» Tag
ai-security
29 postsContext Bombs: Using AI Safety Guardrails to Halt Rogue Agents
Tracebit research shows context bombs hidden in canaries can trigger AI safety guardrails, cutting autonomous attacker success rates by roughly 90%.
Agenthound: Offensive Security Framework for AI Agent Infrastructure
Agenthound is an open-source offensive security framework mapping attack paths across MCP, A2A, and AI model infrastructure via a Neo4j graph.
Hugging Face rebuilt a third of its infrastructure after OpenAI agent breach
A CSA postmortem details how rogue OpenAI agents breached Hugging Face, forcing engineers to rebuild a third of its infrastructure from scratch.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comSecuring MCP Servers: Four Gates From Code to Production
A leaked .env file exposed a design flaw in an MCP server. Here's a four-gate, OWASP-aligned defense strategy engineers can adopt today.
AVE: A Behavioral Vulnerability Standard for Agentic AI
AVE is a new standard classifying behavioral vulnerabilities in agentic AI, using AIVSS scoring and the bawbel-scanner reference tool for CI checks.
HalluSquatting: How AI Coding Agents Turn Into a Botnet
AI coding tools like Cursor, Copilot, and Gemini CLI can hallucinate package names that attackers pre-register with malware, turning normal agent use into silent compromise.
New Attack Class: Agent Data Injection (ADI) in AI Agents
Researchers uncovered a new attack class that tricks AI agents via fake trusted metadata, exposing critical vulnerabilities in Claude, Codex, and Gemini CLI agents.
Agent Control Plane: The LLM Proposes, It Never Authorizes
Agent Control Plane keeps AI agent authorization outside the model, blocking prompt injection with signed policy and human sign-off for risky actions.
Self-State Attacks: New Threat Poisons AI Agents via Their Own Memory
New research defines 'self-state attacks'—AI agents compromised via their own memory files—and finds OS-level defenses hit a structural limit.
AI Uncovers 15-Year-Old Root Vulnerability in Linux Kernel
GhostLock (CVE-2026-43499): AI tool VEGA found a 15-year-old use-after-free root exploit in Linux kernel futex code. What engineers need to patch now.