Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-07 · high
The flaw hits only ISO/IEC-conformant AEAD implementations, since NIST's spec blocks empty nonces outright.
Why now: The paper posted August 6, one day before this write-up on August 7.
A zero-length nonce recovers the GCM hash key, per arXiv 2608.06061, posted August 6. With the key exposed, an attacker can forge ciphertexts and messages the system is supposed to authenticate.
The exposure traces to which spec a library validated against. NIST's version of GCM requires a nonce of at least one bit. The ISO/IEC version permits a zero-length nonce string, and that's the version this attack breaks.
Implementations built strictly to ISO/IEC are open to key recovery and forged messages. Implementations built to NIST's version aren't, per the paper.
I'd check whether my AEAD library enforces a minimum nonce length, rather than trusting whichever spec it was built against.
A crypto library is only as safe as the spec it validated against. This bug shows some AEAD implementations have been trusting the wrong one. Watch whether library maintainers start rejecting zero-length nonces outright, regardless of which spec they cite.
Each link below shares sources, entities, or timing with this story.
arXiv 2608.06061 is a short note with a sharp point: pass a zero-length nonce to GCM or GMAC and an adversary recovers the hash key, then forges arbitrary ciphertexts. NIST's version requires at least one bit. ISO/IEC's permits the empty string. So the attack lands on ISO/IEC-...
An attacker stole an AI agent's signing keys through email injection in under five minutes, per a prior incident this design cites.
Llama caught 80% of borderline anomalous logins in testing, versus 20% for Wazuh and 15% for OpenSearch.
A proposed provenance gate cut unauthorized high-risk actions to zero after the attack itself hit a 1.000 success rate in tests.
Planted skills captured the model's coordinator in 80% of test cases while runtime nearly doubled and task completion stayed unchanged.
Real transfer showed up only on tasks needing the sender's private text; on math and trivia, a scrambled cache worked nearly as well.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.