标签：#SEC

github.com/deghosal-2026/agent-tooltrust · pip install agent-tooltrust · field test report · design decisions My last three projects taught me the same thing. Mock agents lie. Unit tests pass. Demos look clean. Then real agents run and everything breaks. On my eval harness, I admitted it: field testing "got added ad hoc, late in the build, because I started getting nervous that unit tests and mock agents were hiding real integration problems." On my observability tool: "I thought it was a detector problem. I was wrong." Same lesson. Three times. But lessons only matter if you change what you do next. So this time I did the opposite. Zero mock agents. 83 real ones across 10 frameworks. A covering design that cut a 12-day test matrix into one afternoon. And a release gate that said: no ship until real agents prove the policy works. It worked. 2,490 tests green. 83/83 agents passed. PyPI published. Repo public. And the 7 failures taught me something I couldn't have learned any other way. The Problem With Allow-Lists Everyone is racing to give AI agents more tools. Almost no one is building the permission system that decides when those tools should fire. Right now, agent permissions are binary: allowed or denied. That's reachability, not authorization. The same tool is harmless in staging and dangerous in production. The same read is fine on public docs and risky on customer data. A delete in a CI sandbox is not the same as delete in production. About 18% of MCP server deployments implement any access scoping. 80% of orgs admit agents have taken actions beyond intended scope. OWASP classifies agent tool misuse as a first-class risk. Giving an agent tools is the easy part. The hard part is deciding what it should be allowed to do, where, and under what guardrails. I wrote a PRD and architecture spec before touching engine code — partly to keep myself honest, partly because I've learned the hard way that skipping design leads to shipping the wrong thing. What I Built Agen

The nastiest failure mode in a remote coding agent is not a bad patch. It is a permission prompt that nobody can see. You start a long-running job on a workstation, leave the desk, and check it from a phone later. The agent reaches a command that needs approval. If that request only exists as a modal in the desktop UI, the job has not technically failed. It has just stopped forever. That is worse. A failed job is observable. A hidden wait looks healthy until someone notices no work has moved. The permission prompt is protocol state The fix starts with a small change in how you model approval. A permission request is not UI state. It is durable state owned by the job that is doing the work. The lifecycle should look more like this: asked → persisted → surfaced → answered → applied → resolved The desktop dialog, phone screen, CLI, or web controller is only one view over that state. Closing a window must not erase it. Reconnecting must not create a second request. Two controllers must not be able to resolve different requests because a stale button happened to be on screen. This also changes what a remote-control protocol needs. A controller should be able to fetch job status with pending approvals, submit an answer for one request ID, and observe the resulting event. It should not become a filesystem or runtime proxy just to click “allow.” What needs to survive a disconnect At minimum, the pending request needs a stable request ID, its owning job/session, the requested action and resources, and enough ordering information to render concurrent requests deterministically. The answer also needs an identity. If request abc is pending, an answer for xyz must fail. Replaying the same answer for abc should be harmless. Replaying a different answer under the same ID should not quietly overwrite the first decision. That sounds fussy until a phone reconnects on a flaky network and retries the last command. Then it is the difference between idempotence and “the agent ran it twic

The mental model that fixes everything JWT is just a token format . It is not authentication, not a session, and not a database. Once you separate those ideas, most of the pain disappears. A JWT is a JSON object that is signed. That's it. The payload holds claims like sub (subject) and exp (expiration). The signature proves the token wasn't tampered with. What JWT is not Not a session store : You can't revoke a JWT before it expires. If you need revocation, you need a blocklist or short expiry. Not a database : Don't stuff heavy data in the payload. It gets sent on every request. Not a magic bullet : It's a way to pass claims between parties without a shared server-side state. The three flows that matter 1. Access token only Simplest flow: login returns a JWT, client sends it in the Authorization header, server verifies it on every request. // server middleware (Express example) const jwt = require ( ' jsonwebtoken ' ); function auth ( req , res , next ) { const header = req . headers . authorization ; if ( ! header ) return res . status ( 401 ). json ({ error : ' No token ' }); const token = header . split ( ' ' )[ 1 ]; // Bearer <token> try { req . user = jwt . verify ( token , process . env . JWT_SECRET ); next (); } catch ( err ) { res . status ( 401 ). json ({ error : ' Invalid token ' }); } } Works fine for small apps, but every request hits your auth logic and the token can't be invalidated early. 2. Access + refresh token Common pattern for SPAs. Access token lives 15 minutes, refresh token lives 7 days. The refresh token is stored securely (httpOnly cookie) and used only to get a new access token. // issue tokens on login const accessToken = jwt . sign ({ userId }, process . env . JWT_SECRET , { expiresIn : ' 15m ' }); const refreshToken = jwt . sign ({ userId }, process . env . REFRESH_SECRET , { expiresIn : ' 7d ' }); res . json ({ accessToken }); res . cookie ( ' refreshToken ' , refreshToken , { httpOnly : true , secure : true , sameSite : ' strict ' })

The data was scraped and exfiltrated from 2,500 users of a compromised AI package.

AI agents that break free and hack into other systems are only trying to make us happy.

An extortion gang known for targeting transportation companies and private equity firms has taken credit for a breach at Uber Freight.

I spend most of my time building evidence layers for AI agents. The reflex in that work is to reach for a signature. Something happened, sign the record, hand it to the auditor, done. Three things from the last five months say that reflex is wrong, or at least badly incomplete. One is a governance draft that never asks for a signature at all. One is a CVE where the signature verified correctly and the client still ended up talking to an attacker. One is a limit in a spec I wrote myself. Read together they point at the same thing. A signature is a statement about an object. Almost every security question you actually care about is a statement about a relationship. Case one: the requirement that is not there The Open Secure AI Alliance published its Shared AI Findings Exchange draft on GitHub on August 3. It is an incident-reporting compact for AI agents. Members agree to report when an agent they operate accesses or disrupts a third-party system without authorization, and to do it on a clock: notify the affected organisation as soon as possible, notify customers with credible exposure within 72 hours, file a confidential report within four business days. The clock is well specified. So is the evidence. Members must preserve and provide affected organisations with "prompts, traces, tool calls, logs, configurations, model and safeguard versions and third-party dependencies", plus agent and workload identities, permissions and credentials available during the run, human approval events, and a complete incident timeline. That is a good list. It is close to the one I would have written. Now search the draft for signing. It appears exactly once, in a list of example recommendations that incident reviews might produce: "signed evaluation manifests". The draft also asks, in its review framework, whether "data boundaries [were] independently verified". Both of those are about keeping an agent inside its box. Neither applies to the record of what happened when it got out. The

This is the latest zero-day released by security researcher Nightmare Eclipse, despite Microsoft publicly threatening to take legal action against them.

A public AI tool found the dangerous Zoom flaw in under 20 prompts.

If you compare live update solutions for long enough, you will run into a security claim that sounds decisive: "end-to-end encrypted." It suggests that solutions offering encryption are more secure than solutions that "only" sign their updates. That framing mixes up what the individual security controls in an update pipeline actually do. In this post, we walk through the threat model of live updates (also known as OTA updates or CodePush): what HTTPS already protects, what code signing guarantees, what encryption adds on top, and which of these properties matter for your app. By the end, you can evaluate the security of any live update solution based on facts instead of buzzwords. Key Takeaways HTTPS protects update bundles in transit. It does not protect against a compromised update service, storage bucket, or CDN. Code signing with a developer-held private key guarantees authenticity and integrity all the way to the device: even a fully compromised update infrastructure cannot inject code into your app. Encrypting bundles adds confidentiality only. It provides no additional protection against malicious updates. Client-side encryption cannot keep app code secret, because the decryption key must ship inside the app binary. The React Native maintainers state it plainly: "Code on the client is not secret." If bundles must stay confidential, for example in privately distributed enterprise apps, self-hosting them is a stronger control than encrypting them. The Trust Chain of a Live Update Every live update passes through the same chain: you build a web bundle in your CI/CD pipeline, upload it to an update service, the service stores and serves it (usually through a CDN), and the Live Update SDK in your app downloads and installs it. Security along this chain means three different properties: Authenticity : The update genuinely comes from you. Integrity : The update was not modified on the way. Confidentiality : No third party can read the update's content. For code that

¿Tu equipo comparte credenciales por Slack? ¿Discuten arquitectura en plataformas que almacenan cada mensaje en servidores ajenos? Existe una alternativa que no depende de la nube: NETO . ¿Qué es NETO? NETO es un chat peer-to-peer diseñado para redes locales . No hay servidor central, no hay cuentas, no hay datos saliendo de tu oficina. Abres el navegador, y los compañeros de tu LAN aparecen automáticamente gracias a mDNS (Multicast DNS), el mismo protocolo que usa Bonjour para descubrir impresoras y servicios locales. Sin registro. Sin configuración. Sin fricción. Cifrado de extremo a extremo real Cada conexión entre peers se establece mediante WebRTC , creando canales de datos directos entre navegadores. Antes de intercambiar un solo mensaje, NETO realiza un intercambio de claves con X25519 (Curve25519 en

✓ Human-authored analysis; AI used for formatting and proofreading. SadCloud is an open-source Terraform project by NCC Group that deploys misconfigured AWS resources. Security teams use it to test their tooling: if your scanner can't find the misconfigurations in SadCloud, it can't find them in production. We pointed Stave at SadCloud. Then at BishopFox's IAM Vulnerable. A lab focused on IAM privilege escalation paths. The numbers tell a story about what happens when you move from per-resource scanning to compound attack path analysis. The raw numbers Metric SadCloud (NCC Group) IAM Vulnerable (BishopFox) Assets evaluated 36 31 Atomic violations 992 837 Compound chains firing 84 instances (13 unique) 70 instances (6 unique) Near-miss chains 785 instances (40 unique) — A per-resource scanner (Prowler, ScoutSuite, Checkov) would show 992 findings for SadCloud. Each finding stands alone: this bucket is public, this role is overpermissioned, this trail isn't logging. The operator opens a dashboard with 992 items sorted by severity and starts scrolling. Stave's compound-only default output shows 84 findings across 13 named attack paths. Same underlying data. Different composition. The 992 atomic violations still evaluated. They're the detection infrastructure. The 84 compound chains are the findings that reach the operator. That's a 12x reduction by composition. Compound chains Each compound chain fires when multiple controls fail simultaneously on related assets, matching a named attack pattern: Chain Severity Instances What it means iam_escalation_undetected critical 36 IAM roles can escalate privileges and no detective control monitors the escalation path iam_boundary_governance_failure critical 36 No permission boundary constrains IAM principals in the account — any role can reach any resource iam_session_opacity high 2 IAM session activity isn't logged at the detail level needed to detect credential abuse s3_ssec_ransomware_path critical 1 S3 bucket is vulnerable t

Security researchers found that in less than 60 seconds, they could open a hatch on a plane’s exterior, plug in a tiny device, and redirect the aircraft’s autopilot or sabotage its flight plan.

Last week, an AI newsroom beat mainstream journalists—including WIRED—to a story about OpenAI and hacking. It’s just the beginning.

Experts allege that two recent incidents in California show the extreme lengths that criminal organizations are willing to go to to steal servers and other gear meant for data centers.

Details from recent court filings show that DOGE's influence within government—and potential conflicts of interest—extend further than previously known.

I have four different load_env() functions in my MCP server project ( my-git-manager ) — one in server.py , one in publish_devto.py , one in reply_comments.py , one in scripts/list_all_published_titles.py . All four exist for the same dumb reason: this repo has no dependency on python-dotenv , so each script that needs GITHUB_TOKEN or DEV_TO_API reads .env by hand. I went digging for a fresh bug in this repo this week — I write a lot about it, and the well is getting shallow — and decided to actually diff all four load_env() implementations against each other instead of reading them one at a time like I usually do. They'd never been compared side by side before. That's how I found this one. The line that started it Every one of them does roughly this: for line in f : line = line . strip () if " = " in line and not line . startswith ( " # " ): k , v = line . split ( " = " , 1 ) os . environ . setdefault ( k , v . strip (). strip ( '"' ). strip ( "'" )) Look closely at what gets .strip() ed there. v — the value — gets stripped of whitespace and surrounding quotes. k — the key, the actual name of the environment variable — gets nothing. That's fine if your .env file looks like this: DEV_TO_API = abc123 It's not fine if it looks like this: DEV_TO_API = abc123 Spaces around = are a completely normal thing to type. Plenty of .env examples online use them. Plenty of people reach for that style out of habit from other config formats. And line.split("=", 1) doesn't care — it splits on the first = no matter what's next to it, so k comes out as "DEV_TO_API " , trailing space included. What that trailing space actually does os.environ.setdefault("DEV_TO_API ", "abc123") sets an environment variable. It's just not the one anything is looking for. Every caller in this repo does os.environ.get("DEV_TO_API") — no trailing space, because that's the name everyone actually types. That lookup returns None , or whatever was already sitting in the environment before .env ever got read. I

Gunra Ransomware: RaaS Exploiting FortiGate for VDI Sessions, OTP Theft, SaaS Exfiltration, and Encryption 1. Basic Information Severity : Critical Title : #StopRansomware: Gunra Ransomware (AA26-222A) Publishers : CISA / FBI / DC3 / NSA / USSS / Korean National Police Agency (KNPA) Publication Date : 2026-08-10 Original Source : https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a Primary PDF : https://media.defense.gov/2026/Aug/10/2003976697/-1/-1/0/CSA_STOPRANSOMWARE_GUNRA_RANSOMWARE.PDF Related Sources : NSA Announcement: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4567025/nsa-joins-fbi-and-others-in-releasing-guidance-to-defend-against-gunra-ransomwa/ BleepingComputer: https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/ Related Malware, Groups, CVEs, and Products : Gunra, Golden Community, Conti variant, CVE-2024-55591, CVE-2025-24472, FortiOS, FortiProxy, SSL-VPN, VDI, Active Directory, Hiware, OneDrive, SharePoint, Mega, Sliver, Impacket, RClone 2. Executive Summary This is a double-extortion Ransomware-as-a-Service (RaaS) that enters networks through FortiGate/VPN authentication bypasses or default credentials. It modifies VPN traffic to steal sessions, implants static OTP backdoors into VDI authentication processes, steals dozens of terabytes of data from Active Directory, management servers, and SaaS platforms, and finally encrypts Windows and Linux systems. 3. Attack Flow Chain A: Fortinet-Initiated (Observed by FBI) Exploits CVE-2024-55591 or CVE-2025-24472 on internet-facing FortiOS/FortiProxy to bypass authentication. Gains access to the firewall/SSL-VPN and performs internal reconnaissance. Performs SMB lateral movement using Impacket's psexec.py or smbclient.py . Executes secretsdump.py on the domain controller to retrieve password hashes derived from NTDS.dit . Moves to privileged system accounts using pass-the-hash/pass

Kimwolf v7: Android/IoT Botnet with HTTP/2 Browser Spoofing DDoS and ENS/Tor Three-Layer C2 1. Basic Information Severity : High Article Title : Kimwolf v7: An Evolution of the Kimwolf Botnet Publisher : Unit 42 / Palo Alto Networks Publication Date : 2026-08-11 Original Source : https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ Related Sources : Unit 42 IOCs and Analysis Materials: https://github.com/pan-unit42/iocs/tree/master/Kimwolf-v7 BleepingComputer (Large-scale DDoS Observation): https://www.bleepingcomputer.com/news/security/ddos-attacks-over-1-tbps-surged-fivefold-in-the-second-quarter/ Related Malware, Groups, and Products : Kimwolf v7, AISURU, Android TV box, set-top box, Android Debug Bridge (ADB), Ethereum Name Service (ENS), Tor, nghttp2, BoringSSL Main IOCs : netd_service , TVHelper , 127.0.0.1:23075 , eth.rpcuniverse[.]com , 212.193.31[.]119:13 , 212.193.31[.]122:13 , 212.193.31[.]92:443 , 212.193.31[.]158:443 2. Executive Summary This is a new version of the botnet that uses residential proxies to reach unauthenticated ADB and turn Android TV devices into bots. It maintains DDoS and proxy relay capabilities using Chrome-like HTTP/2 floods and a fault-tolerant C2 that combines ENS, Tor, and local SOCKS proxies. 3. Attack Flow Chain A: Infection and Bot Registration The attacker uses a residential proxy exit node as a stepping stone to reach ADB TCP/5555 on the local network. The attacker finds Android TV boxes or set-top boxes where ADB is active and requires no authentication. The attacker drops and runs an ARM ELF payload via an external loader or APK wrapper. For APK variants, a Java wrapper disguised as SystemService runs an embedded ELF such as libdevice.so . Some samples check for root access, but public sources do not explain how this affects execution. Some samples use BootReceiver to run after reboot. The ELF creates a Unix domain socket to prevent multiple instances and changes its process name to netd_service or TVHelper . It

I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...