Data Safety and Information Security

Indirect prompt injection in agentic coding tools can lead to full system compromise because authorized tools allow LLMs to run shell commands, access files, and make network calls without clear user visibility. An attacker can gain code execution using a completely normal looking repository by chaining trusted setup instructions, routine error handling, and automated agent behavior. The malicious payload does not exist in the repository at all and is instead fetched at runtime from a DNS TXT record, making it invisible to code review, static scanners, and even the agent itself. The result is a reverse shell running as the developer’s own user, exposing credentials, API keys, and allowing persistence, all triggered by the agent attempting to fix a harmless looking setup error.

If you’re lazy like me, consider doing the bare minimum and do not keep plain text secrets in your repo. Here’s a basic workflow that encrypts them with SSH keys.

[Tip #132] Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting.

Discover why traditional guardrails fail to stop AI agent breaches. This deep dive analyzes the 5 stages of agent failure — from prompt injection to memory poisoning — and why execution must remain deterministic.

The OpenAPI specification can seem quite complex. It is a large document with many details and edge cases to keep in mind, especially if…

A security firm says a single fake Sentry error can hijack AI coding agents through MCP and run attacker code on a developer's own machine.

How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

Restricting Fable and Mythos has the same unintended consequence of harming defense while doing nothing to impede attackers. We can't export control our way to cyber resilience.

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid…

Bot detection that runs in your infrastructure. 31 detectors, sub-millisecond, zero PII. Open source core, commercial dashboard. 10x cheaper than DataDome or Cloudflare.

A botnet abused the hosted version of my open source project to phish 14,000 strangers. What I found, what I cleaned up, and what it taught me about running cloud on behalf of people I’ve never met.

Deep technical analysis of MicrosoftSystem64, an 81 MB Node.js SEA binary deployed via malicious npm packages. This RAT steals browser credentials, 80+ crypto wallet extensions, Telegram sessions, SSH keys, and screenshots, exfiltrating everything to HuggingFace datasets while maintaining persistence across Windows, macOS, and Linux.

Emails can’t run JavaScript, but by selling your soul to the CSS devil you can get pretty close.

A multi-stage attack on Linux devices began with an exposed F5 BIG-IP edge appliance and pivoted to an internal Confluence server for credential theft and identity compromise. Learn how the threat actor attempted Kerberos relay and lateral movement, and how Microsoft Defender detected, blocked, and unraveled the attack.

I am constantly getting scrape attempts for avatar-image-JPEG URLs that have not existed on my blog since a restructuring in 2022. They come in bursts of about a 100 per minute, each from a different IP address, and in random order. I thought: enough is enough, I need to figure out what clown service these are coming from and start blocking whole networks. Nope, they're almost all from cable ...

How TanStack got hit through GitHub Actions, the 8 vulnerabilities we found auditing 20 repos the next day, and the playbook we used to fix them all in 4 days.

32 security rules with deterministic scanning and AI-powered remediation via Claude.

Intel ME and AMD PSP: The silicon layer nobody certifies

How a fake LinkedIn recruiter used a Google Drive Git repo, malicious hooks, and obfuscated JavaScript malware to compromise developers and steal files.

Also, it's a twofer with the GreenPlasma zero-day local privilege escalation.

AI-accelerated vulnerability discovery is compressing the patch window. Hardware-bound identity and short-lived certificates are how trust holds up.

We notice there are a lot of hacks on YouTube lately, but we don’t share enough hacks about YouTube. That’s why [PortalRunner]’s latest oeuvre is interesting: it’s a video t…

Turns out that LLMs are really good at hiding text messages in other text messages.

A web page that tells you what your browser gave away the moment you arrived. No login, no form, no permission. Most pages do this. None of them tell you.

Google Chrome is downloading a 4 GB Gemini Nano model onto users' machines without consent, with no opt-in, no opt-out short of enterprise tooling, and an automatic re-download every time the user deletes it. The pattern is identical to the Anthropic Claude Desktop case I wrote about last month, but the scale is between two and three orders of magnitude larger. This article does the legal analysis and, for the first time, the environmental analysis. The numbers are not small.

No Input Sanitization, No Warning: The MCP Vulnerability Behind 30+ Disclosures This post is part of OX Security's The Mother of All AI Supply Chains research — a comprehensive investigation into one systemic vulnerability at the heart of the MCP ecosystem, covering 30+ disclosures and 10+ CVEs. Download the full eBook for the complete findings Explore the full advisory Read…

Audit Terraform end to end: code changes, plan/apply runs, state access, and cloud audit logs to prove who changed what, when, and why.