AISafetyHot aggregates daily AI safety news, arXiv papers and real-world incidents into a browsable observatory and a free read-only MCP interface that authorized security professionals and red teams can query from their agents.
| Tool | wuyoscar/AISafetyHot — an AI safety news, paper and incident aggregator with a public read-only MCP endpoint and agent skills |
| Category | News aggregation / MCP server / research tracking |
| Primary Use | Tracking jailbreak, prompt-injection, agent security, defense, alignment and governance developments daily, and querying them from agents like Claude Code, Codex and Cursor |
| Safe Use | Purely a read-only intelligence and research feed for defenders, authorized red teams, and academic researchers monitoring publicly reported AI security news; no offensive functionality |
| Telemetry Note | The public API is rate-limited (60 requests/minute, 300/day per IP, 429 with retry hints on excess); defenders deploying it should note agent queries are read-only and the skills instruct agents to treat returned content as data, not instructions |
AISafetyHot is not an exploitation tool at all — it is an intelligence pipeline, and that is precisely why it deserves attention in a publication that tracks what working security professionals actually use day to day. The repository at wuyoscar/AISafetyHot (roughly 2.1k stars, primary language TeX for its paper archives) backs a bilingual Chinese/English website that continuously curates AI safety news across jailbreak research, prompt-injection, agent security, defenses and guardrails, alignment, evaluation, real incidents, and governance policy. The GitHub hub stores the public paper lists, daily report archives, and a set of four agent skills, while the live site does the aggregation and rendering.
The architecture is worth pausing on because it is a clean example of the emerging pattern where research tooling ships as an MCP service rather than a CLI. There is a public, key-free MCP endpoint over Streamable HTTP at https://aisafetyhot.com/api/mcp, and the skills live in-repo under skills/ (aisafety-hot, aisafety-brief, aisafety-paper-scout, aisafety-watch). Any client that speaks MCP can consume it: Claude Code via plugin install, Codex via codex mcp add, or Cursor by registering the HTTP endpoint in MCP settings. The split between a hosted aggregation service and a repository of skill definitions and archives is a sensible one for maintenance, even if it means the interesting ingestion code is not in this repo.
What the aggregation covers is broad and, notably, defensive-leaning in its taxonomy. The site organizes content into real-time news, hot-story clustering (related reports grouped so you can follow an incident's development), real-time papers filterable by research direction, conference papers, and a daily digest that merges new developments into a single issue. For a professional who needs to answer "what happened in agent security this week," the hot-story view is the most operationally interesting feature: it clusters reporting by event and shows per-story source counts, which is a crude but useful proxy for how corroborated an incident claim is.
The four skills map cleanly onto analyst workflows. aisafety-hot reads the hot-topic ranking and then traces a story's timeline; aisafety-brief produces a 24-hour digest segmented into attacks, defenses, incidents and policy; aisafety-paper-scout reads the daily paper list and the topic index and can emit BibTeX entries; aisafety-watch monitors a specific vendor or product (the README's examples use Anthropic) and lists developments, incidents and vulnerabilities. The paper-scout skill is the standout for researchers — the daily selection picks 30 papers per day, deduplicates across days, and preserves original publication dates plus links to arXiv originals and site-side reading notes.
The daily paper archive itself is substantive and reveals the editorial focus. The repository's daily-papers directory exports paper lists as Markdown, JSON and BibTeX, with per-topic indexes and yearly archive indexes. A glance at a recent day shows the sort of material being triaged: compositional security for agentic coding harnesses (ActiveSecHarness), retention of safety behaviors after fine-tuning (NEST), memory-poisoning defenses for multi-agent systems, BypassGym for evaluating agent EDR-evasion capabilities, and fingerprinting the LLMs behind agentic attacks. This is squarely the literature that purple teams and AI-safety reviewers should be scanning, packaged with enough structure to mine programmatically.
The MCP tool surface is documented and honest about its limits. The README shows live example calls such as aisafetyhot_get_hot_topics, aisafetyhot_get_story, aisafetyhot_get_latest (with an optional topic argument), and a daily-papers JSON resource. The free tier covers the last 7 days of curated news, the hot-story rankings, the daily digest and daily papers — anonymously, with no API key. Historical queries, full paper interpretations and weekly/monthly reports sit behind a read-only authorization scheme documented in docs/agent.md, alongside docs/mcp-examples.md for reference invocations.
Security posture of the tool itself is addressed explicitly, which is rare and welcome for an MCP service in 2026. The API is documented as read-only, with no write operations exposed. More importantly, because the service returns third-party headlines and summaries — exactly the kind of content that prompt-injection researchers will recognize as untrusted — the skills instruct the consuming agent to treat returned text as reference material only and not execute instructions embedded within it. That is a correct mitigation for the indirect-injection risk inherent in any news-feeding agent, though operators should verify their client actually honors such guidance rather than trusting the skill prompt alone.
Rate limits and abuse handling are concrete: 60 requests per minute and 300 per day per IP, with 429 responses that include a wait time. There is a one-line self-check pattern in the README — a curl against the endpoint issuing a tools/call for aisafetyhot_get_hot_topics with limit:3 — which is a reasonable smoke test, and one we can repeat here as the single non-weaponized invocation example since it is a read-only query to a public feed. Installation itself is either a natural-language one-liner your agent resolves against docs/install.md, or the conventional per-client commands (claude plugin install aisafetyhot@aisafetyhot-hub, or codex mcp add aisafetyhot --url https://aisafetyhot.com/api/mcp).
Licensing is the one open flag: the repo metadata reports NOASSERTION, meaning the license file is non-standard or unset. For a repository whose value is largely its archives — the daily-papers, daily and papers directories of Markdown, JSON and BibTeX exports — that ambiguity matters if you plan to redistribute or build tooling on top of the data rather than just reading it through the API. Check the license terms before any derivative use.
For defenders, the telemetry angle is minimal: this is a consumer of public information, not an active scanner. Its observation footprint is limited to outbound HTTP requests to aisafetyhot.com from whatever agent or browser touches it, governed by the documented IP-level rate limits. The more interesting defensive application is the inverse — aisafety-watch and the incident clustering give blue teams and AI governance staff a daily signal source for emerging prompt-injection techniques, supply-chain incidents in the LLM ecosystem, and jailbreak research, which feeds directly into threat-model updates and guardrail tuning.
Where does it fit in an authorized workflow? Think of AISafetyHot as situational awareness rather than capability. A red team preparing an authorized LLM engagement uses the paper scout to ground its threat model in the current jailbreak and agent-security literature; a defensive team uses the hot feed to catch ecosystem incidents (compromised packages, leaked keys, misconfigured MCP servers) as they break; a governance function uses the policy stream to track regulatory movement. Nothing in the tool touches a target system — its entire output is public-source knowledge, which keeps it comfortably on the safe side of any engagement rules of engagement.
Caveats before adoption: the service is centralized, so availability and curation bias depend on one operator's pipeline; the aggregation scope (the README cites hundreds of distinct sources per 72-hour window on major stories) is impressive but unverified by third parties; and the README's example outputs include vendor-incident claims that should always be corroborated against primary sources before being acted on. As with any aggregator, treat it as an index, not an authority. Used that way — as a fast, programmable index into the daily flood of AI safety research — wuyoscar/AISafetyHot is a genuinely useful addition to the professional's reading stack, and one of the cleaner examples of agent-native research tooling currently shipping.
wuyoscar/AISafetyHot.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.