Tom Bonner

SVP of Research @hiddenlayersec.

Formerly Norman, HP, Cylance, BlackBerry. All views are my own.

[Dark Web Informer @DarkWebInformer]

CVE-2026-45829: ChromaToast Served Pre-Auth Demo

Demonstration of CVE-2026-45829 from the "ChromaToast Served Pre-Auth" blog.

[BleepingComputer @BleepinComputer]

Max-severity flaw in ChromaDB for AI apps allows server hijacking
https://t.co/HdMK2M4S3v

https://t.co/HdMK2M4S3v

[BleepingComputer @BleepinComputer]

Fake OpenAI repository on Hugging Face pushes infostealer malware
https://t.co/Ec5fRW9SbW

https://t.co/Ec5fRW9SbW

[Jim Simpson @4a696d]

So this one has been a while coming. If you've seen any of the talks or workshops I've done recently you'll have heard me talking about the way we are thinking about attacks on generative AI. Well, it's finally here.
https://t.co/7LCM2JQQ8R

[Tom Bonner @thomas_bonner]

Announcing our latest attack technique, "Policy Puppetry" - a single, transferable prompt blending structured policy & roleplay that bypasses alignment in frontier AI models. Game-changing for red-teaming!

#AI #GenAI #RedTeam #CyberSecurity

https://t.co/5GOeYtq9mf

[HiddenLayer @hiddenlayersec]

HiddenLayer researchers uncovered a malicious version of the Android #DeepSeek - #AI Assistant app recently uploaded to a popular #malware scanning service.

[Tom Bonner @thomas_bonner]

Our latest research, modifying the computational graphs of neural networks to introduce backdoors, has been extremely interesting. In this blog, we've targeted ResNet, YOLO, and Phi-3 models, using different triggers and payloads.

#AI #CyberSecurity

https://t.co/5JZTekAQdU

[SecurityWeek @SecurityWeek]

ShadowLogic Attack Targets AI Model Graphs to Create Codeless Backdoors https://t.co/lThpdcthPq

[HiddenLayer @hiddenlayersec]

Today, we publicly disclosed 14 new CVEs across three critical machine learning projects. These vulnerabilities highlight the importance of proactive security in AI and reinforce our commitment to safeguarding the future of machine learning.

👉 https://t.co/qfQNEHFjjD

[HiddenLayer @hiddenlayersec]

🚨 New Research: AI’ll Be Watching You

Our team recently presented this cutting-edge research at @aivillage_dc 2024. This blog takes a deep dive into the security of edge AI devices, starting with the widely used Wyze Cam 👉 https://t.co/VT1az0PY4O

#EdgeAI #AIResearch

[Costin Raiu @craiu]

Small thread about my experience YARA-X, version 0.3.0 fresh beta, courtesy of @plusvic

[Abraxus @Abraxus7331]

I'm incredibly excited to announce that I will be speaking with @thomas_bonner this August at #BHUSA. If you enjoyed the research on R this week come check out our talk to see even more! https://t.co/fqVAHQ8Pi1

[The Hacker News @TheHackersNews]

👨‍💻🔐 A new security #vulnerability (CVE-2024-27322) has been discovered in the R #programming language. It could allow attackers to execute arbitrary code through malicious RDS files, exposing your projects to supply chain attacks.

Read: https://t.co/N3Vkj9lFdY

#cybersecurity

[Tom Bonner @thomas_bonner]

Very nice work from @Abraxus7331 and @KieranEvans89 in discovering CVE-2024-27322, a vulnerability in R's deserialization library that can lead to "R-bitrary" code execution when deserializing untrusted data.

https://t.co/6zmEpywfTD

[HiddenLayer @hiddenlayersec]

🎉 We are proud to present the first-ever HiddenLayer AI Threat Landscape Report! Get your copy TODAY to see our survey insights, risks related to the use of #AI & security recommendations for the next 12 months.

Learn more 👉 https://t.co/spNxlGNDio

[Trail of Bits @trailofbits]

Fickling gets powerful new upgrades: a modular analysis API and PyTorch and Polyglot modules. Enhance threat detection and analysis across your ML workflows.
https://t.co/NOyfA3KbJa

[The Hacker News @TheHackersNews]

🤖 Security researchers have uncovered a new #vulnerability in Hugging Face's Safetensors conversion service that could lead to supply chain attacks, compromising user-submitted models.

Read details: https://t.co/93WZx7DRnP

#cybersecurity #hacking #technews

[Tom Bonner @thomas_bonner]

Our researchers discovered that the Hugging Face PyTorch to Safetensors conversion service could easily be compromised by attackers, who could tamper with models and leak the token used to create pull requests from the official bot.

https://t.co/W9gc9bHEAE

[HiddenLayer @hiddenlayersec]

📅 SAVE THE DATE: HiddenLayer’s 2024 AI Threat Landscape Report will be released on March 6th. Sign up to be the first to preview the report & join us in a webinar discussion as we share some of the report’s most important findings 👉 https://t.co/MlwpyrpJAF

#Security4AI

[HiddenLayer @hiddenlayersec]

In our SAI team's latest blog, they discuss and demonstrate how easily preventable, high-impact vulnerabilities known in the security industry for years plague widely used #AI infrastructure 👉 https://t.co/46JwzKZaEn

#securityforai #hiddenlayer #mldr #adai #cybersecurity