Here's the thing nobody wants to hear: we already know how to break systems where components blindly trust each other's output. We've known for twenty-five years. We just gave it a new name and forgot the lesson. Context An "AI harness" is orchestration glue. Take an LLM, wrap it with a bunch of connectors, plugins, and tool-calling scaffolding so it can actually do things (query a database, hit an API, write a file), and you've got a harness. The Dark Reading piece points out something structurally obvious once you say it out loud: these components form a chain of trust boundaries, and a lot of them don't verify what the component next to them is handing over. If that sentence gives you deja vu, it should. Deserialization bugs, SSRF via internal service calls, XML entity injection through a "trusted" upstream parser — the entire history of appsec is a history of Component A assuming Component B already did the validation. We keep rediscovering this pattern every time a new architecture pattern gets hot enough to attract production traffic before anyone's threat-modeled it. The new part isn't the trust boundary problem. The new part is that the thing sitting in the middle of the chain is a probabilistic text generator that can be talked into doing weird stuff by its own inputs, and it's now wired directly into tool execution. Hype check What's overstated: the framing that this is some novel AI-specific exploit class requiring AI-specific defenses. It's not. It's an integration security problem wearing an LLM costume. The moment you have plugins and connectors passing data between components without verification, you have the same problem you'd have gluing together any set of microservices with implicit trust. The attack surface is old news; the payload delivery mechanism (prompt-driven tool invocation) is what's new. What's understated: how fast harnesses are being shipped without anyone doing basic component-boundary threat modeling, because everyone's racing to sh

Back in February I published a post about osx-proxmox-next , a tool that builds a macOS VM on Proxmox with one command instead of an afternoon of OpenCore plist editing. About 1,500 people read it. Some of them installed it. On hardware I don't own. That's when the interesting bugs showed up. 150 commits later, here are five failures that don't appear in any macOS-on-Proxmox guide I've found, with the actual root cause for each. 1. The installer stalls at 100% CPU and nothing moves Symptom: macOS installer reaches the copy phase. CPU pegged at 100%. Disk IO and network throughput both flat zero. It sits there forever. Only on Xeon E5/E7 v2-v4 hosts. My first fix was wrong. The stall looked like a network problem, so I assumed the vmxnet3 kext was failing to load during install and swapped those hosts to e1000-82545em . Shipped it. Then issue #103 came back from someone with the actual hardware: vmxnet3 got network fine, and e1000-82545em did not attach at all. I had made it worse. The real cause is two layers down. Those chips are genuine HEDT parts with dual-socket / multi-die topology, and -cpu host leaks that topology straight through to the guest. Pair it with a MacPro7,1 SMBIOS, which macOS treats as multi-socket capable, and XNU's scheduler livelocks under heavy multithreaded IO. The installer copy phase is exactly that workload. The fix is to stop passing the host topology through: _XEON_HEDT_PATTERN = re . compile ( r " Xeon.*E[57][ -]*\d+ *v([234]) " , re . IGNORECASE ) def _xeon_hedt_cpu_model ( model_name : str ) -> str : match = _XEON_HEDT_PATTERN . search ( model_name ) if not match : return "" if match . group ( 1 ) == " 2 " : return " Haswell-noTSX,model=158,stepping=3 " return " Broadwell-noTSX,model=158 " Lesson I keep relearning: the symptom showed up at the network layer, the cause lived in CPU topology. Guessing from the symptom cost me a release. 2. The VM boots into Recovery forever Symptom: Fresh install finishes. Every subsequent boot lands b

When configuring Claude Code (or Claude-driven AI coding assistants) in your projects, structuring your instructions efficiently is key to getting accurate code generation while keeping token consumption low. Understanding when to use a single CLAUDE.md versus modular .claude/rules/ files will help keep your AI assistant sharp, focused, and predictable. The Core Hierarchy & Scope Claude Code looks for configurations across multiple levels: ├── ~/.claude/ # User / Global level (applies to all your projects) └── project-root/ ├── CLAUDE.md # Global project level (loaded into every session) ├── .claude/rules/ # Modular & scoped rules (loaded selectively) └── sub-app/ └── CLAUDE.md # Sub-directory / Monorepo scope CLAUDE.md (The Global Cheat Sheet)Think of CLAUDE.md as the main ReadMe for the AI. It provides high-level context and essential project memory. When to use CLAUDE.md:Common CLI Commands: Build, test, lint, and run scripts (npm test, docker compose up). Core Architecture: Tech stack summary, overall folder structure, and design principles. Global Rules: Non-negotiable guidelines that apply project-wide (e.g., "Strict TypeScript, no any"). Project Context: E-Commerce Web App Build & Test Commands Build: npm run build Test single file: npx jest src/components/Button.test.tsx Lint: npm run lint High-Level Guidelines All UI components must use React 19 functional syntax. Never hardcode secrets or environment variables. .claude/rules/ (Modular & Path-Scoped Rules)As projects grow, packing every guideline into CLAUDE.md bloats the prompt context and reduces overall compliance. The .claude/rules/ directory lets you create modular, topic-specific, or path-scoped rules (in .yml or .md). When to use .claude/rules/:Path-Specific Rules (globs): Guidelines that apply only to certain files (e.g., API routes vs. React components). Domain Separation: Splitting rules into dedicated files (testing.yml, security.yml, db-migrations.yml). Token Optimization: Prevent loading backen

Last week, a Baseten inference engineer who goes by @waterloo_intern published a technical blog post titled "22,580: From GPT-2 to Kimi K3, Explained." It hit 2.4 million views in days. He didn't write a press release. He wrote runnable PyTorch code — starting from GPT-2's attention block, stepping through every architectural change, explaining one problem and one cost per iteration. It's the best transformer lineage explanation I've seen. I devoured his post, then cross-checked the key claims against 5 original papers. Here's the full picture. The 22,580x Number In February 2019, OpenAI released GPT-2 — 124M parameters. Seven years later, Moonshot AI open-sourced Kimi K3 — 2.8T parameters. You could fit 22,580 GPT-2s inside one Kimi K3 . But this isn't a "throw more compute at it" story. It's a story about how we store, update, and retrieve memory . Starting Point: GPT-2 class Block ( nn . Module ): def forward ( self , x ): x = x + self . attn ( self . ln_1 ( x )) x = x + self . mlp ( self . ln_2 ( x )) return x Every time the model generates a new token, it recomputes Q, K, V projections for all historical tokens, then runs an O(N²) softmax attention. K and V from tokens 1 through N-1? Thrown away. Token N+1 arrives? Recompute everything. That's why KV Cache was invented. KV Cache: Store It, Don't Recompute Simple idea: cache the already-computed keys and values. For the next token, new Q only needs one dot product against the cached K. Problem solved — but a new one created. KV cache grows linearly with sequence length. At 1M tokens × d_model × layers, that's dozens of GB of VRAM. Every decoding step reads all of it from HBM. The bottleneck isn't compute. It's memory bandwidth. This is the key to understanding every improvement that follows. Linear Attention: Fixed-Size Memory Can we compress O(N²D) into O(ND²)? The idea: replace softmax with a feature map. # Standard softmax (must materialize N×N first) attention = softmax(QKᵀ / √d) × V # Linear attention (fold

The biggest reason NVIDIA began providing GPL-licensed kernel modules is that its driver architecture evolved to the point where Linux integration, distribution, and maintenance could be greatly simplified while keeping the GPU's critical intellectual property in firmware and user-space components . To be precise, NVIDIA did not open-source its entire driver stack. The components that became open are primarily the following Linux kernel modules: nvidia.ko nvidia-drm.ko nvidia-uvm.ko nvidia-modeset.ko User-space components such as CUDA, OpenGL, Vulkan, and the GSP firmware remain proprietary. ( NVIDIA Developer ) 1. To make integration with Linux distributions easier Previously, NVIDIA's proprietary kernel modules had to be built, signed, and distributed separately from the Linux kernel. A DKMS-based workflow, which rebuilds modules after every kernel update, commonly led to problems such as: Kernel modules failing to build after kernel updates Unsigned modules being blocked by Secure Boot Linux distributions having difficulty maintaining the driver as an official package Increased complexity when integrating with custom kernels or cloud environments By publishing the source code, distributions such as Ubuntu, Red Hat, and SUSE can integrate NVIDIA's kernel modules into their own packaging, signing, and update infrastructure much more easily. NVIDIA itself cites tighter OS integration and simpler signing and distribution as key motivations. ( NVIDIA Developer ) 2. To improve debugging and security review Kernel modules interact with deep parts of the operating system, including memory management, interrupts, inter-process synchronization, PCI Express, and display subsystems. With the source code available, Linux distribution developers and enterprise users can: Trace where execution stops inside the kernel Analyze interactions between GPU events and workloads Fix incompatibilities with custom kernels Review security-related issues Submit patches to NVIDIA NVIDIA stat

Watching an autonomous agent run through a loop of tasks is like watching a black box try to solve a puzzle in another room. You can see the final result, but the middle part—the reasoning, the failures, and that pivotal moment where it realizes its plan was garbage—is buried in thousands of lines of unstructured logs. If you've ever deployed an agentic workflow only to check back an hour later and find it has been stuck in a high-latency loop of 'I made a mistake... let me try again' for forty minutes, you know the pain. You didn't have failure; you had expensive, silent repetition. The problem with current LLM observability is that we focus too much on the input and output (the traces) and not enough on the internal state transitions of the agent itself. We need to quantify how often an agent is actually self-correcting versus just spinning its wheels. I recently started working with a specific tool designed for this exact visibility gap: the Agent Self-Reflection & Sentiment Scanner . The Observability Gap in Agentic Loops When we talk about 'agents,' we're usually talking about a loop: Observe, Think, Act, Repeat. In a perfect world, the 'Think' step includes self-correction. If an action fails (e.g., a 403 error from an API), the agent should reflect on that failure and adjust its next move. But how do you measure if your agent is actually getting better during a session? How do you distinguish between an agent that is 'Proceeding' with confidence and one that is in a state of constant 'Correction'? You can't just look at the final success/fail status. You need to parse the execution logs for deterministic markers. Why Deterministic Matching Wins Over LLM-Based Analysis The temptation here would be to pipe your agent logs into another, even larger LLM and ask, 'Is this agent struggling?' Don't do that. It’s redundant, it’s slow, and if you're running high-volume loops, the cost will kill your margin. You've already paid for the primary reasoning engine; don't p

The Observability Black Box As autonomous AI agents evolve from isolated chat assistants into multi-agent systems executing multi-step business logic across databases, APIs, and microservices, enterprise platform teams face an acute operational challenge: black-box opacity. When an autonomous agent fails, hallucinates, or executes an out-of-bounds API call, traditional Application Performance Monitoring (APM) tools fall short. Standard HTTP request logging and basic prompt-response captures cannot reconstruct the non-deterministic reasoning loops, tool selection branches, or sub-agent delegations that led to an incident. Furthermore, enterprise auditors, security teams, and regulatory bodies (governed by SOC 2, FedRAMP, and the EU AI Act) now require non-repudiable proof of agent execution. Organizations must be able to answer five fundamental questions for every production run: Which human or non-human identity authorized the agent run? What planner reasoning path or tool routing logic was chosen? Which exact data assets or vector embeddings were retrieved into context? What was the precise execution latency, token cost, and error tax of each intermediate step? Can the complete execution graph be cryptographically reconstructed for compliance review? To resolve this challenge, platform engineering teams must deploy Audit, Observability & Lineage —an architecture anchored in OpenTelemetry (OTel), OWASP Agent Observability Standards, and immutable lineage graphs. Deep-Dive Architecture: OpenTelemetry & Lineage Integration A production-grade Agent Observability stack avoids proprietary vendor lock-in by standardizing on OpenTelemetry (OTel) OTLP trace ingestion and open metadata stores. 1. The Unified OpenTelemetry Span Tree Every agent execution unit — from user intent trigger to final task completion — is encapsulated within a single root trace context ( agent.run ). Sub-tasks, tool calls, and model invocations are recorded as hierarchical child spans: [ Root Trace:

JavaScript vs React: Understanding How They Work Together If you're starting web development, you've probably heard about JavaScript and React. Many beginners think they are competitors, but they actually work together. Let's understand them in simple terms. What is JavaScript? JavaScript is a programming language used to make websites interactive. Without JavaScript, a website would mostly be static. JavaScript allows you to: Handle button clicks Validate forms Create animations Fetch data from APIs Update content without refreshing the page Example: document . getElementById ( " btn " ). addEventListener ( " click " , () => { alert ( " Hello World! " ); }); JavaScript is the foundation of modern web development. What is React? React is a JavaScript library created by Meta Platforms for building user interfaces. Instead of manipulating the webpage manually, React helps developers create reusable UI components. Example: function Welcome () { return < h1 > Hello World! </ h1 >; } React uses JavaScript to create dynamic and interactive user interfaces more efficiently. Simple Analogy Think of building a house: JavaScript = The tools and materials (bricks, cement, wood) React = A construction framework that helps you build the house faster and more efficiently You need JavaScript to use React. Key Differences Feature JavaScript React Type Programming Language JavaScript Library Purpose Adds logic and interactivity Builds UI components Learning Curve Easier to start Requires JavaScript knowledge Usage Works everywhere Used mainly for frontend applications Created By Netscape Meta (Facebook) DOM Updates Manual Virtual DOM for optimized updates Why React Became Popular As applications grew larger, managing UI with plain JavaScript became difficult. React solves this by providing: Component-based architecture Reusable code Better state management Faster UI updates with Virtual DOM Large ecosystem and community support This makes React ideal for building modern applications

Unified video generation for motion design and branding Discussion | Link

STAC4749: Chaos Ransomware in Under 17 Hours via Teams IT Support Scam 1. Basic Information Article Name : Chaos in Teams vishing Publisher : Sophos Publication Date : 2026-07-28 (Detailed report by target site BleepingComputer on 2026-07-30) Original Source : https://www.sophos.com/en-us/blog/chaos-in-teams-vishing Related Source : https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ Related Entities : STAC4749, Chaos ransomware, Quick Assist, RemSupp, DWAgent, AnyDesk, PyInstaller backdoor, reverse SOCKS proxy Severity : High 2. Executive Summary An attacker uses an external Teams account to pose as IT support and tricks the user into allowing remote control. The attacker then deploys PowerShell, a custom loader, multiple RMM tools, and a SOCKS tunnel. This leads from lateral movement to simultaneous encryption in less than 17 hours at the shortest. 3. Attack Flow An external Teams account with an IT-like .top domain starts a chat and a call. The attacker poses as IT support and establishes a remote session using Quick Assist or RemSupp. The attacker runs PowerShell to download a loader from an external server and executes it in AppData\Roaming or similar folders. The loader collects device information, sets persistence via Run keys, and connects to the C2 server. A PyArmor-obfuscated PyInstaller backdoor runs shell commands, loads extra Python modules, and stages collected data. The attacker installs DWAgent and AnyDesk as backup access, enables RDP, and tries to move laterally. The sc5.exe reverse SOCKS proxy relays internal network traffic. The attacker steals data in at least one case, and then encrypts multiple devices with Chaos almost at the same time. 4. Attacker Locations and Execution Sites Initial contact occurs via an external Microsoft 365 tenant. Operations run through legitimate remote support tools on the victim device. Subsequent activities happen on Windows devices and the internal netwo

GTIG: 2026 OSS Supply Chain Compromise, Credential Theft, and Self-Propagation 1. Basic Information Article Title : Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise Publisher : Google Threat Intelligence Group / Mandiant Publication Date : 2026-07-30 Original URL : https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/ Related Sources : TeamPCP, axios, and WAVESHAPER.V2 investigations within the article Related Entities : UNC6780/TeamPCP, SANDCLOCK, MIDNIGHT NEPTUNE/UNC1069, WAVESHAPER.V2, npm, PyPI, Docker Hub, GitHub Actions, axios Severity : High 2. Executive Summary Attackers are stealing credentials from developers, maintainers, and CI/CD pipelines to tamper with legitimate packages. This attack model is growing on a large scale: it steals cloud secrets from user environments, self-propagates to other packages, and leads to ransomware or extortion. 3. Attack Flow UNC6780 / TeamPCP Attackers gain write permissions by abusing GitHub Actions pull_request_target , compromising maintainer accounts, or publishing malicious packages. They inject malicious code into legitimate and spoofed packages on PyPI, npm, and Docker Hub. Users execute the code during installation on their development devices or in CI/CD pipelines. Tools like SANDCLOCK steal credentials for the cloud, CI/CD, and package registries. Attackers tamper with other packages owned by the victim to spread like a worm. They pivot from AI software into wider enterprise networks. They monetize the stolen credentials by selling them or partnering with ransomware and data extortion groups. axios / MIDNIGHT NEPTUNE Attackers compromise maintainer accounts using social engineering. They add malicious dependencies to the legitimate axios package and publish a new version. Dependency resolution spreads the package to many users and downstream packages. A dropper deploys the WAVESHAPER.V2 backdoor. 4. Attacker Position and Execution Locati

TA488 OWAReaper: A "Half-Click" Attack that Adds Persistence Inside OWA Just by Opening an Email 1. Basic Information Article Name : Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit Publisher : Proofpoint Threat Insight Publication Date : 2026-07-29 Original Source : https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit Related Source : https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/ Related Entities : TA488, Void Blizzard, Laundry Bear, OWAReaper, ZimReaper, CVE-2026-42897, Microsoft Exchange Outlook Web Access Severity : Emergency Target Period : 2026-07-30T08:10:34+09:00 to 2026-07-31T08:06:06+09:00 2. One-Line Summary This is an attack where viewing a crafted email in OWA runs JavaScript, leaves no file on the device, achieves persistence in both the browser and Exchange, and steals saved credentials, OAuth tokens, and mailbox permissions. 3. Attack Flow A compromised account sends a normal informational email with no URLs or attachments. The victim opens the email in the OWA reading pane. CVE-2026-42897 triggers an onload event, and reconstructs Base64 JavaScript from image fragments in the email body. OWAReaper runs in the OWA browser context and deletes the malicious parts from the original email. It collects browser autofill IDs and passwords using an invisible DOM input field. It hides its encrypted self inside OWA settings to run again when OWA syncs and restores. It steals OAuth tokens via a privileged Outlook add-in. It gives Owner permissions to the Default principal on all mail folders, allowing continuous access from another authenticated account in the same organization. It embeds an iframe into the IndexedDB offline mail cache to reinfect it. It receives commands from GitHub commit messages or attacker emails, and sends data through multiple paths. 4. Attacker Position and Execution L

KindaRails2Shell (CVE-2026-66066): Arbitrary File Read and RCE via Active Storage Uploads 1. Basic Information Article Title : Alert on Vulnerability in Ruby on Rails Active Storage Leading to Remote Code Execution Publisher : JPCERT/CC Publication & Update Date : 2026-07-30 Original Article : https://www.jpcert.or.jp/at/2026/at260021.html Related Sources : https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm Related Entities : CVE-2026-66066, KindaRails2Shell, Ruby on Rails, Active Storage, libvips, ruby-vips Severity : Critical 2. One-Sentence Summary This is a vulnerability that combines Active Storage direct uploads and variant processing by libvips, allowing attackers to upload a crafted file without authentication, read files and credentials on the server, and potentially execute code under the Rails process permissions depending on the conditions. 3. Attack Flow The attacker discovers or guesses that the target Rails app uses Active Storage. The attacker registers a crafted file to the unauthenticated direct upload feature. The attacker triggers variant processing, which is handled by the vulnerable Active Storage and default builds of libvips. The attacker reads arbitrary files on the server. The attacker retrieves Rails secrets, cloud credentials, database credentials, and other sensitive data. The attacker may achieve remote code execution by using the retrieved secrets or the processing chain. The attacker may move laterally to databases, storage, cloud environments, or CI/CD pipelines as a next step (Inference). 4. Attacker Position and Execution Location The attacker uploads files from the external network via HTTP. The processing happens on the Rails application server and the libvips process. Remote code execution runs with the OS permissions of the Rails or variant processing service. 5. What Victims and Administrators See Even without a user-facing upload screen, apps can be vulnerable if Active Storage is enabled. Administrators m

Disclosure: BrowserAct sponsored this piece. The BrowserAct links below are affiliate-tracked — I get...