAI Security Project

Securing Agentic Applications V2 — 2026-11-10
An updated practical guide covering secure architectures for single- and multi-agent systems, threat mitigation, identity/access controls, runtime protection, supply-chain security, and assurance testing for agentic AI. Practical value: a concrete control checklist (identity, runtime, supply chain) for teams actually deploying agents, not just another risk taxonomy — useful alongside the OWASP Top 10 for LLM/Agentic Apps as a build-time reference.

NVIDIA / guardrail tooling blogs

Nothing with clear security-technical substance published in this window — the most recent tagged security post predates the coverage period.

Through-line

Three independent arXiv papers this week point the same direction: attacks are moving past the prompt and into the infrastructure around the model. A backdoor can live in seven edited neurons, a malicious adapter can hide inside the quantization step rather than the weights an auditor actually checks, and even the refusal/abstention mechanism meant to keep an agent safe can be turned into a denial-of-service lever. Meanwhile the defense side (CapLite, Anthropic's eval methodology, OWASP's updated agentic guide) is converging on the same fix: stop trusting the model to police itself — derive policy from schemas, verify against the real deployment config, and calibrate evaluations against humans, not vibes.

What's catching your eye this week — the quantization-triggered backdoor, or the abstention-as-DoS angle? Drop a comment below.