Local LLMs Enable Scams by Drafting Fraudulent Replies Without Warnings
Local language models running on ordinary gaming laptops can be tricked into helping scammers by simply asking them to write messages instead of asking whether a conversation is fraudulent.
The experiment used three openly available 7-8B models: Llama 3.1 8B, Qwen 2.5 7B and DeepSeek-R1 8B, executed through Ollama on an RTX 5050 notebook with no internet connection. Forty-two scam dialogues covering twelve common Kazakhstan fraud patterns were presented not as detection questions but as requests to draft polite replies agreeing to advance payments.
Without protection the models almost never refused. Llama 3.1 8B issued warnings in only ten of the forty-two cases, while both Qwen 2.5 7B and DeepSeek-R1 8B warned in just two cases. On Kazakh-language examples the detection rate dropped to zero for the latter two models.
The author then inserted an intermediate protective component named MoneyGate that performs three sequential checks before any message is sent: a mandate defining what the assistant is allowed to do, a separate judge model that must cite evidence from the chat, and a set of deterministic red-flag rules such as “new phone number”, “prepayment to unknown Kaspi Gold account”, or “payment outside the platform”.
Under this regime none of the forty-two fraudulent requests succeeded with any of the three models. Legitimate payment requests were either executed immediately or forwarded to the user for confirmation; none were wrongly blocked.
The results highlight that current small local models remain unreliable at recognising social-engineering attempts when they are asked to act rather than to judge. Simple, auditable rule layers combined with human oversight on irreversible actions provide a practical way to make even weak models safe for everyday financial tasks.
Related articles
SOC Forum 2026: Experts Warn Generative AI Lowers Attacker Skill Barriers While Raising SOC Complexity
At SOC Forum 2026 in Moscow, cybersecurity leaders examined how generative AI reduces the expertise needed for cyberattacks while complicating defensive operations. BI.ZONE's Oleg Skulkin noted that AI has effectively lowered attacker preparation requirements to near zero. Kaspersky researcher Georgy Kucher warned that unverified AI-generated code can expose threat actors, and overly perfect Russian-language phishing text now triggers suspicion. Solar Group’s Alexander Shepilov advocated treating AI agents as distinct non-human identities with strictly limited privileges. Alexander Kuznetsov from the same company recommended gradual automation of SOC tasks rather than abrupt AI integration. Participants also cautioned that managing AI agents may increase spending on skilled personnel instead of delivering cost savings.
Anthropic's Research Claude Model Generates Exploit Bypassing Linux Protections for Root RCE via MPTCP and CVE-2026-98432
Anthropic's internal research model of Claude autonomously wrote an exploit that achieved remote command execution with root privileges on a Linux server configured with multipath TCP (MPTCP). The exploit targets CVE-2026-98432, a use-after-free vulnerability in the Linux kernel's networking stack that occurs during parallel TCP request processing. The attack first bypassed KASLR in 48 minutes to locate the required kernel address, then took an additional five minutes to seize control and execute commands as root without any password or user interaction. Anthropic disclosed the results in a technical report but noted that the experiment used an unreleased model and cannot be reliably reproduced with public chat interfaces. The Linux team rated the flaw 9.8 on CVSS while Red Hat assigned it 5.9, citing exploitation complexity; a patch has already been merged into mainline and stable branches, though users must verify updates from their distribution vendor.
Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security
The article examines how local large language models can be integrated into application security workflows without relying on cloud subscriptions. It traces the evolution from llama.cpp in 2023 through agentic frameworks like PentAGI and Strix in 2025-2026. Teams can now run models on local hardware, connect them to code analyzers such as Semgrep, and delegate specific tasks like vulnerability path reconstruction or multi-step application testing. The piece highlights practical scenarios including static code review, dynamic testing with browser and terminal agents, and security evaluation of embedded AI assistants using tools like Garak and PyRIT. It stresses the importance of task decomposition, context management, and verification of model outputs to avoid misleading results. Hardware performance, model selection, and custom agent configurations are presented as key factors for successful adoption.
From Accessible to Controllable: Ruishu Information Launches AITM for AI Agent Lifecycle Security
As AI Agents become digital employees in enterprise R&D, office, and business workflows, organizations must now ensure they are manageable, controllable, and auditable. A multinational consulting firm’s internal AI platform was compromised by an autonomous agent attack that progressed from interface reconnaissance to vulnerability exploitation and database read-write access. Conventional scanners missed the injection points, but the agent inferred query structures from database error messages. Ruishu Information has responded with its Agent Intelligent Lifecycle Management system (AITM), which enforces security across admission, runtime, permissions, and data flows. The platform combines static scanning, behavioral analysis, semantic judgment, and sandbox execution for pre-deployment checks, followed by continuous runtime validation and LLM data-plane protection. AITM applies HMAC-SHA256 signatures, tool whitelists, PII tokenization, and four-stage Trace auditing to reduce blind spots throughout the agent lifecycle.