A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...

As we adjust our print schedule, launch a new website and rely on the U.S. Postal Service for delivery, please know these changes were not made lightly. They were made with our readers in mind — and ...

mcp-socd is a stdio proxy that sits between an AI agent and its MCP server. Every tool call is intercepted, classified against a typed action catalog, and gated by a default-deny policy before it ...

Ongoing research into AI agent framework security identified an exploit chain in AutoGen Studio (AutoGen’s open-source prototyping user interface) that allows untrusted web content rendered by a ...

AI engineer turned founder. Building Usenocta.app. Speaker at 42 Paris, NASA judge. Writing about AI agents, and startups. My agent leaked a customer's email address to another customer on day three.

I am a Software Engineer with 14 years of experience in industry. I am here to share my learnings and experiments with technology. I am a Software Engineer with 14 years of experience in industry. I ...

OpenAI has disclosed that two of its employee devices in its corporate environment were impacted via the Mini Shai-Hulud supply chain attack on TanStack, but noted that no user data, production ...

Unsafe defaults in MCP configs open servers to possible remote code execution, as evidenced by several commercial services and open-source projects. AI agent building tools enable users to configure ...

On Monday, the Axios npm supply chain attack came to light where malicious packages had been inserted into one of JavaScript’s most widely used libraries. Three major threat intelligence firms have ...

Serpentine builds a code reference graph for Python, JavaScript/TypeScript, Rust, and Terraform projects. A code reference is when one named entity mentions another by name — a function call, a type ...

Over the past year, Microsoft Threat Intelligence observed the proliferation of RedVDS, a virtual dedicated server (VDS) provider used by multiple financially motivated threat actors to commit ...