标签：#Trust

We cannot forget that AI coding agents are not yet trustworthy : Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code packages or domain names that weren’t registered. To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, the researchers received a phone-home response from a Fortune 500 company. Over time, they got a few dozen more, some from more Fortune 500 companies and others from startups. Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents, including Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication...

When a support agent is trying to recover an account after a suspicious login, JWKS verification and session verification define different trust boundaries for API requests. The distinction decides which recovery path the agent can offer and how much damage a stolen credential can do. Short answer: use JWKS verification for a stable, distributed signature boundary, and session verification when the request must reflect current session state; most customer-support systems need both, with an explicit recovery policy between them. 1. Separate the two trust boundaries before scoring a device JWKS verification checks a token signature with a public key set. The verifier never needs a copy of the issuer's private key, which keeps key material out of every API service. That is a good fit for a high-volume edge where the identity claim should remain stable while requests cross service boundaries. Session verification asks a different question: is this particular session still valid right now? Revocation, expiry, or a changed recovery decision can make a previously well-signed token unsuitable for a sensitive action. A valid signature is necessary, but it does not satisfy the business constraints by itself. That distinction is the invariant. Device-fingerprint risk scoring should not silently turn a cryptographic result into an account-recovery decision. Keep it explicit. 2. How should JWKS and session verification govern API requests? Start with the least surprising path. Verify the token signature at the request boundary, then apply issuer, audience, expiry, and device-risk rules. For password reset, email change, or an agent-assisted recovery, perform session verification as a second check when the policy requires current state. The operational catch is key rotation. A JWKS client needs a bounded cache, a refresh trigger for an unknown key identifier, and telemetry for fetch failures. In capacity planning, that means sizing the refresh path separately from ordinary reques

The DOJ proved to the court that Google acted illegally, but it won't get the big win it wanted.

US District Court Judge Leonie Brinkema declined the Justice Department's request to make Google sell off parts of its ad tech business, accepting milder remedies to restore competition to markets it illegally monopolized for years. Brinkema said she would adopt most of the behavioral changes proposed by the parties, with some modifications. But those won't […]

v0.2.1 RELEASED — Aug 28, 2026. Release notes · Field test report · v0.2.2 release notes v0.2.2...

The FTC and Zillow have announced a settlement that ends the case alleging that a 2025 "partnership" between Zillow and Redfin violated antitrust laws. The FTC had alleged Zillow agreed to pay Redfin to syndicate its listings, while Redfin would end its own advertising contracts and promise not to compete with Zillow for multifamily listings. […]

A bad cutout rarely announces itself as a bad cutout. The car lands on a new backdrop, the paint looks clean, then a thin piece is gone. An antenna. A tire lip. The dark seam under a rocker panel. The complaint that comes back is never technical. The vehicle looks wrong. I wanted the last correction stage to fix fuzzy edges without handing it the whole car to rewrite. That sounds like a small distinction. It stops being small the first time a model improves one boundary and quietly damages another. So the rule is physical. Edit the uncertain strip. Leave the settled area alone. This is Part 2. Part 1, "Negative Space Is a Label", was about supervision: what the pixels beside an object teach a model, and why a shadow touching a tire has to be labeled as evidence against foreground. This one moves from training to runtime. A mask already exists. Where is a learned stage allowed to act? 1. The contract lives in the band CarSegNet is the research implementation here. Its pipeline module splits the route by media type, and the docstring says the design more clearly than any diagram I could draw after the fact. Stills run SAM 3 text concept, then NSJ alpha, then composite. A detector box prompt and a depth prior are optional inputs. Video runs SAM 3.1 multiplex propagation, per-frame NSJ with temporal handling, a depth-parallax plate, composite, encode. The list matters less than the handoff. SAM gives a semantic prior. NSJ receives a trimap band. The compositor receives a matte only after the prior and the refiner have each done bounded work. flowchart TD image[Vehicle Image] segment[Concept Mask] trimap[Trimap Band] refiner[NSJ Alpha Refiner] depth[Depth Prior] composite[Showroom Composite] frozen[Prior Frozen Outside Band] image --> segment segment --> trimap trimap --> refiner image --> depth depth --> refiner refiner --> composite segment -.-> frozen frozen --> composite The diagram is a contract. It is not a model zoo. The refiner edits the uncertain strip. The sema

Third-party app stores are about to become more visible in Google Play.

Aptoide has become the first app store distributed inside Google Play under a judge's order.

If you are an enterprise architect working on Microsoft Entra and AI agents, your first overdue job is not another policy wizard, another dashboard, or another governance steering committee. It is schema design. Specifically, it is deciding how you classify non-human identities with custom security attributes in Microsoft Entra . Not eventually. Up front. I keep seeing the same pattern across customers of every size: teams move quickly on agent experimentation, they onboard identities, they test controls, and then they realize they have no consistent attribute language for policy scope. At that point, every policy becomes a naming convention problem in disguise. That is backwards. The control plane starts with classification Custom security attributes are not decorative metadata. They are tenant-scoped key-value classifications you can assign to users, enterprise applications (service principals), and agent identities that are modeled as a service principal subtype, with dedicated role and permission boundaries for who can define and assign them ( overview , Graph model , agent identity service principal model ). That alone should change how architects think about them. This is not "nice to have taxonomy." This is policy input. Microsoft Entra Conditional Access for agents supports attribute-driven targeting with custom security attributes, and policy evaluation happens during token issuance and refresh, not just at policy authoring time ( Conditional Access for agents ). In other words: if your classification is sloppy, your runtime decisions are sloppy. Why agents raise the stakes You can say "an agent identity is still a service principal" and be technically correct. Microsoft Entra Agent ID is built on service principal infrastructure ( agent identities, service principals, and applications ). You can also miss the point. Agent identity introduces a blueprint-centered model where one blueprint can represent many agents, where blueprint-level policy decisions can

A judge partially granted the request from a dozen state attorneys general to temporarily place the $110 billion merger of Paramount and Warner Bros. Discovery on hold, as reported by Variety and Reuters. US District Judge Araceli Martínez-Olguín said that based on the new company's market share, "the Court is persuaded that it can presume […]

The line between editorial content and paid promotion has been eroding for years. On most major retail platforms, in countless lifestyle publications and across the breadth of social media, content that presents itself as independent assessment is frequently underwritten by the very brands being assessed. This is not a new problem, but it is a worsening one. The consequences are practical. Consumers who believe they are reading a review and acting accordingly may be making purchasing decisions on the basis of what is, in effect, an advertisement. The financial cost of that mistake is modest in most individual cases. The cumulative effect on consumer trust is not. Understanding what separates a genuine review from disguised promotional content requires more than checking for a disclosure label. It requires looking at structure, incentive, methodology and language - and recognising that some of the most effective adverts are those that most convincingly resemble reviews. What a Review Is Actually Supposed to Do A review serves one primary function: to help a reader make an informed decision about a product, service or brand. That function is incompatible with advocacy. A reviewer who is trying to help a reader decide cannot simultaneously be trying to persuade that reader to buy. This distinction sounds obvious. In practice, it collapses quickly when the person writing the review has a financial relationship with the brand, when the product was provided free of charge without conditions, or when the publication depends on advertising revenue from the sector it covers. None of those arrangements automatically invalidates the content produced. But each one creates a structural incentive that pushes in a specific direction - and that direction is rarely towards harder scrutiny. The Disclosure Problem Regulatory frameworks in the UK, including guidance from the Advertising Standards Authority and the Competition and Markets Authority, require that paid-for content be clea

The Federal Communications Commission will vote next month on whether a single company can own broadcast stations that reach more than 39 percent of US TV households. In a Breitbart op-ed on Wednesday, Republican Chair Brendan Carr announced an August 6th vote to end the national ownership cap rule, which was intended to prevent one […]

With the settlement withdrawn, Google is now bound by the court's full antitrust remedies.

A dozen state attorneys general are trying to block the $110 billion merger of Paramount and Warner Bros Discovery they warn would raise movie prices and crush cable TV distributors. The states - California, Arizona, Colorado, Connecticut, Massachusetts, Minnesota, Nevada, New Jersey, New Mexico, New York, Oregon, and Washington - filed suit on Monday, arguing […]

Parts 1 and 2 of this series ( Microsoft Entra extensibility is a gift. It is also Control Plane. and Securing the code that decides who Entra trusts ) made two static decisions. Where the code lives: a dedicated Control Plane subscription, directly under the root management group or under a dedicated Control Plane management group, never in the platform identity subscription or an application landing zone. What credential it uses to call out: a managed identity by default, federated identity credentials when the call must leave Azure, certificates as a tolerated middle step, and static symmetric keys never. Both decisions are one-time. You make them, you walk away, you do not touch them for months. The third decision is not like that. It is continuous, and it is the one most teams quietly skip: how do you know the deployed code on that Function App is still the code your reviewers approved? How do you know the Logic App workflow definition has not been rewritten since last Tuesday? How do you know nobody added a federated identity credential to the managed identity at 3 a.m. on a Saturday? The answer is monitoring. Not "we have Log Analytics turned on." Monitoring with a specific operating contract attached. The posture inversion For most Azure workloads, the default operating posture is reasonable trust. Engineers deploy. Pipelines run. Configuration drifts a little. The team reviews changes weekly. Anomalies are caught eventually. For a Microsoft Entra extension, that posture is wrong. The default has to be inverted. Once an Entra extension lands in production, every change to it is suspicious by default. Not "needs review." Not "let's check first." Suspicious. The default state of an alert firing on a Function App that hosts a custom claims provider is "the SOC is investigating, prove this was approved." If you cannot prove the change was approved within the team's response SLA, the change is treated as an incident and rolled back. That posture is harsh on purpo

Beyond the Playbook: Architecting Defenses Against Autonomous AI Threats We used to build security systems assuming the attacker was human. That assumption just died. Recent research demonstrations involving autonomous AI agents, such as "JadePuffer", have shown how quickly this shift is happening: an autonomous system independently compromised an unsecured Langflow instance, corrected failed authentication attempts, escalated privileges, exfiltrated credentials, and deployed ransomware — all without human intervention. This is not a one-off curiosity. It marks the beginning of a fundamental change in the threat landscape. Recent research demonstrations involving autonomous AI agents, such as "JadePuffer", have shown how quickly this shift is happening: an autonomous system independently compromised an unsecured Langflow instance, corrected failed authentication attempts, escalated privileges, exfiltrated credentials, and deployed ransomware. All without human intervention. This is not a one-off curiosity. It marks the beginning of a fundamental change in the threat landscape. From Static Playbooks to Autonomous Attackers Traditional ransomware follows predictable patterns. A script runs through a fixed playbook: scan, encrypt, demand ransom. If one step fails, the attack often stalls. Autonomous AI agents operate differently. They analyze their environment in real time, adapt when initial attempts fail, make contextual decisions about targets and techniques, and chain multiple exploits together without predefined sequences. This introduces machine-speed lateral movement. Something human defenders and traditional security tools are not built to handle. The Defensive Automation Gap The core problem is asymmetry. Attackers are rapidly automating both reconnaissance and execution. Defenders, on the other hand, still rely heavily on manual processes, static rules, and human-driven response. This "Defensive Automation Gap" creates dangerous imbalances in speed, scale, an

Supreme Court will weigh if Apple contempt finding in Epic case is “erroneous.”

Diagrid has announced the release of Dapr 1.18, introducing what it calls Verifiable Execution, a new set of capabilities designed to bring cryptographic trust, provenance, and tamper-evident execution records to distributed applications and AI agents. By Craig Risi

While the court still hasn't signed off on the massive settlement resolving Epic's antitrust lawsuit against Google for having a monopoly over Android's app store with Google Play, the tech giant says it will start rolling out changes to the way it handles billing for developers worldwide. As announced in March, the flat 30 percent […]