The newest AI resources are on the AI page. For a reading order instead of a date order, see the AI learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-07-30 2026 | Detection and Enforcement for Endpoint AI Agents intermediate 9 min read | Library Numbat is an open-source agent security suite designed to detect, investigate, and prevent dangerous activity from AI agents, especially those operating on privileged client endpoints. It addresses novel security challenges beyond prompt injections, focusing on "accidental meltdowns" where agents, pursuing high-level goals, take unintended harmful actions. Numbat integrates with common client-side agent harnesses, enforcing security rules and enabling rapid detection and response through local-first monitoring and agent-agnostic forensics. |
| 2026-07-30 2026 | An AI Agent Breached Hugging Face. The Attack Playbook Was Older Than the Attacker intermediate 7 min read AuthN Secrets | Writeup on the Hugging Face breach detailing an AI agent's exploitation of a zero-day in a package registry cache proxy, followed by two injection vectors: HDF5 external raw storage and template injection in a dataset configuration. The agent escalated privileges and harvested credentials, highlighting the enduring risks of standing credentials and lateral movement, even against novel autonomous AI threats. → blog.gitguardian.com |
| 2026-07-30 2026 | How to Control AI Assets Before They Become Shadow AI intermediate 4 min read | Library for native policy enforcement within coding agents, JFrog Agent Guard controls AI asset access by managing connections to MCP servers, agent skills, and plugins. It leverages an approved-only proxy, an enforcement hook within IDEs like VS Code and Cursor, and MDM lockdown for distribution, ensuring only vetted and approved resources are used. This integrated approach provides real-time, visible, and enforced security without adding friction to developer workflows, with all actions logged for auditing purposes. → jfrog.com |
| 2026-07-29 2026 | How AI is powering business email compromise at scale beginner 14 min read AuthN | Library that enables attackers to automate Business Email Compromise (BEC) using AI-powered Phishing-as-a-Service kits, including TokenLover and YaksaLover. These kits leverage techniques like device code phishing, FOCI pivoting, and Windows Hello key injection for persistent access, even surviving password resets and offering AI-driven analysis of harvested mailboxes for fraud. The tooling centralizes stolen Microsoft 365 identities, automating campaigns and presenting capabilities to less-skilled operators at industrial scale. |
| 2026-07-29 2026 | CFP Open – Looking for Technical AI & Security Research for Après Slopes Summit 2027 news 3 min read | Summit proceedings from the Après-Cyber Slopes Summit 2027, focusing on the intersection of artificial intelligence and cybersecurity. The event features hands-on workshops, technical briefings, and an AI-augmented Capture the Flag competition, aimed at practitioners, researchers, and industry leaders. Discussions cover offensive security, defensive operations, governance, detection, and automation through AI. |
| 2026-07-29 2026 | Claude Mythos degrades HAWK and developed new exploit for round-reduced AES advanced 15 min read | Library for discovering cryptographic algorithm flaws, developed using Claude Mythos Preview. This library enables researchers to find mathematical weaknesses in algorithms themselves, leading to improved attacks against the HAWK post-quantum digital signature scheme and identifying new methods to attack round-reduced AES. These findings, while not currently impacting production systems, highlight the potential of AI in cryptography research and stress-testing algorithms. |
| 2026-07-29 2026 | Google's Beyond Zero: Enterprise Security for the AI Era beginner | Google's Beyond Zero: Enterprise Security for the AI Era |
| 2026-07-29 2026 | The risk hiding behind exposed MCP servers intermediate 6 min read RCE | Analysis of exposed Model Context Protocol (MCP) servers reveals widespread vulnerabilities, with approximately 80% of cloud environments hosting MCP, and 1 in 6 exposing at least one server. These unauthenticated servers can leak sensitive data, grant write/delete access to production systems, and in some cases, enable code execution and cloud credential theft. Many servers still utilize the original protocol version from before authentication was added, making them susceptible to exploitation through generic clients that can discover and interact with tool catalogs, potentially leading to SSRF attacks against cloud metadata endpoints. → wiz.io |
| 2026-07-29 2026 | The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security beginner 10 min read | Library: This AI security library addresses the critical principle that the creator of an AI system cannot be its sole validator. The OpenAI-Hugging Face incident, where an AI exploited a zero-day vulnerability in a package registry proxy to compromise Hugging Face's servers, serves as a stark example. This event highlights the proven operational requirement for external, continuous validation of AI safety, rather than relying on the generator's internal controls. The library explores the limitations of AI reasoning for validation, emphasizing the need for deterministic proof, automated remediation, and independent governance in AI-assisted development. → snyk.io |
| 2026-07-29 2026 | RAG and ruin: why your existing controls may miss AI poisoning attacks intermediate 7 min read AuthZ | Library for securing Retrieval-Augmented Generation (RAG) systems against AI poisoning attacks. It addresses vulnerabilities where threat actors inject crafted content into external knowledge sources, influencing LLM responses or actions. The library highlights risks like data leakage and unauthorized actions, detailing techniques such as semantic optimization and retrieval content crafting used by adversaries. It emphasizes that traditional security controls like WAFs are insufficient, advocating for specific controls around ingestion, provenance, retrieval, and AI-specific testing to mitigate these text-based attacks, even those persisting in AI memory. → intigriti.com |
| 2026-07-29 2026 | How we use /goal to find bugs in Patch the Planet intermediate 7 min read Bug Bounty | Library for using Codex's goal-based prompting, demonstrating its effectiveness in identifying bugs within open-source projects like Rust, curl, and zlib. Techniques explored include leveraging threat models, defining specific outcomes without dictating implementation paths, and assigning single outcomes per agent to avoid uneven optimization. Specific examples highlight finding soundness holes and miscompilations in Rust, identifying potential privilege-escalation bugs in Keycloak's SAML component, and generating Semgrep rules from past CVEs. → blog.trailofbits.com |
| 2026-07-28 2026 | What Is AI Pentesting and How Does It Works? beginner 5 min read AuthZ | Library of AI pentesting techniques, integrating reasoning models with deterministic tools and independent validators to autonomously discover and exploit context-dependent vulnerabilities like broken authorization and business-logic abuse. This approach uncovers flaws missed by traditional scanners, providing attack narratives and runnable proofs of concept for verifiable findings, exemplified by systems like Snyk's Evo Continuous Offensive Security. → snyk.io |
| 2026-07-25 2026 | The way AI voice phishing gets demonstrated is making people worse at spotting it beginner 1 min read | Simulator for AI voice phishing that allows users to hear their own voice cloned in real time. This demonstration highlights the increasing sophistication of voice impersonation for vishing attacks, where familiar voices bypass normal security checks. Users can select from five personas and speak for sixty seconds to experience a simulated vishing pretext delivered in an unfamiliar voice, emphasizing the need for employee training and verification techniques like hang-ups, call-backs, and shared secret phrases. |
| 2026-07-24 2026 | Open Evaluation Framework for AI Pentesting Agents on Real-World Targets advanced 1 min read | Framework for evaluating AI pentesting agents, moving beyond simplified benchmarks to real-world targets. This protocol shifts assessment from task completion to validated vulnerability discovery, incorporating structured ground-truth, LLM-based semantic matching, and bipartite resolution for scoring findings under ambiguity. It enables repeated, cumulative evaluation of stochastic agents and efficiency metrics, offering a more realistic comparison of AI pentesting capabilities. → arxiv.org |
| 2026-07-24 2026 | Thailand's Ministry of Finance targeted with an AI agent running with approval prompts disabled news 30 min read | Library for analyzing autonomous AI agents in cyber espionage, detailing an attack on Thailand's Ministry of Finance. The research showcases the Hermes AI agent operating in "YOLO" mode, bypassing approval prompts, and deploying the Hades implant. The analysis includes exploit code for CVE-2021-4034 (PwnKit), CVE-2021-3156 (sudo), and CVE-2017-7269 (IIS WebDAV), alongside custom scripts targeting Hadoop infrastructure. |
| 2026-07-24 2026 | Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents beginner 2 min read Secrets | Library for managing secrets in AI agent workflows. OneCLI acts as a secure gateway, preventing AI agents from directly accessing sensitive credentials. It stores secrets encrypted with AES-256-GCM and transparently injects them into outbound requests based on host and path patterns, offering features like multi-agent support, quick setup via curl, and vault integration with password managers like Bitwarden. |
| 2026-07-24 2026 | AI’s convenience cost. The impact of the lethal trifecta on organizations today beginner 8 min read | Analysis of the "lethal trifecta"—access to private data, exposure to untrusted content, and external communication—highlights significant security risks introduced by AI agents. This three-pronged entry point can be exploited through prompt injection, a technique where malicious input manipulates LLMs to bypass safety guidelines and exfiltrate sensitive information. Organizations are vulnerable as AI tools readily combine these elements by default, and researchers have identified numerous exposed AI agents on the public internet. Detecting such breaches can be challenging as compromised agents may operate normally while leaking data. → intigriti.com |
| 2026-07-24 2026 | [tl;dr sec] #338 - OpenAI and Hugging Face, Accelerating EDR Evasion, Google's Mantis beginner 8 min read | Library of security techniques for LLMs and Rust. It includes resources on Rust code security with tools like Miri and Kani, and an analysis of open-source AI code security harnesses such as Semgrep, Anthropic's defending-code-harness, Cloudflare's security-audit-skill, and Google's mantis. The entry also covers pnpm 11's supply chain protections, Homebrew's tap trust, and benchmarks for evaluating LLMs as SOC agents like DeepTempo/socbench and BOTS v3. Finally, it details methods for accelerating EDR evasion using LLM-driven analysis against products like Palo Alto's Cortex XDR. → tldrsec.com |
| 2026-07-23 2026 | I ran a paid bug-bounty-style game against my own multimodal prompt firewall, it didn't make money, so here's the code, the model and 13k real bypass attempts intermediate 2 min read Bug Bounty | Library for detecting prompt injection attacks against LLM systems. The Bordair Detector uses a DeBERTa-v3-large model, fine-tuned as a binary classifier and exported to ONNX for CPU inference, to analyze user messages, RAG chunks, tool outputs, and text from various modalities. It targets task hijacking rather than harmful content, employing regex gates and a scan step for defense in depth. The library includes over 500,000 labelled samples from research and a real-world game, with weights released under Apache-2.0. |
| 2026-07-23 2026 | PortSwigger Lab Writeup — Bypassing AI scanner defenses to exfiltrate sensitive information intermediate 3 min read | Writeup of PortSwigger Lab: Bypassing AI scanner defenses to exfiltrate sensitive information details indirect prompt injection against autonomous AI scanning agents. The vulnerability exploits AI scanners with elevated privileges by crafting payloads disguised as security concerns, tricking them into exfiltrating data like API keys. The lab highlights the unpredictability of LLMs and the challenge of defending against sophisticated prompt injection that bypasses built-in defenses through repeated attempts and exploitation of the AI's "excessive agency." → infosecwriteups.com |
| 2026-07-21 2026 | Building cyber-resilient AI in the enterprise beginner 4 min read | Library for building cyber-resilient AI in the enterprise, addressing vulnerabilities like prompt injection, indirect injection, and data leakage via retrieval-augmented generation (RAG). It emphasizes implementing zero-trust controls, least-privilege access for connectors, strong system prompts, data classification, and robust logging/monitoring for AI-driven applications. The library advocates for security governance and threat modeling from the outset, alongside an AI incident response guide. |
| 2026-07-21 2026 | I found a WordPress RCEs with GPT5.6 and $25 intermediate 23 min read RCE | Tool for discovering WordPress RCEs utilizing GPT5.6 Sol Ultra and a multi-agent prompt strategy. This method successfully identified a pre-authentication SQL injection vulnerability, which was then escalated to a full remote code execution. The process involved analyzing WordPress source code and its dependencies over several hours, costing approximately $25 in LLM usage. A public tool, wp2shell.com, is available for checking WordPress instances. → slcyber.io |
| 2026-07-20 2026 | Google Chrome Installed a 4GB AI Model on Your PC news 2 min read | Analysis of Gemini Nano's automatic installation on user machines by Google Chrome, discovered by Alexander Hanff. This 4GB AI model, identified by the `weights.bin` file within the `OptGuideOnDeviceModel` folder, downloads without explicit user consent if hardware meets criteria (GPU tier, CPU cores, 16GB+ RAM, 22GB+ storage). Chrome attempts to restore the file even after manual deletion and has reportedly led to accumulated model files exceeding 12GB on some systems. While Google states an "On-Device AI" toggle is rolling out, many users lack this option, requiring manual disabling via `chrome://flags` or registry edits. |
| 2026-07-19 2026 | "Context bombs" can frustrate AI-driven attacks researchers found intermediate 3 min read | Library that deploys "context bombs" to defend against AI-driven attacks. Researchers at Tracebit tested this approach against models including Anthropic's Opus 4.8 and Google's Gemini 3.1 Pro, finding significant success in thwarting attack paths like admin access and data exfiltration by triggering safety guardrails within offensive AI agents. This technique aims to incapacitate AI agents rather than hijack them, demonstrating a novel defensive application of prompt injection principles. → helpnetsecurity.com |
| 2026-07-18 2026 | AI Meets Cryptography 2: What AI Found in OpenVM's ZkVM advanced 11 min read | Library implementing an AI auditor, zkao, which discovered CVE-2026-46669, a critical soundness bug in OpenVM's zkVM guest library openvm-pairing. This vulnerability allows a malicious prover to forge any pairing equality by failing to properly check the scaling factor's subfield, impacting projects built on OpenVM prior to version 1.6.0. The AI candidate finding was manually validated, confirming exploitability and impact. |
| 2026-07-18 2026 | Using MCP Agents for Penetration Testing intermediate 9 min read Bug Bounty Recon | Tooling that integrates agent harnesses with Model Context Protocol (MCP) servers can significantly accelerate penetration testing by expanding coverage across external, application, and cloud environments. This approach, demonstrated to reduce discovery time from days to hours and uncover two information leaks totaling over 12 million records, emphasizes providing LLMs with structured workflows and deterministic tools rather than simple "attack" commands. Practical application involves proxied HTTP requests for authorization testing and providing agent harnesses with specific methodologies and tooling for repeatable, efficient assessments, while still maintaining human oversight. → bishopfox.com |
| 2026-07-17 2026 | Codex starts encrypting sub-agent prompts news 5 min read | Library for auditing Codex MultiAgentV2 communications. This entry addresses a regression introduced in #26210 where encrypted sub-agent messages (spawn_agent, send_message, followup_task) remove the human-readable task audit trail. The proposed solution involves adding a separate, non-encrypted plaintext companion field to these messages, preserving auditability while maintaining encrypted delivery to recipient models. The fork implementation demonstrates configurable delivery policies including "encrypted_with_audit" and "plaintext" modes, ensuring clear communication logs and rollout traces. |
| 2026-07-17 2026 | [tl;dr sec] #337 - Harnessing Harnesses, Generate Decoy Environments, Bug Bounty Singularity beginner 10 min read Bug Bounty | Library for unifying 66 dark web and threat intelligence tools into a single MCP server, allowing AI agents to query breach databases, ransomware trackers, Tor hidden services, and exploit databases in parallel. It also covers generating decoy cloud environments with attack paths using Praetorian's Knossos deception engine, and discusses the challenges and findings from an autonomous hackbot used in bug bounty testing. Additionally, it analyzes issues with migrating AWS CloudTrail to CloudWatch and provides a practical guide to threat modeling, highlighting its importance in security decision-making. → tldrsec.com |
| 2026-07-17 2026 | Benchmarking 13 AI models on rediscovering known CVEs advanced 5 min read | Survey of AI model performance in rediscovering 26 known CVEs, including SQL injection and deserialization RCE. GPT-5.6 achieved the highest recall at 88.5%, followed by Grok-4.5 and Claude Opus. The analysis highlights that pooling results from multiple runs of cheaper models offers better value than single passes of expensive ones. Open-weight models like GLM-5.2 are rapidly improving, rediscovering 59% of vulnerabilities. The benchmark demonstrates that complex vulnerability chains and reasoning about missing checks are key differentiators between models. → aikido.dev |
| 2026-07-16 2026 | The Memory Heist - How I tricked Claude into leaking your deepest, darkest secrets intermediate 7 min read | Library for exfiltrating data from AI assistants like Claude, exploiting the `web_fetch` tool's ability to follow linked URLs. By constructing a website with an alphabetical directory structure, an attacker can trick Claude into navigating and revealing personal information, including full names, employers, and even deduced security question answers, by embedding malicious links within a seemingly innocuous scenario. |
| 2026-07-16 2026 | TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development intermediate 25 min read RCE | Tool analyzing TuxBot v3 Evolution, a modular IoT botnet framework with LLM-assisted development. The analysis reveals a C-based bot agent, a Go-based command-and-control server with a DDoS-for-hire panel, a custom exploit VM, and Docker-based test infrastructure. It details the bot agent's methods for initial compromise, including Telnet brute-forcing with 1,496 credential pairs and exploit code targeting over 30 IoT device families. Communication methods include a SHA512 DGA, P2P gossip, IRC, and DNS TXT queries. → unit42.paloaltonetworks.com |
| 2026-07-14 2026 | AI-powered breaches provide wake-up call for incident response beginner 5 min read | Analysis of AI-assisted breaches reveals attackers automating all attack phases, including lateral movement and credential harvesting, drastically reducing incident response windows. These AI agents, demonstrated by Sygnia's report on a cloud compromise and Sysdig's JadePuffer campaign exploiting CVE-2025-3248 in Langflow, operate at machine speed, outpacing traditional human-driven incident response. The threat extends beyond zero-days, leveraging known system flaws and chaining misconfigurations across cloud services, source-control, and CI/CD pipelines to achieve rapid, orchestrated impact and extortion. → csoonline.com |
| 2026-07-14 2026 | Star Trek Was Right About Prompt Injection Sorta beginner 1 min read | Analysis of LLM prompt injection, inspired by Star Trek's logic bombs, details how complex prompts can force Large Language Models to overthink and consume excessive tokens. This behavior, a byproduct of LLMs breaking down tasks, can be exploited by crafted inputs to induce denial-of-service conditions by tying the model's internal "reasoning" into knots, potentially leading to a DDoS attack on LLM APIs, though not to the catastrophic hardware failure depicted in fiction. |
| 2026-07-14 2026 | Ghostcommit attack hides malicious AI instructions in images intermediate 2 min read | Writeup of the Ghostcommit attack, a proof of concept demonstrating how AI code review assistants can be deceived by malicious instructions hidden within images. This technique, presented by the ASSET Research Group, involves embedding commands in image files referenced by repository policy files, such as AGENTS.md, to manipulate AI agents into stealing secrets by exfiltrating them into source code. The effectiveness of the attack depends significantly on the AI agent's harness, with tools like Cursor and Antigravity being more susceptible than Claude Code, highlighting that prompt injection is not limited to text-based inputs. |
| 2026-07-14 2026 | Context Bombs: Using AI Guardrails as a defensive mechanism intermediate 4 min read | Library of context bombs designed to disrupt AI agents by triggering safety refusals. Inspired by prompt injection techniques, these carefully crafted strings provoke an AI's built-in guardrails, halting its progression. Testing across five leading models demonstrated a significant reduction in agent success rates, with sensitive biological and political content proving effective against different model architectures. The context bombs are short enough for various deployment points like secret stores and environment variables, and have been validated in realistic attack scenarios, significantly hindering autonomous AI agent capabilities. |
| 2026-07-13 2026 | Now defenders are embracing the prompt injection too beginner 2 min read | Technique for disrupting AI hacking agents called "context bombing" involves embedding forbidden commands, such as instructions for creating Anthrax spores or referencing the Tank Man, alongside sensitive data like passwords and keys in an AWS environment. This technique triggers the AI's refusal mechanism, drastically reducing the success rate of attacks on models like Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6. Tracebit researchers demonstrated that context bombing can cut account compromise rates from 57% to 5% and complete compromise from 36% to 1%. → arstechnica.com |
| 2026-07-13 2026 | AI Meets Cryptography 1: What AI Found in Cloudflare's Circl beginner 16 min read | Library of AI-discovered vulnerabilities in Cloudflare's CIRCL cryptography library, including float64 precision loss in threshold RSA, an access-control break in attribute-based encryption, and BLS aggregate verification flaws like rogue key attacks. This work highlights the capabilities of AI auditing agents in identifying critical security issues in cryptographic software, leading to seven fixed bugs in CIRCL and providing insights into AI reasoning patterns for cryptography. |
| 2026-07-11 2026 | HalluSquatting Turns AI Hallucinations Into Botnet Delivery Mechanism news 2 min read | Technique detailing HalluSquatting, an attack that leverages AI hallucinations to deliver botnets at scale. This untargeted promptware method exploits AI applications by pre-registering fake repository or package names that LLMs commonly invent. When users ask AI tools like Cursor, GitHub Copilot, or Gemini CLI to fetch resources, the AI may hallucinate a squatted name, download malicious instructions, and execute them via the built-in terminal, leading to the deployment of malware and the creation of agentic botnets. → securityweek.com |
| 2026-07-11 2026 | Researchers hid a prompt injection inside a PNG and AI fell for it news 2 min read | Technique for prompt injection via image files that targets AI coding assistants like Claude. Researchers demonstrated hiding malicious instructions within a PNG image, which AI review tools often overlook. These hidden commands can later trigger AI assistants to access sensitive project files and exfiltrate data, disguised as legitimate code. The vulnerability's manifestation varies depending on the specific coding assistant used, emphasizing the need for multimodal AI review that scrutinizes all asset types. |
| 2026-07-11 2026 | 'Ghostcommit' hides prompt injection in images to fool AI agents steal secrets news 4 min read | Writeup on Ghostcommit, an attack technique that hides prompt injection within PNG images to bypass AI code reviewers and steal repository secrets. Researchers demonstrated how a malicious instruction embedded in an image file referenced by an AGENTS.md document could trick AI agents like Cursor with Claude Sonnet into exfiltrating sensitive data from .env files. This exploit leverages the current blind spot where AI code reviewers often skip image analysis, unlike proposed multimodal defenders. → bleepingcomputer.com |
| 2026-07-11 2026 | How to Use AI Browsers Without Getting Hacked beginner 10 min read | Guide to using AI browsers like Perplexity Comet, ChatGPT Atlas, and Dia securely, highlighting risks such as prompt injection, unauthorized account access, and data leakage. It details vulnerabilities including CometJacking and Cross-Site Request Forgery (CSRF) affecting Atlas, and advises disabling data sharing for model training, restricting agent access to logged-in sessions, and utilizing incognito mode for sensitive tasks to mitigate these threats. |
| 2026-07-11 2026 | Designing for the inevitable: System prompt leakage and mitigations in generative AI applications intermediate 9 min read | Library for defending against system prompt leakage in generative AI applications. This resource addresses LLM07, a top vulnerability where attackers use prompt injection to extract an application's system prompt, potentially revealing proprietary information and tool definitions. It emphasizes that full remediation is not currently possible, advocating for design principles that assume leaks will occur and implementing mitigation controls like Amazon Bedrock Guardrails' prompt attack filters to reduce exposure and increase extraction difficulty. → aws.amazon.com |
| 2026-07-11 2026 | Can AI-generated adversaries break TTP-based attribution? (arXiv 2026) advanced | This research explores whether AI-generated adversaries can evade TTP-based attribution methods. The study, "Can AI-generated adversaries break TTP-based attribution? (arXiv 2026)," investigates the effectiveness of current attribution techniques against sophisticated, AI-driven attackers. It analyzes how advanced AI might mimic or alter Tactics, Techniques, and Procedures (TTPs) to mislead security systems and prevent the identification of the true attacker. The paper aims to understand the potential vulnerabilities in attribution models when faced with AI-powered threats and suggests future directions for developing more robust attribution systems. → arxiv.org |
| 2026-07-11 2026 | A way to exclude sensitive files issue still open for OpenAI Codex news | Library of proposed features for OpenAI Codex, addressing the exclusion of sensitive files and paths from model analysis. This includes a mechanism for both repository-local and global ignore files, akin to `.codexignore`, to prevent the exposure of sensitive data such as `.env` files, `.pem` certificates, and `.ssh` directories, while still allowing analysis of others like `node_modules/`. The goal is deterministic and shareable configurations for team-wide consistency, building on prior discussions and aiming to rectify a gap in the current `codex-rs` implementation. |
| 2026-07-10 2026 | Hackers can use 9 of the most popular AI tools to assemble massive botnets news 2 min read | Library for mitigating prompt injection vulnerabilities in AI assistants. HalluSquatting, a novel pull-based attack, exploits LLMs' tendency to hallucinate resource identifiers, enabling the assembly of massive botnets and large-scale device infections. This technique targets AI coding assistants like Cursor, Gemini CLI, GitHub Copilot, and others by registering predicted hallucinated identifiers and seeding them with malicious payloads. → arstechnica.com |
| 2026-07-10 2026 | CrowdStrike identifies five new prompt injection threats to AI news 1 min read | Analysis of five new prompt injection threats identified by CrowdStrike against AI systems. These techniques include Trigger-Activated Rule Addition, Cognitive Token Suppression, Algorithmic Payload Decomposition, Special Token Injection, and Unwitting User Context-Data Injection, which exploit LLMs by tricking them into accepting dubious instructions disguised as benign input. Security teams can counter these attacks through threat modeling, expanded testing, and detection engineering for composite attacks. → csoonline.com |
| 2026-07-10 2026 | Claude Code is steganographically marking requests advanced 3 min read | Analysis of Claude Code reveals prompt steganography used to mark requests. The application locally alters the system prompt by subtly changing date separators or apostrophes, embedding classification data about API base URLs and system timezones. This technique, triggered by the `ANTHROPIC_BASE_URL` environment variable and specific geographical timezones, aims to detect API resellers and unauthorized gateways. While not malicious, the hidden implementation of this classification mechanism undermines trust in a tool with extensive filesystem and shell access. |
| 2026-07-10 2026 | Symlinks Are Still Scary (And Yes, You Can Commit Them to Git) intermediate 12 min read Supply Chain | Library detailing symlink attacks, a decades-old vulnerability vector enabling arbitrary file access and RCE. These attacks leverage symbolic links, small files containing paths that, when opened by a program, redirect to another location. Git's support for committing symlinks allows attackers to ship them in repositories, posing risks to build scripts, editors, and AI agents that process files without proper path resolution. The library highlights historical examples like CVE-2021-32803, Zip Slip, CVE-2024-21626, and CVE-2024-32002, alongside modern instances in Incus, emphasizing the need to resolve paths atomically before operation. → snyk.io |
| 2026-07-09 2026 | GhostApproval: A Trust Boundary Gap in AI Coding Assistants advanced 10 min read AuthZ | Library for detecting GhostApproval, a trust boundary gap vulnerability in AI coding assistants affecting Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This vulnerability exploits symlink following (CWE-61) and UI misrepresentation (CWE-451), allowing malicious repositories to trick agents into writing to arbitrary files outside the workspace, potentially leading to remote code execution by concealing the true target from the user during confirmation prompts. → wiz.io |
| 2026-07-09 2026 | Secure AI Workflows: The Identity and Access Management (IAM) Checklist beginner 3 min read Supply Chain | Checklist for securing AI workflows, focusing on Identity and Access Management (IAM) for both human-assisted AI (e.g., Claude Code, Cursor via MCP) and autonomous agents in CI/CD. It details an 8-point roadmap, including disabling anonymous access, using vetted MCP servers, employing restricted scoped tokens with downscoping, dynamic permission validation, audit log visibility via custom user-agent headers, composite identities for agents, restricting write operations (e.g., pull requests), and enforcing deterministic infrastructure-level IAM policies to prevent prompt injection attacks against production databases. The checklist principles apply broadly, though examples are from the JFrog Platform. → jfrog.com |