» Tag
security
437 postsALIBI: Adversarial Comments Bypass LLM Vulnerability Detectors
ALIBI framework shows LLM-based vulnerability detectors can be bypassed over 90% of the time using adversarial source-code comments.
Rethinking MCP Security: A Large-Scale Study of 64K Runtime Servers
MCPZoo tests 64,611 MCP servers, revealing that most security scanner alerts are false positives and scanners disagree widely.
AI Jailbreak Benchmark Reveals 100x Safety Gap Between Models
New benchmark shows up to 100x safety gaps among frontier AI models against jailbreak attacks; some models yield zero jailbreaks.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comRust crate arrayref 0.3.10 pulls in malware via proc-macro1 dependency
crates.io package arrayref 0.3.10 pulls in malicious proc-macro1, executing remote payloads and affecting Rust GUI projects like egui and iced.
221,000 Live Secrets Found in 7.6PB of Hugging Face Training Data
Researchers scanned 7.6PB of Hugging Face training data and found 221,303 live secrets — GitHub, GCP, database, and AI provider credentials.
ButterClaw: Self-Hosted Runtime Security for AI Agents, No Cloud
ButterClaw enforces AI agent security locally with regex signatures, a local LLM verdict pipeline, and SIGKILL/credential shredding — no cloud, no telemetry.
CodeCrucible: A Reusable Blueprint for LLM-Driven SAST
Block's CodeCrucible offers a reusable design blueprint for LLM-driven SAST, using whole-repo analysis instead of snippet-anchored vulnerability scanning.
How Anthropic bakes security into its Claude-driven dev lifecycle
A look at how Anthropic embeds AI-driven security checks across coding, CI review, and deployment in its Claude-based dev lifecycle.
Static Scanner Finds 30 Unguarded Destructive Actions in AI Agent Frameworks
An open-source scanner analyzed 25 AI agent frameworks and confirmed 30 cases where models can delete data, deploy, or send webhooks unauthorized.
LLM-Assisted Formal Verification Uncovers Two Critical nftables Bugs
Basis used LLM-guided formal verification in Rocq to audit Linux's nftables optimizer, uncovering two critical bugs since 2022.