» Tag
ai-security
32 postsAI Uncovers 15-Year-Old Root Vulnerability in Linux Kernel
GhostLock (CVE-2026-43499): AI tool VEGA found a 15-year-old use-after-free root exploit in Linux kernel futex code. What engineers need to patch now.
Researcher Tricks Claude Into Leaking User Secrets via Web Fetch
How a researcher exploited Claude's memory and web_fetch tool to silently exfiltrate a user's name, employer, and security answers letter by letter.
Enterprise AI Agents Are Now Runtime Products, Not Model Wrappers
Drawing on LangChain-NVIDIA's NemoClaw and Schneider Electric's LangSmith case study, this piece explains why enterprise AI agents are runtime products defined by permission boundaries, audit trails, and deployment—not just models.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comAI Sandboxing: The Real Risk Lives in Infrastructure, Not the Model
As autonomous AI agents gain access to tools, credentials, and infrastructure, security focus is shifting from model behavior to runtime isolation and sandboxing.
WriteOut Flaw in Writer AI Enabled Cross-Tenant Account Takeover
A critical flaw dubbed WriteOut let attackers hijack any Writer AI account by leaking session cookies through the platform's sandbox. Writer has since patched it.
After gpg.fail: responsible disclosure and GPG's security reckoning
A 39c3 talk details unpatched GPG vulnerabilities, GnuPG's disputed response, and what AI means for security research and disclosure.
Prompt Injection Is Now an RCE Primitive for AI Agents
Prompt injection in tool-using AI agents can now lead to remote code execution. A reachability-graph defense model based on Microsoft's Semantic Kernel flaws.
The Lethal Trifecta Hiding in Your MCP Server, and How to Defuse It
An exploit-free attack on GitHub's MCP server reveals the 'lethal trifecta' risk in agent tooling, and the architectural fix engineers need.
AI's next phase: from smarter chat to controlled systems
HalluSquatting attacks, Prime Intellect's $130M raise, and DeepSeek's chip plans show AI advantage shifting from model choice to workflow control.
Shadow AI: You Can't Secure the AI Systems You Can't See
Enterprise AI adoption is outpacing visibility. A look at shadow AI risks and how an AI Bill of Materials helps discover, own, and govern hidden AI systems.