Tencent Zhuque Lab evaluated DeepSeek Harness against prompt injection via A.I.G across 14,560 runs. Risks span attack expressions, file representations, and Skill assets, with high success rates in fake completions, hidden Unicode, and Skill vectors.
Read Full Article arrow_forward
SCTPhantom is a Linux kernel use-after-free in SCTP's dynamic address reconfiguration code.
Read Full Article arrow_forward
This article breaks down the end-to-end attack chain of Memory Heist and demonstrates how to automate its detection using the Agent Security Scanning module (agent-scan) in AI-Infra-Guard (A.I.G).
Read Full Article arrow_forward![[Open Source] A.I.G Releases Agent Security Drill SKILL](https://secbench-1258476245.cos.ap-guangzhou.myqcloud.com/zhuque-blog/2026/06/1782718349166-fa6e7ec9802db322.png)
AI Agents gain access to tools, code execution, and business systems, risks such as prompt injection, jailbreaks, and tool abuse can lead to data leaks, system compromise, or business tampering. Tencent Zhuque Lab open-sources the A.I.G Agent Security dirll Skill to help developers and business teams run lightweight, local, and systematic security tests before launch.
Read Full Article arrow_forward
The Chinese University of Hong Kong, Shenzhen, in collaboration with Tencent Zhuque Lab, has released SkillTrustBench, the first safety evaluation benchmark for Agent skills.
Read Full Article arrow_forward
Zhuque Lab’s Red Teaming Bot—an automated vulnerability discovery and adversary simulation platform powered by multi-agent orchestration—successfully conducted rapid security audits on targets including OpenClaw and the Linux kernel.
Read Full Article arrow_forward
Tencent Zhuque Lab recently uncovered widespread security vulnerabilities in popular AI tools, including DeepSeek. If left unmitigated, these flaws could allow attackers to exfiltrate sensitive user data, hijack computational resources, or even gain full control over user devices.To address these threats, we will demonstrate how to use the open-source toolkit AI-Infra-Guard to perform one-click detection and effectively remediate these security risks.
Read Full Article arrow_forward
This article exposes the supply chain security risks hidden within Agent Skills used by AI coding assistants. Research highlights how attackers can weaponize seemingly benign plugins—such as GIF makers or calculators—to steal sensitive keys, deploy ransomware, or establish remote control via "hidden prompts," malicious scripts, or authorization flaws. Since traditional security tools struggle to detect these NLP-based threats, Tencent's Zhuque Lab has introduced A.I.G, an open-source platform that uses "AI to scan AI," providing automated auditing and risk mitigation to build a safer Agent ecosystem.
Read Full Article arrow_forward