Vulnerability Research on Jorge Laurel

When an AI Assistant Stores a False Memory

Tue, 14 Jul 2026 21:10:17 +0000

A single email can lead an AI assistant to record something false about a user, without disclosing that it has done so, and then draw on that false record in later sessions. The technique requires no stolen password and no account access. It relies only on a message sent to an inbox the assistant is configured to read.

Researchers describe the technique, which they call stealth memory injection, in a paper posted to arXiv on 6 July 2026, titled “When Claws Remember but Do Not Tell.” They built a tool called MemGhost that generates the attack emails, and a benchmark called WhisperBench to measure how often it succeeds. The findings are relevant to teams, and individuals, considering agentic assistants in a production or private environment.

Vulnerability Exploitation Is Moving Faster. What the 2026 Time-to-Exploit Data Shows

Fri, 26 Jun 2026 16:46:24 +0000

Average time from vulnerability disclosure to working exploit has dropped from roughly 125 days in early 2025 to under a day by April 2026, across an analysis of approximately 69,000 CVEs. Some vulnerabilities are now exploited before patch advisories are published. The assumptions most patch management processes were built on may no longer hold.

For most of the last two decades, vulnerability management rested on a quiet assumption: between the moment a flaw became public and the moment an attacker could use it at scale, defenders had a usable buffer. Days, often weeks. Enough time to test, stage, and deploy a patch or patches. A lot of process was built on top of that buffer.

The Code Looks Fine. That's the Problem.

Thu, 04 Jun 2026 08:15:24 +0000

There is a version of this story that sounds like hype. Chinese AI models are secretly inserting backdoors into American software. Hackers are hiding in your IDE. The threat is invisible and everywhere.

That version is wrong, and it is worth saying so clearly. Booz Allen Hamilton, which published this research in May 2026, does not claim intentional sabotage. The report is careful about that. What it does claim, backed by more than 2,800 test trials across five frontier models, is something more unsettling in its own way.