hackerlogs: AI Red Teaming https://hackerlogs.com/topics/ai-red-teaming Methodology, tooling, and reporting for adversarial testing of AI systems, from scoping through to remediation. en Tue, 08 Sep 2026 00:00:00 GMT 0.00 Is a Lab Number. Grok's Incident Standard Is Still Missing. https://hackerlogs.com/blog/grok-420-safety-eval-standards https://hackerlogs.com/blog/grok-420-safety-eval-standards Tue, 08 Sep 2026 00:00:00 GMT Ajain Vivek xAI's April 2026 Grok 4.20 system card reports a 0.00 chat-mode violation rate on an internal refusal set. The same PDF reports 0.30 on AgentHarm and 0.33 on AgentDojo. Those are lab measurements, not an incident standard. A 2025 production failure, the January 2026 DSA case on Grok-in-X, and California AB 316 already bind operators.

Key takeaways

  • The 0.00 figure is xAI's internal chat refusal set. AgentHarm on the same card is 0.30. Brief the PDF, not the headline rate.
  • xAI names third-party testers and does not identify them. A lab number no one else can rerun is a claim, not a standard.
  • The July 2025 production incident was a config regression, live for about 16 hours. A card published nine months later does not close that clock.
  • The Commission opened a DSA case on Grok-in-X and the recommender on 26 January 2026. That is a platform duty, not a model-card duty.
  • California AB 316 already bars the defence that the model caused the harm by itself. SB 243 already requires a companion-chatbot self-harm protocol.
]]> ai-governance ai-red-teaming llm-app-security WeWorm Took WeChat Over While the Phone Rang. Tencent Closed It. https://hackerlogs.com/blog/weworm-wechat-zero-click https://hackerlogs.com/blog/weworm-wechat-zero-click Tue, 08 Sep 2026 00:00:00 GMT Ajain Vivek WeWorm is Calif's demo of a zero-click WeChat account takeover. An incoming call from a friend-list contact was enough; the victim did not have to answer. Calif says AI found the VoIP-stack memory bug and a first RCE in two days, then spent a week on a three-phone worm. Tencent mitigated the exploit for all users by 28 August.

Key takeaways

  • The demo is an unanswered WeChat call from a friend-list contact. Answering hears silence. Declining stops that attempt. The caller can try again later.
  • Calif showed three phones: a Pixel 10a took an iPhone 17e while it rang, then that iPhone took a second Pixel the same way. That is a lab worm, not a reported outbreak.
  • Tencent shipped Android 8.0.77 and iOS 8.0.76 on 21 August. Calif says a server-side block covered all users by 28 August. Tencent has not published an advisory or a CVE.
  • Calif is holding the VoIP-stack details for a conference. There is no IOC a user can search, and no way to tell whether a past missed call was this bug.
  • The Times headline says models built a worm. Calif's own clock is narrower: AI to first RCE in about two days, then a week of human work on the demo.
]]> ai-red-teaming llm-app-security Build an Indirect Prompt Injection Lab in Thirty Minutes https://hackerlogs.com/blog/indirect-injection-lab https://hackerlogs.com/blog/indirect-injection-lab Thu, 03 Sep 2026 00:00:00 GMT Ajain Vivek An indirect prompt injection lab needs three parts: a retriever that fetches attacker-controlled text, a model that treats retrieved text as instructions, and a tool the model can call to prove impact. Build all three locally with a poisoned document, a small model, and a fake exfiltration endpoint, then replay one payload against each defence to see which hold.

Key takeaways

  • Reading about indirect injection convinces nobody; a working demo against your own stack ends the argument in one meeting.
  • The lab needs a side effect, not just a rude answer, because impact is what turns a demo into a funded remediation.
  • Run the identical payload against each defence in turn, so you measure the control rather than your own improvisation.
  • Input filtering blocks your first payload and fails against the second, which is the point the lab exists to make.
  • Removing the model's ability to reach the network changes the outcome where prompt hardening does not.
]]> prompt-injection ai-red-teaming