标签：#SEC

A green test suite is evidence. It is not independent evidence. The current release of badBANANA Threat Observatory passes all 108 automated tests in its own development and CI environments. That tells me the implementation satisfies the assertions I wrote against the conditions I expected. It does not tell me whether an independent developer can check out the same commit in a clean environment and obtain the same result. That distinction matters more than the number 108. The dangerous failure is a believable one The Observatory presents source-backed threat-intelligence records, freshness information, and material-change events. In that kind of interface, an obvious crash is not necessarily the worst outcome. A more dangerous failure is one that looks healthy: An expired cached snapshot presented as current An invalid expiry value treated as usable A failed upstream source displayed as a successful zero-result response Demo or fallback data appearing without explicit disclosure A disabled or offline state silently normalized into success Those failures do not merely inconvenience the user. They change what the interface appears to know. For v1.2.2, the intended behavior is deliberately fail\ closed: Condition Required behavior Cached snapshot has expired Report it as stale Expiry value is invalid Fail closed to stale Source is offline, disabled, or failed Preserve that state Source data is missing or unavailable Do not present a successful zero result state Ingestion requests overlap Enforce the runtime concurrency limit deterministically Feed credentials are configured Keep them server side and absent from client output The test suite exercises these boundaries. The remaining question is whether the release reproduces cleanly outside the environment in which it was built. Passing tests and independent verification are different claims When the source, tests, build assumptions, and execution environment all come from the same maintainer, a successful run demonstrat

I was asked whether the system was sending patient data to an external body while the integration was half-built. I went and read the logs of every run. They all died early: some with a 415 because the content type wasn't what the other end expected, others with a 500. Not one showed an outbound call. I answered that nothing was going out. The first run that got past the 500 sent two requests carrying real clinical data . My answer had been false from the start, and the worst part is that it was false in a way that felt rigorous: I had looked. I had evidence. The evidence was logs of real executions, not assumptions. A negative says nothing on its own The mistake wasn't misreading the logs. It was not noticing what produced that silence. The runs died before reaching the code that sends. The log didn't say "I didn't send"; it said "I never got to the part that sends". Those are two different statements and they produce exactly the same output: nothing. That's the general shape of the problem, and it turns up everywhere once you look for it: A counter at zero can mean "it didn't happen" or "the counter was never incremented". A "not found" can mean "it doesn't exist" or "I looked in the wrong place". A green test can mean "it passed" or "it skipped itself". An exit 0 can mean "it worked" or "the command was strangled by a pipe that swallowed the exit code". A silent dashboard can mean "everything is fine" or "the process feeding it has been dead for three weeks". In all five, the evidence is identical. And in all five, the optimistic reading is the reassuring one, so it's the one chosen without thinking. The positive control The fix isn't to be more suspicious. It's to demand one specific thing before accepting any negative: Find something the log MUST show if the path was actually taken. If the system had reached the part that sends, something would have to appear in the log: the "preparing request" line, the batch identifier, the connection attempt. Any signal that

A once-overlooked block of unicode that's invisible to humans is gaining ever wider use.

It won’t work : My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface.

Fala galera, Tudo beleza? Bom, acho que não é novidade para ninguém que IA no desenvolvimento de software já passou daquela fase de simplesmente completar uma linha de código ou criar um método pra gente. Hoje temos ferramentas que conseguem analisar projetos, criar arquivos, escrever testes, ajudar em refatorações e até participar de tarefas bem maiores dentro de uma Solution. Sendo nosso Copiloto, NUNCA O PILOTO (sim no futuro esse vai aparecer tbm) E claro... junto com isso começaram as comparações. Nesse artigo vou comparar 2 que gosto muito de usar no dia a dia, sim eu uso gemini e copilot. Mas tudo ao seu tempo, comparar diversos serviços diferentes sem usar bastante nunca foi meu foco então prefiro falar de algo que eu to usando mesmo, por isso demorei tanto pra escrever. Codex ou Claude Code? Qual é melhor para trabalhar com .NET? Nas minhas experiências (sim na EU, EU USANDO, EUUUUUU.. digo isso porque é normal você falar, mas eu uso como... eu to falando EUUUUU. como ponto de partida para quem principalmente ta querendo entender dos dois e usa pouco ou nunca usou) utilizando os dois, principalmente dentro do ecossistema .NET, percebi que a resposta não é tão simples. E antes que isso vire uma guerra de torcida organizada ( ou do seu politico de estimação) nos comentários: não acho que exista um vencedor absoluto aqui . Não , não tem.... Na verdade, eles possuem formas diferentes de trabalhar e, dependendo do problema que estou tentando resolver, acabo preferindo um ou outro. Então bora bater um papo sobre isso? Primeiro: eles trabalham de formas bem diferentes Uma das primeiras coisas que percebi utilizando as duas ferramentas no contexto de dev é que, apesar de ambas terem o mesmo objetivo — ajudar no desenvolvimento — a forma como chegam até a solução me parece diferente. Codex No meu uso, o Codex me passa uma sensação muito mais de controle sobre o que está acontecendo . Você consegue trabalhar de uma forma mais estruturada, analisar o que será alterado

1. Introduction In the previous article, we began studying a level 6 CrackMe and quickly reached the Serial verification routine based on the Name. Here is this routine below: 0x401510: pusha ; Save all general-purpose registers ; ------------------------------------------------------------------------- ; PHASE 1: BASE64 DECODING AND SIZE CHECK ; ------------------------------------------------------------------------- 0x401511: mov ebx,DWORD PTR [esp+0x2c]; ebx = Pointer to Serial (passed as parameter) 0x401515: mov esi,0x404200 ; esi = Destination buffer for decoded Serial 0x40151a: push ebx ; Argument 2: Serial string 0x40151b: push esi ; Argument 1: Output buffer 0x40151c: call 0x401633 ; CALL: Custom Base64 decoder 0x401521: cmp eax,0x10 ; Is the decoded buffer exactly 16 bytes (128 bits)? 0x401524: jne 0x40162f ; No -> Direct failure (Jump to failure) ; ------------------------------------------------------------------------- ; PHASE 2: CHECK AND PREPARATION OF 64-BIT INTEGERS (S1 AND S2) ; ------------------------------------------------------------------------- 0x40152a: lea edi,[esi+0x10] ; edi = Pointer to second memory block (0x404210) ; Verification of the First 64-bit Number: S1 = [esi] (0x404200) 0x40152d: mov eax,DWORD PTR [esi] ; eax = Low 32 bits of S1 0x40152f: mov edx,DWORD PTR [esi+0x4]; edx = High 32 bits of S1 0x401532: test edx,edx ; Is S1 zero? 0x401534: jne 0x40153e 0x401536: test eax,eax 0x401538: je 0x40162f ; If S1 == 0 -> Failure ; Comparison of S1 with Modulus M (stored at 0x40403c) 0x40153e: sub eax,DWORD PTR ds:0x40403c ; S1 - Modulus (low part) 0x401544: sbb edx,DWORD PTR ds:0x404040 ; S1 - Modulus (high part with borrow) 0x40154a: jae 0x40162f ; If S1 >= Modulus -> Failure (S1 must be < M) ; Copy and Verification of the Second 64-bit Number: S2 = [esi+0x8] (0x404208) 0x401550: mov eax,DWORD PTR [esi+0x8]; eax = Low 32 bits of S2 0x401553: mov edx,DWORD PTR [esi+0xc]; edx = High 32 bits of S2 0x401556: mov DWORD PTR [edi],eax ; Copy

On 2026-09-04 I pointed a scanner at langchain-ai/langchain . Shallow clone of the default branch, HEAD 79cab2d , read only. It walked 2581 files and printed zero sites. Its own control had passed immediately before the run, with two positive fixtures seen and four negative fixtures clean, so the zero was a measurement rather than a crash. Then I opened one file by hand. libs/langchain_v1/langchain/agents/middleware/human_in_the_loop.py , line 403: def _should_interrupt ( self , tool_call , config , state , runtime ) -> bool : """ Return False if the `when` predicate rejects this tool call, True otherwise. """ when = config . get ( " when " ) if when is None : return True ... return when ( req ) when is supplied by the caller. It is declared NotRequired[Callable[[ToolCallRequest], bool]] on line 195 and documented as returning True to interrupt or False to auto-approve. Its result is handed back unchanged. A predicate that falls off a branch returns None , and the caller on line 436 reads: if not self . _should_interrupt ( tool_call , config , state , runtime ): continue None is falsy. The interrupt is skipped and the tool call proceeds with nobody looking at it. The annotation says bool ; nothing at runtime makes that true. Why the machine stayed quiet I took the failure apart instead of guessing at it. Three causes, each sufficient on its own: Vocabulary. 22 lines in that file matched the approval vocabulary the scanner looks for. Not one of them put line 403 inside its window. The nearest match was 26 lines away and sat in a comment. This project calls the decision interrupt , not approval. Window. The -> bool annotation is on line 378. The return is on 403. That is 25 lines apart, and the window was 12. Signals. Widened to 55 lines, the three behaviour signals still matched nothing on that line. The file walk was innocent. The file is .py , 18256 bytes, and no skip rule matched it. It was read. What I got wrong The window of 12 lines had no measurement behind it

Runnable reproductions for every framework named above, offline and pinned to a version: https://github.com/mahirhir/unanswered-approval

A swarm of rogue AI agents from OpenAI reportedly commandeered a German website and transformed it into a messaging board for other agents, with officials staying quiet about the incident for weeks as the company prepared to launch its most advanced model yet, Astra. The finding adds to intensifying concern surrounding oversight at frontier AI […]

A senator's letter confirms the U.S. military moved to prevent the tracking after foreign adversaries used location data to target troops.

¿Tu equipo comparte credenciales por Slack? ¿Discuten arquitectura en herramientas que almacenan todo en servidores de terceros? Existe una alternativa que no depende de ninguna nube: NETO . ¿Qué es NETO? NETO es un chat peer-to-peer diseñado para equipos de desarrollo que trabajan en la misma red local. No hay servidores centrales, no hay cuentas, no hay datos saliendo de tu oficina. Abres el navegador, y ya estás comunicándote con tu equipo. ¿Cómo funciona bajo el capó? La arquitectura de NETO combina tres tecnologías clave: mDNS (Multicast DNS): Permite el descubrimiento automático de peers en la red local sin necesidad de configurar servidores DNS ni registrar direcciones manualmente. Tu equipo aparece de forma instantánea. WebRTC: Establece conexiones directas entre navegadores. Los mensajes viajan de punto

A free server is a data boundary decision, not a cost decision. Every prompt you send to a managed endpoint leaves your network. For a coding agent, that means source code, environment variables, and internal architecture notes travel to someone else's infrastructure. The question is not whether the endpoint is trustworthy; the question is whether you can make the boundary explicit. MonkeyCode's free server option is generous in tokens and removes the ops burden of self-hosting. Disclosure: This article was prepared as part of MonkeyCode's product outreach. But generosity does not change the physics of data flow. The moment your agent calls a remote endpoint, the prompt is out of your control. What you can control is what goes into the prompt. This article is a practical guide to building a privacy gate between your agent and a free server. The gate is a local proxy that sanitizes prompts, redacts secrets, and logs every request. It does not make the server trustworthy; it makes your exposure measurable. The threat model Before writing code, define what you are protecting. For most teams, the sensitive material in prompts falls into three categories: hardcoded credentials, proprietary code snippets, and internal names or URLs. Each category has a different risk profile. Credentials are the worst. A leaked API key in a prompt is a direct compromise. Proprietary code is a legal and competitive risk. Internal names are subtler: they reveal architecture and naming conventions that an attacker can use for phishing or targeted attacks. A free server does not automatically read or store your prompts, but you cannot verify that. The boundary you build must assume the server is an untrusted observer. That assumption drives the design. The privacy gate The gate is a small FastAPI service that sits between your agent and the free server. It accepts OpenAI-compatible requests, rewrites them, forwards them, and returns the response. The rewriting step is where the boundary is en

THE BRICK AND THE POST-IT My chemical plant's first vulnerability wasn't a bug, a piece of malware, or a port left open to the internet. It was a brick. In the computer room — the one with a door held open by a brick — I found a sticky note with credentials on it. They weren't even the right credentials for the system I wanted to break into. But they made me think the way whoever wrote them thinks, so I tried the most obvious pair in the world: admin / admin . And I was in. A brick propping open a door that should be locked. A sticky note guarding a password. A factory-default admin/admin. Three layers of security, three layers defeated — not by a genius hacker, but by a student on day one, carrying no tools at all. If that happens in the IT office, it's a problem. When it happens on a factory floor, where that same computer commands real pumps and valves, it's a different planet. The problem: learning OT without a factory I study computer security. Lately I've been drawn to OT — operational technology, the security of factories, power plants and industrial systems. The problem is simple: you can't learn to defend a factory from a book, and nobody will lend you theirs. Then I realized the answer was already inside the question: if you don't have one, you build one. The build: three commands and a lot of patience The lab is called GRFICSv3: an open source project that simulates an entire chemical plant — the PLC, the operator interface, the network, even the server rooms — inside Docker, on a home computer. Three commands and done: curl -O https://raw.githubusercontent.com/Fortiphyd/GRFICSv3/main/docker-compose.yml docker compose pull docker compose up -d "Three commands and done" is the story version. The real version includes my first error, arriving right on schedule at command number two: permission denied while trying to connect to the docker API at unix:///var/run/docker.sock If you hit this — and you will — here's the diagnosis: the Docker daemon is running fi

Homeland Security Investigations agents hit the outdoor retailer with a controversial subpoena as part of a dragnet search for the identities of protesters who entered a Minnesota church in March.

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for...

I've been a die-hard Computer Science fan for as long as I can remember. Right after my 10th standard, I picked up C — that was four years ago. Around the same time, GitHub pulled me in before I even understood what was happening there. I couldn't parse a single line of what people were building, but I could tell something big was going on. That curiosity eventually pulled me into web development, and from there, into almost every corner of tech over the next few years — AI included. Diploma: The Real Lessons Weren't in the Syllabus I just finished a 3-year Diploma in Computer Engineering. Looking back, the biggest lessons weren't in the coursework. They were in hallway conversations — friends and teachers talking about where technology and the market are headed, instead of the usual teenage small talk. Watching how an organization actually runs, what really happens day to day — that taught me more than most subjects did. A Habit I Used to See as a Flaw Here's a pattern about how I work: everything I start, I start from zero — and I don't always go deep. I finish with the basics, then move on. For a long time I saw that as a bad habit. Three years and almost every major technology later, I've changed my mind — it was the fastest way to find out that "a little bit of everything" isn't who I am. What I actually need is to dig into a system until I find the reason it works. Until I do, I can't let it go. Where That Instinct Pointed Me: Cybersecurity That same need to dig eventually pointed me toward something equal parts fun and dangerous — cybersecurity. I'm about three months into this path now, and I'm moving slowly. Not because it's too hard, but because I won't move to the next topic until every dot is connected. Loose ends don't let me sleep. What I've Learned So Far This is still the floor, not the ceiling, but it's real and hands-on: Web authentication attacks — 2FA bypass, broken password-reset logic, username enumeration through timing differences, account lo

An email file is not just text plus a few attachments. It can contain HTML, nested MIME parts, misleading filenames, inline resources, remote tracking pixels, malformed encodings, and enough data to exhaust a browser tab. Moving parsing into the browser removes an upload from the architecture, but it does not automatically make the viewer safe. It changes the security job: untrusted content is now being interpreted next to the user’s active web session. This is the checklist I use for a local EML and winmail.dat/TNEF reader. Treat every parsed field as untrusted The sender, subject, recipient, filename, MIME type, and message body all came from a file. Render headers and filenames as text, never by concatenating HTML. The same applies to errors. A parser exception can include a filename or fragment of malformed input. Showing that message verbatim may leak data into logs or turn it into markup. Map parser failures to stable error categories, then display a controlled explanation. Normalize into one internal model EML and TNEF have different container structures, but the UI should not contain two independent security implementations. Both parsers can produce a common message model: subject, sender, to, cc, date, plain body, sanitized HTML candidate, attachments[] { safe filename, MIME type, bytes, inline flag, content ID, content location } The normalization layer is the right place to enforce per-source limits and reject unsupported structures. The viewer and download code then work against the same constrained data regardless of input format. Sanitize HTML as hostile input Email HTML was designed for mail clients, not for direct insertion into an application DOM. A conservative policy removes: scripts and event handlers; forms and interactive controls; iframe , object , and embed elements; styles and CSS URLs; unsafe protocols; executable or unexpected embedded content. Use a maintained sanitizer with a pinned version, but do not stop at its default configuration.

Microsoft Execution Containers provide a cross-platform framework for isolating AI agents within secure sandboxes to protect private data and system integrity. This technology allows developers to manage the lifecycle of autonomous code while ensuring that unpredictable agentic workflows do not access sensitive local files or unauthorized network resources. The Evolution of Agent Security and Isolation Trust remains a significant hurdle for developers building modern AI agents, particularly those operating on edge systems. When agents combine local processing with cloud-based intelligence, they often require access to sensitive information to be effective. However, granting this access creates a risk that the agent might call unintended APIs or compromise private user data. Historical attempts to launch autonomous agents in the 1990s largely failed because of these security concerns. Delivering arbitrary code to local machines proved too risky for mainstream adoption. Today, hardware-assisted virtualization has changed the landscape. This technology serves as the foundation for modern security models, including isolated operating system components and cross-platform tools like the Windows Subsystem for Linux. Microsoft now utilizes these virtualization advancements to build a more reliable framework for agent operations. By running agents in secure containers or microVMs, the system separates their activities from the primary operating system. This isolation ensures that even if an agent receives a poorly constructed prompt, it cannot delete critical system files or leak sensitive information. Managing Developer Environments Developers need a way to build code in flexible environments while still planning for restricted production deployments. Microsoft Execution Containers (MXC) address this by offering a policy-based restriction model. This framework allows for the creation of managed, isolated containers that follow specific security protocols. Applying Policy-Ba

ChatGPT, Claude, and Grok all suffered outages at nearly the exact same time for reasons that remain murky.

This week on Uncanny Valley, we dig into the latest prediction market buzz, Flock’s AI-powered police search tool, and how tech bros don’t know how to talk about “rouge” AI agents