2026-07-29 AI 与数据工作流雷达
来源：The Hacker News。这里只保留与 AI 编程、数据工作流或安全边界相关的候选线索；不抓取全文，也不代表事实核验或产品推荐。
Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack
主题：AI 与数据安全
来源日期： Jul 28, 2026
候选状态：待评估
为什么值得看：命中与个人工作流相关的 AI/数据主题；需要阅读全文判断是否具备临床编程、研究或可复现分析价值。
Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic’s released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server. The AES result removes a 256-way guessing step from an existing meet-in-the-middle attack. Anthropic said neither result affects production systems. HAWK remains a candidate in a National Institute of Standards and Technology (NIST) post-quantum standardization process, and the public recovery code only targets the smaller HAWK-256 parameter. The Advanced Encryption Standard (AES) result applies to seven of AES-128’s ten rounds and still requires an impractical number of chosen plaintexts. The company said no production software needs to change as a result. Anthropic published…
可转化方向：评估 AI 辅助研究和编程中的隐私、供应链与安全边界
JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
主题：AI 与数据安全
来源日期： Jul 28, 2026
候选状态：待评估
为什么值得看：命中与个人工作流相关的 AI/数据主题；需要阅读全文判断是否具备临床编程、研究或可复现分析价值。
JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is JFrog’s software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for cloud and self-hosted customers. The Artifactory exploit occurred inside OpenAI’s environment. OpenAI says a separate attack path later reached Hugging Face’s systems. JFrog says its cloud customers are already protected. Self-hosted users should review the Artifactory release notes and move to the remediating build for their maintained branch. Several Artifactory CVE records were published on July 27 with affected-version ranges and fixed-version thresholds, but neither JFrog nor OpenAI has said whether any of those records correspond to the vulnerabilities used during the evaluati…
可转化方向：评估 AI 辅助研究和编程中的隐私、供应链与安全边界
Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
主题：AI 与数据安全
来源日期： Jul 28, 2026
候选状态：待评估
为什么值得看：命中与个人工作流相关的 AI/数据主题；需要阅读全文判断是否具备临床编程、研究或可复现分析价值。
STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel’s network traffic-control subsystem. Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local privilege escalation, not remote code execution, so an attacker needs a foothold on the machine before any of it applies. The demonstrated exploit also requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER kernel options, and a kernel-specific return-oriented programming (ROP) chain containing hardcoded offsets. Those conditions narrow the immediate exposure, but full exploit source code is now public. The upstream fix landed on June 1, 2026, and has since been backported to several stable kernel branches. The Linux CNA record lists vulnerable ranges begi…
可转化方向：评估 AI 辅助研究和编程中的隐私、供应链与安全边界
NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
主题：数据工作流与自动化 / AI 与数据安全
来源日期： Jul 27, 2026
候选状态：待评估
为什么值得看：命中与个人工作流相关的 AI/数据主题；需要阅读全文判断是否具备临床编程、研究或可复现分析价值。
NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents. The 37-member group spans cloud, security, enterprise software, and AI companies, including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation. Its stated scope covers the full agent stack, including identity, permissions, isolation, guardrails, logs, model formats, multi-model scanning, and secure coding workflows. The pitch is that cyber defenders need AI models they can read, change, and run on their own hardware, not only closed systems reached through a vendor’s application programming interface (API). The launch also brings its first named technical contribution: NVIDIA-labs OO Agents (NOOA) , an Apache 2.0 research framework designed to make agent behavior easier to test, trace, audit, and govern. The laun…
可转化方向：评估对可复现分析、依赖管理或数据质量流程的启发；评估 AI 辅助研究和编程中的隐私、供应链与安全边界