ShieldFont Poisons AI Training Data by Swapping Words While Preserving Grammar
ShieldFont, a free font created by Brazilian agency Seneda & Abrucio and Danish studio Playtype, offers website owners a new way to disrupt unauthorized collection of text for training generative AI models.
Publishing content online now exposes material not only to human readers but also to AI scrapers that frequently ignore robots.txt directives. ShieldFont counters this by allowing scrapers to access the page while feeding them deliberately altered text that remains grammatically plausible.
The font leverages the OpenType mechanism for glyph substitution, replacing entire words rather than individual characters. Nouns are swapped with nouns, past-tense verbs with past-tense verbs, and plural forms are preserved. The vocabulary is organized into 250 groups based on parts of speech and semantic features, resulting in roughly one quarter of words being altered while maintaining readable structure.
This controlled substitution aims to keep poisoned text inside training datasets instead of being filtered out by quality checks. When evaluated with FineWeb-Edu, about 10 percent of fragments previously rated as high quality still passed after protection, yet 55.8 percent of tested excerpts contained facts that no longer matched the original.
ShieldFont is not immune to all extraction methods. Screenshots followed by OCR can recover the original text, and screen readers for visually impaired users currently read the substituted words. Developers have added a beta feature to supply the correct text to assistive technologies, though accessibility concerns remain unresolved.
The font currently supports only English and is freely available on GitHub.
Related articles
Chinese Cybercriminals Deploy AI Agents to Automate Exploitation of Exposed Windows and Linux Servers
A Chinese cybercriminal group tracked as UAT-10147 is actively using AI agents to automate reconnaissance, exploitation, and post-exploitation against internet-facing Windows and Linux servers. Cisco Talos identified the campaign after discovering approximately 170,000 URLs in the attackers' infrastructure, with targets spanning government, education, media, technology, and gaming organizations across multiple countries including Brazil. The group divides targets into smaller batches to accelerate scanning and exploitation of known vulnerabilities in applications such as Zimbra, AjaxPro, Nacos, and Telerik. AI agents go beyond simple code generation by producing exploitation guides, refining failed attacks, verifying payload success, and automating persistence and post-exploitation steps. In one observed case, the agents created scripts capable of validating permissions, exploiting ViewState deserialization, installing implants, and deploying web shells on compromised IIS servers. Cisco Talos assesses the operation as a shift toward semi-autonomous offensive orchestration rather than basic AI-assisted scripting.
Hermes Emerges as Modular Harness for Practical AI Security Testing
The article details the development of Hermes, a lightweight modular harness designed to turn raw language models into reliable AI security agents. Unlike heavy frameworks such as OpenClaw, Hermes uses dynamic skill loading, strict runbooks stored in Git, and a file-system source of truth to eliminate hallucinations and context bloat. It continuously scans dozens of sources including NVD, CISA KEV, arXiv and research blogs, then applies the custom TIPS scoring metric to rank threats before attempting reproduction. A dedicated Paper-to-PoC skill converts academic attack descriptions into executable code that is validated inside an isolated Ollama and Docker sandbox. Eight mandatory validation gates must pass before any finding is accepted, ensuring reproducibility and freshness of data. The system already supports tools such as Garak, PyRIT, promptfoo, fickling, modelscan and presidio, and evolves autonomously by committing successful attack scenarios back to its repository.
Zero Trust for AI Agents: Why Separate Identity Alone Is Not Enough
Denis Korbakov, CTO of Smart-Soft, explains why traditional IAM approaches fail to secure autonomous AI agents that dynamically select tools, change context, and delegate authority. Only 21.9% of teams treat agents as distinct identity-bearing entities, while 45.6% rely on shared API keys and 44.4% use generic tokens. Research from Gravitee, Cloud Security Alliance, and Aembit shows that 68% of organizations cannot distinguish AI agent actions from human actions, 74% grant excessive privileges, and 52% allow rights inheritance. The article maps NIST SP 800-207 Zero Trust principles—explicit verification, least privilege, and assume breach—to agent workloads using short-lived scoped tokens, SPIFFE/SPIRE credentials, and layered policy enforcement points. A concrete ticket-diagnosis scenario illustrates how prompt injection can be contained through per-task authorization, dedicated network segments, and independent telemetry from NGFW and SIEM. The piece concludes with an open question on sub-agent delegation chains and offers reference OPA/Rego policies plus runbooks for pilot implementations.
AWS Details Architecture to Reduce Prompt Injection Risks in AI Agents
AWS has introduced a new architecture designed to prevent compromised or manipulated AI agents from accessing data beyond user permissions. The approach relies on Amazon Bedrock AgentCore to shift authorization decisions from the agent itself to the underlying infrastructure and connected services. The core risk arises when agents receive broad credentials to query databases, repositories, and SaaS platforms, allowing potential prompt injection attacks to retrieve unauthorized information. In the proposed design, users authenticate via Amazon Cognito and receive JWT tokens containing attributes such as department or role. The AgentCore Runtime validates these tokens before executing any agent actions, rejecting requests that violate configured rules. For DynamoDB queries, temporary credentials are issued through AssumeRoleWithWebIdentity, with IAM policies enforcing strict access to authorized data partitions only.