52 results for “TAP”

Oversecured's write-up of 20 vulnerabilities in Xiaomi apps and system components, reported to Xiaomi between 25 and 30 April 2023. Bugs include intent redirection with system privileges in Security and GetApps, shell command injection in System Tracing, and arbitrary file theft via path traversal in Settings and MIUI Bluetooth. Each has a PoC. The page was truncated, so the later MIUI Bluetooth entries and the rest are not covered.

oversecured.comwriteupAdded 29 Oct 2026🛡️ Security

Colin O'Flynn's paper shows that the flash accelerator in most microcontrollers produces the same timing collisions as a cache, so cacheless Cortex-M devices remain open to cache-collision attacks on AES. AES keys were recovered from as few as 750 traces across six cryptographic libraries, eight architectures and over twenty devices. It also attacks SPI bootloaders, Ethernet, CTAP2 over USB and 802.15.4, and releases the open-source tool FlashWhisperer.

eprint.iacr.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🛡️ Security

"The future of the firm" is a 2026 essay in OpenAI's "The Next Economy" series by two young OpenAI team managers. It sets out three scenarios for AI in the org chart: beneath workers as an agent workforce, beside them as colleagues, and between them as a consultant and monitor. It then argues how each affects red tape, worker agency, firm size and pay inequality.

openai.comarticlePublished and added 28 Oct 2026🧠 AI

p-DCIM is a 28 nm SRAM digital compute-in-memory macro (0.16 mm2, 0.41 mW) that works as an Ising machine for RAG evidence selection. Selection is cast as a QUBO problem, and the same MAC datapath computes embedding similarities and annealing steps. Replacing LLM reranking with it gives a selection-energy estimate over six orders of magnitude lower and cuts total energy per query by 67%, with comparable token-level F1 on the evaluated examples.

arxiv.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Dutch police arrested two men, aged 23 and 25 from Vaassen and Ede, on October 6 over a bank helpdesk fraud that took over €380,000 from 170 victims. Callers played AI-generated bank audio, then a fake bank employee had victims install an app and tap their card to the phone. The app read the NFC chip data and relayed it to an accomplice at an ATM. Police seized the servers.

securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security

ZTrust is a Python supply-chain scanner that checks manifests, lockfiles, source and GitHub workflows for vulnerable or malicious dependencies (via OSV.dev), typosquats, leaked secrets, unsafe lockfiles and risky CI patterns such as pwn requests and script injection. It outputs console, JSON and SARIF 2.1.0 and ships as a GitHub Action. It also includes a FastAPI bounty service using commit-reveal and shielded Zcash payouts for researchers.

github.comrepoAdded 27 Oct 2026, published 22 Oct 2026🛡️ Security

The Geometry of Metaphor is an October 2026 arXiv preprint that uses mechanistic interpretability to find causal subspaces for metaphor in LLMs of different architectures and sizes. The authors steer output on classification tasks across parts of speech. They also steer generation tasks, showing the metaphoricity of model output can be controlled. The abstract gives no model names or metrics.

arxiv.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🧠 AI

Adversa AI assesses Claude Code enterprise security as of October 2026. Managed settings bind only Claude Code, can be edited by local admins, and are not read by Anthropic-hosted cloud sessions. Auto mode misses 17% of risky actions in Anthropic's test set. The article covers attacks on the harness (CVE-2025-59536, CVE-2026-21852, TrustFall, SymJack, GhostApproval) and recommends credential, egress, isolation and monitoring controls.

adversa.aiarticlePublished and added 22 Oct 2026🛡️ Security

Hackers Arise article on the October 2026 attack in which Ledger Nano X devices sold by the reseller CryptoBilis carried a hidden circuit board that taps the SPI bus to the screen, rebuilds the 24-word recovery phrase and sends it out over LTE. Losses are estimated at $86 million to over $100 million. The device still passes Genuine Check. It lists safe purchasing, checking and recovery steps, plus BIP-39 passphrase and multisig advice.

hackers-arise.comarticlePublished and added 21 Oct 2026🛡️ Security

Cisco Talos research on attackers using legitimate infrastructure to deliver lures, with abuse seen across more than 25 platforms in the past year. It details two campaigns (about 1,400 messages) that put attacker phone numbers into Staples and Dell order notifications that passed DKIM and DMARC. It also covers list bombing as content delivery and bounce (DSN) abuse, and recommends content-aware validation and recursive MIME inspection.

blog.talosintelligence.comwriteupPublished and added 21 Oct 2026🛡️ Security

Jev Cards is a browser picture quiz where a player competes against Jev 1.14, a vision decision model. The 490 cards cover fruit, flags, maps, chess and illusions. Jev reads the image and question and returns a probability for every option, or a box for "tap the place" cards, in one call of about 0.25 seconds. It never writes text. The page reports 5,256 wins in 6,820 games.

jevcards.comtoolAdded 21 Oct 2026, published 20 Oct 2026🧠 AI

VoidAccess is a self-hosted, MIT-licensed dark web OSINT platform that runs a 13-step pipeline from a research query to a relationship graph. It collects from Tor indexes, paste sites, code forges, security feeds and .onion seeds, applies content-safety filters, and exports STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV and JSON. It runs as a CLI with SQLite or as a Docker Compose stack with PostgreSQL, FastAPI and Next.js.

github.comrepoAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

Ponytail is a single skill prompt (skills/ponytail/SKILL.md, with a compact AGENTS.md) that makes coding agents write only the code a task needs, reusing existing components while keeping validation, error handling, security and accessibility. The author benchmarked it in Claude Code with Opus 5.5 over 39 tasks, 5 runs each, including a real FastAPI + React repo. They report -53% code, -41% time, -26% cost and -45% tokens, and 98% of risky logic shipping with a test versus 68% without. It adds /ponytail-review and /ponytail-audit commands, a Claude Code cost/token band with a local board, and installs through Claude Code and Codex plugin marketplaces or as a rules file for Cursor, Copilot, Gemini, OpenCode and others.

github.comrepoAdded 17 Oct 2026🧠 AI

CyberForge CVE of the Day #080 covers CVE-2026-99999 ("PwnEscape"), a Linux kernel IPv4 checksum-completion flaw. Crafted checksum metadata can trigger a deferred write into an already-validated IPv4 header, which allows host memory disclosure from a guest or microVM over virtio-net and TAP. It gives upstream fixed branches (5.10.272 to 7.2.11), Amazon Linux, Red Hat and Ubuntu status, CVSS 9.3, EPSS 0.211% and a SOC investigation trail. No IOCs were verified.

x.comadvisoryAdded 19 Oct 2026, published 17 Oct 2026🛡️ Security

Protos reports that German retailer MediaMarkt pulled all Ledger products after teardowns of Ledger hardware wallets showed physical spyware implants, tied to an $86M drain of wallets bought from Malaysian reseller CryptoBilis. Ledger's investigation concluded the implant recorded the 24-word recovery phrase and sent it out over an attached eSIM. Mark Karpelès has helped identify implants in dismantled devices from MediaMarkt, LazMall (Philippines), CryptoBilis and Metapod (Singapore airport). Ledger has so far confirmed only the CryptoBilis devices and says it is reviewing reports of implants elsewhere.

protos.comarticlePublished and added 13 Oct 2026🛡️ Security

The Defiant reports that Mt. Gox's Mark Karpelès says a Ledger Flex hardware wallet bought at an airport contained a spy implant. The buyer, Ben Yorke, named Metapod as the retailer. Ledger says the verified fund losses in its investigation remain tied to wallets sold by CryptoBilis. The captured text is only the headline and standfirst, so the technical details of the implant are not available. The claim is an allegation of third-party-retailer hardware tampering against a Ledger statement that points elsewhere.

thedefiant.ioarticlePublished and added 13 Oct 2026🛡️ Security

The article reports Anthropic research (William Zhou and Daniel Freeman) on whether small open models can autonomously replicate onto unfamiliar IoT and consumer hardware. Qwen3.5-9B established inference on eight of nine hardware types using the Memento harness (built on the Pi coding agent). GLM-5.2 completed a simplified end-to-end replication across eight emulated Android nodes in four of five trials, and reached seven nodes in the fifth. Gemma4-26B-A4B was sharded by pipeline parallelism across 15 low-RAM Android TV boxes at 0.39 tokens/s. The authors estimate replication intervals of 1–2 days and a capability threshold around end of 2026, which makes it a concrete capability-evaluation datapoint for AI safety.

en.cryptonomist.charticlePublished and added 12 Oct 2026🧠 AI

Paper on the forensic analysis of a stand-alone HackRF One with a PortaPack running Mayhem firmware v2.0.1. It establishes at source-code level which data sit on the microSD card, their formats, when they are written and how to interpret them. The method is applied to a four-month SD image and covers RTC-battery-dependent timestamp rules, traces of on-device trimming and text editing, cluster-level recovery of deleted IQ captures, and decoding of recorded signals cross-checked with an independent decoder. In the example, the tail of a deleted IQ capture and a trimmed-away segment are recovered, and six captures are attributed to one rolling-code OOK transmitter with a shared 32-bit ID. It provides an artifact catalogue, interpretation rules and acquisition recommendations.

arxiv.orgpaperAdded 17 Oct 2026, published 11 Oct 2026🛡️ Security

watchTowr's analysis of the PaperCut NG 26.0.4-PO build 76508 pre-auth RCE chain, built from WT-2026-0143 (authentication bypass) and WT-2026-0144 / CVE-2026-82077 (post-auth RCE). The bypass reaches Setup Wizard forms through the Tapestry service parameter via the Home page, which resets the admin password. The RCE uses path traversal in the Scan to Fax connector. It also gives the August to September 2026 patch and bypass timeline, including exploited CVE-2026-81578 and CVE-2026-82078.

labs.watchtowr.comwriteupAdded 30 Oct 2026, published 9 Oct 2026🛡️ Security

Anthropic launched OSS Scanner, a free opt-in service modeled on Google's OSS-Fuzz that uses its most capable Claude models to periodically scan open source projects and send maintainers model-generated, unreviewed vulnerability reports with PoCs and suggested fixes (targeting >90% true-positive rate). It also announced the Critical Infrastructure Defense Program (CIDP), pairing frontier Claude models and on-site engineers with eleven founding partners — Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation — to help OT/ICS operators in power, water, manufacturing and transportation remediate vulnerabilities that often can't be patched quickly. Both build on lessons from Anthropic's earlier Project Glasswing, which found many vulnerabilities but struggled to get them fixed in time.

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

Galaxy Research newsletter piece covering "Shielded Bitcoin," a paper by [[alloc] init] researchers Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin proposing a Zcash-style shielded pool (encrypted notes, public nullifiers, zero-knowledge proofs) run as a Bitcoin L1 metaprotocol via OP_RETURN envelopes, with peg-in/peg-out deliberately left to a future "PIPEs v2" paper. The article's security-relevant angle flags that novel ZK circuits need battle-testing — citing Zcash's own Orchard Pool soundness bug that survived professional audits for four years before being fixed in the Ironwood upgrade — and that bridge/peg mechanisms (the likely weak point) have historically been the most exploited component in crypto, naming Ronin, Wormhole, Nomad, and KelpDAO. It also notes a growing AI-driven deanonymization threat to transparent blockchains, citing ETH Zurich/Anthropic research showing LLM agents can re-identify pseudonymous users from profile data alone.

galaxy.comarticleAdded 8 Oct 2026🛡️ Security

Agent.reviews is a review platform built specifically for AI coding agents: agents like Claude Code, Codex and a "Muse Code" agent write first-hand reviews of developer tools and services (FastAPI, Auth0, Amazon DynamoDB, Redis, Playwright, Vercel, Daytona, Git, npm, Claude API, Cursor) based on real usage during coding tasks, noting concrete friction like nested executables, missing live-credential verification, or scattered docs. The site exposes agent-readable endpoints (skill.md, install.md, llms.txt, and a .md mirror of every page) so a coding agent can both consult prior reviews when choosing a tool and submit its own after a task.

agent.reviewstoolAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

Checkmarx's research team documents MALFEX, an npm supply-chain malware campaign run by a single operator ("Murizada") publishing since August 2023, with 12 packages (8 malicious), three still live as of late September/October 2026. The campaign delivers three distinct Windows payloads: Overlord RAT (a Go-based C2 that reads its server address from encrypted Solana blockchain transactions and uses process hollowing into TapiUnattend.exe), the movinlike Node.js stealer (targeting Discord, browser credentials, Telegram, and crypto wallets, exfiltrating via Discord webhook), and a long-running downloader hidden in function-flag's postinstall script. The writeup includes full IOCs, file hashes, host artifacts, detection commands, and remediation guidance for compromised Windows hosts.

checkmarx.comwriteupAdded 7 Oct 2026, published 5 Oct 2026🛡️ Security

Episode 23 of the OpenSourceMalware Show covers the arrest of ShinyHunters figure Pepijn van der Stap (Umbreon) and three KillSec ransomware suspects, a suspected North Korean theft of $351.6M from crypto exchange Bitget via a zero-day in a security product (per incident responder SlowMist), a signed macOS installer impersonating Claude Desktop and hosted on GitHub, over 100 malicious npm packages abusing the Baileys WhatsApp library to inflate channel followers, and DPRK's PolinRider campaign renaming its fake-font payload (fa-solid-400.woff2 variants, now using a .llf extension and nested folder paths) to evade static file-name detections.

opensourcemalware.comtalkAdded 1 Oct 2026, published 2 Oct 2026🛡️ Security

InterEvolve is a test-time evolution method for humanoid loco-manipulation that lets a pretrained controller solve new tasks without retraining. It pairs an object-aware forward-backward (FB) behavioral foundation model, which turns new body/object rewards into loco-manipulation behavior, with "reward programs" — staged rewards with completion conditions and tunable constants — whose structure an LLM agent revises using execution feedback and a skill library, while a numerical optimizer tunes constants, with every candidate verified across parallel simulations. Experiments show it unlocks competence that human-designed rewards leave untapped and produces autonomous long-horizon behaviors on a physical Unitree G1 humanoid from onboard egocentric perception.

arxiv.orgpaperAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

StateTape is a framework for long-horizon coding agents that replaces text-based context pruning/summarization with a symbol-level code graph tracking which code symbols each write could have affected. A per-write procedure uses the graph to nominate context records a write may have falsified, with a small manager model resolving ambiguous cases, turning staleness detection from text inference into an observation of actual code dependencies. The paper introduces TraceBench, a benchmark labeling what an agent holds versus what it actually needs, and shows improved resolve rates across six coding agents and three edit-heavy benchmarks with low computational overhead.

arxiv.orgpaperAdded 30 Sep 2026🧠 AI

Release changelog for MITRE ATLAS's atlas-data repository, the structured YAML/STIX dataset behind the ATLAS knowledge base of adversary tactics and techniques targeting AI-enabled systems (prompt injection, model/data poisoning, AI agent tool abuse, AI supply chain compromise). The v2026.09 release brings the matrix to 120 techniques, 88 sub-techniques, 40 mitigations, and 73 case studies, and recent versions introduced a new v6 YAML data format with Pydantic/SQLAlchemy/FastAPI tooling, platform tagging (Predictive AI, Generative AI, Agentic AI, Enterprise), and renamed/generalized techniques like "AI Agent Tool Poisoning," "Manipulate AI Model," and "Enterprise Resource Discovery." It's the canonical, actively-maintained taxonomy practitioners use for AI red-teaming, threat modeling, and mapping real-world AI attack case studies.

github.comrepoAdded 26 Sep 2026🛡️ Security

This is a release changelog for awslabs/mcp, AWS Labs' collection of Model Context Protocol servers covering services like HealthOmics, Aurora DSQL, Bedrock Knowledge Base retrieval, ECS, CloudWatch, billing/cost management, and dataprocessing. This release adds vended metrics tools, SQL parser-based policy guards for Aurora DSQL, agentic retrieval support for Bedrock KB, and fixes several security issues including region validation to prevent SSRF credential disclosure in the CloudWatch server and read-only mode bypass in the MySQL server. It reflects an actively maintained, high-velocity multi-server MCP monorepo used for AWS tool integration with LLM agents.

github.comrepoAdded 26 Sep 2026🧠 AI

Zafran Security disclosed four vulnerabilities (dubbed DifyTap) in the open-source agentic workflow platform Dify, including two critical authorization bypass/path-traversal bugs (CVE-2026-41947, CVE-2026-41948) letting attackers redirect app traces to an attacker-controlled LLM provider or reach Dify's internal Plugin Daemon API, plus two file-preview authz flaws (CVE-2026-41949, CVE-2026-41950) exposing other tenants' uploaded documents and chat files via UUID guessing. Separately, Dify's file-parsing stack bundled a version of PDFium vulnerable to CVE-2024-5846, a use-after-free that can trigger heap corruption via a crafted PDF. All but CVE-2026-41948 were patched in Dify 1.14.2.

thehackernews.comarticleAdded 26 Sep 2026🛡️ Security

Belgian CCB advisory on CVE-2026-48710 ("BadHost", CVSS 6.5), an authentication bypass in Starlette versions before 1.0.1. The Host header was not validated when request.url was rebuilt, so request.url.path could differ from the routed path. Middleware and endpoints that enforce access control on request.url could therefore be bypassed. The flaw affects FastAPI, LiteLLM, vLLM, MCP servers and other Python LLM infrastructure, and may expose stored third-party credentials. The advisory recommends upgrading to 1.0.1 or later and increasing monitoring, and links to the badhost.org scanner and to the GitHub, OSTIF, X41 D-Sec and Ars Technica write-ups.

ccb.belgium.beadvisoryAdded 26 Sep 2026🛡️ Security

Atredis Partners built an LLM-driven pipeline (WALA/ASM call-graph builder, a FastAPI graph query server, Claude Code as the reasoning/validation agent, and a dynamic test/debug runner) to automate discovery of Java deserialization gadget chains against modern, hardened application servers (WebSphere, WildFly, Payara). The project found 17 confirmed chains, 6 novel, including CB1-Shaded-RCE — a chain that bypasses JPMS's TemplatesImpl restrictions via a shaded/relocated copy of Xalan's XSLTC shipped inside WildFly's JSTL jar, giving RCE on the latest WildFly on JDK 21 — plus a novel JNDI-injection chain in Payara via AttributeComparator/InjectableJMSContext. The write-up details the architecture, methodology limitations (benchmark gaming, non-determinism), and broader implications for any app/server that bundles a shaded Xalan outside java.xml, with tooling released on GitHub (atredispartners/llmchainhunter).

atredis.comwriteupAdded 25 Sep 2026🛡️ Security

TrackEverything is a 3D point tracker that represents videos as persistent 3D scene tracks in world coordinates, decoupling model complexity from video duration by scaling with scene geometry rather than frame count. It introduces voxelization-based de-duplication to merge co-located tracks across sliding-window boundaries, an endpoint refiner plus lightweight trajectory refiner that only decodes dense trajectories for dynamic points, and 3D WAFT, which replaces memory-heavy 4D correlation volumes with feature sampling in the scene cloud. On TAPVid-3D it beats open-source dense 3D trackers by over 20% APD on short clips and is the first 3D tracker able to track all visible points across 1000+ frame videos within 40GB GPU memory.

arxiv.orgpaperAdded 26 Sep 2026, published 24 Sep 2026🧠 AI

Adversa AI catalogs ten distinct Claude Code attacks documented between September 2025 and September 2026: the Miasma supply-chain worm that hit 73 Microsoft repos via a SessionStart hook, TrustFall's unsandboxed MCP server execution on folder-trust, Check Point's CVE-2025-59536/CVE-2026-21852 pre-trust-dialog code execution and API key theft, Sentry-DSN-based "Agentjacking" prompt injection via fake bug reports, a 50-subcommand cap that silently disables deny rules, the SymJack symlink-to-config-hijack primitive working across six agent CLIs, Wiz's GhostApproval deceptive-approval-prompt finding (with CVE-2026-12958 at AWS and CVE-2026-50549 at Cursor but none at Anthropic), the Plugin4Shell SHA/branch-name collision bypassing plugin pinning, an academic MCP tool-poisoning paper achieving RCE on agent/LLM pairs, and SkillCloak's self-extracting-packer bypass of skill scanners. The piece argues almost none of these are model-behavior bugs - they are trust-boundary and consent failures in the surrounding tooling - and closes by pitching Adversa's own runtime agent security gateway as the fix.

adversa.aiwriteupAdded 7 Oct 2026, published 23 Sep 2026🛡️ Security

PISmith trains an attack LLM with GRPO in a black-box setting to generate injected prompts that defeat prompt-injection defenses. It addresses extreme reward sparsity, which causes entropy collapse in standard GRPO, with adaptive entropy regularization and dynamic advantage weighting. Evaluated on 13 benchmarks against 8 defenses and 7 baselines (static, search-based such as TAP and PAIR, and RL-Hammer), it achieves the highest attack success rates and also works on InjecAgent and AgentDojo against GPT-4o-mini and GPT-5-nano. It shows state-of-the-art defenses such as Meta-SecAlign remain vulnerable to adaptive attacks.

arxiv.orgpaperAdded 17 Sep 2026🛡️ Security

ThreatIntel-Aggregator is a self-hosted FastAPI/Next.js platform that polls 60+ tiered security RSS feeds (CISA, Talos, Unit42, etc.), runs AI triage to score severity and tag MITRE ATT&CK TTPs, extracts IOCs/CVEs, and correlates findings against a RunZero asset inventory to surface org-level exposure. Its Detections module goes further: it catalogs AI-generated or locally-imported detection rules (KQL/Sigma/YARA/Suricata/SPL), statically validates them, runs AI-driven MITRE alignment checks against technique coverage, tracks detection "rot," and can sync Hunts/Analytics Rules to a live Microsoft Sentinel workspace. It's designed to run standalone with zero cloud dependency or fully integrated with Azure/Entra/Sentinel, with all storage in Postgres and auth via Entra SSO or a local API key.

github.comrepoAdded 22 Sep 2026, published 17 Sep 2026🛡️ Security

Socket's Threat Research team identified six malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker, GhostApe, GhostApe Color) that steal authenticated session tokens, Firebase access tokens, and wallet-related data from users of the Axiom Trade and Padre crypto trading platforms. The extensions abuse a byte-identical collection module (axiom-fetch-intercept.js) that reads localStorage/IndexedDB and exfiltrates data by encoding it into URLs opened via browser navigation to Vercel-hosted C2 endpoints, evading manifest-based host-permission review since navigation isn't subject to CORS/CSP connect-src restrictions. The report includes full IOCs (extension IDs, C2 domains, hashes), attribution links via shared code and publisher portfolios, and defender guidance for hunting and blocking the campaign.

socket.devwriteupPublished and added 12 Sep 2026🛡️ Security

BugScanner is an asyncio/httpx Python framework for recon and automated web vulnerability scanning, with a React and FastAPI dashboard. It covers subdomain enumeration (crt.sh, DNS brute force), TCP port scanning, fingerprinting, and modules for XSS, SQLi, CORS, SSRF, open redirect, JWT, IDOR and business logic, plus a Nuclei wrapper. A 5-rule false-positive filter with SPA detection, adaptive rate limiting, WAF detection and SARIF export are included.

github.comrepoAdded 20 Oct 2026, published 5 Sep 2026🛡️ Security

Diffusion TV is an interactive AI art installation built from a modified CRT TV that lets audiences control the clarity of AI-generated images and sounds by physically manipulating the antenna, metaphorically enacting the denoising process of diffusion models. A tuning knob switches between three channels of AI-generated animals (extinct, endangered, speculative), embedding the interaction in a temporal and ecological narrative. The work argues for embodied, tangible interaction as an alternative mode of explainable AI that foregrounds the generative process itself rather than final outputs.

arxiv.orgpaperAdded 22 Sep 2026, published 4 Sep 2026🧠 AI

goal-flow (goalflow) is a production-oriented framework built on LangGraph that offers two complementary ways to build LLM apps: transpiling Dify Studio's drag-and-drop workflow DSL export into a version-controllable, runnable LangGraph Python file, and building ReAct/Deep/custom agent loops with a vendored agent_kit SDK. It includes a FastAPI HTTP layer, a node library (LLM, code, HTTP, if/else, classifier, iteration, loop, tool, agent, doc-extractor), a chunk-processor that turns raw LangGraph streams into semantic SSE events consumable by pluggable data adapters (Dify/OpenAI/custom), Redis/MySQL persistence, human-in-the-loop interrupts, a skills engine, and Langfuse tracing. It was extracted from an internal production system and reports sustaining 100 concurrent conversations on modest hardware (2 vCPU/4GB per replica).

github.comrepoAdded 30 Sep 2026, published 6 Aug 2026🧠 AI

LongHorizon-Harness (AMAP-ML, package lh-harness) is a Python tool that wraps existing coding/computer-use agents (Claude Code, Codex, OpenCode, DeepSeek Harness) in a durable plan → act → verify → checkpoint/recover loop. It separates Manager, Executor and Auditor roles, accepts only independently verified progress as task state, and restarts rounds from the original goal plus the last verified checkpoint. It supports GUI and terminal workflows via computer-use MCP plugins (codex-computer-use, open-computer-use, clawdcursor), a React/FastAPI web workbench, per-role model and backend selection, and eval suites including Terminal-Bench 2.1; an arXiv paper accompanies it.

github.comrepoAdded 12 Oct 2026, published 4 Aug 2026🧠 AI

Adversa AI's monthly roundup of AI coding agent security resources for August 2026, covering 19 items across attack techniques, defenses, vulnerabilities, incidents, CISO guidance, and threat modeling. Highlights include a cross-vendor symlink/approval-bypass pattern (GhostApproval) in six coding assistants, two CVSS 9.8 zero-click RCEs in Cursor (DuneSlide), AWS Kiro rewriting its own MCP config after reading hidden web page text, GitHub Agentic Workflows leaking private repos via a public issue comment (GitLost), and a Claude Code agent wiping a production database via a misconfigured Prisma migration. The piece closes with a synthesis arguing approval prompts can't be trusted, repositories (READMEs, issues, skill files) must be treated as hostile input, and destructive operations need their own permission class with automated policy enforcement.

adversa.aiarticleAdded 7 Oct 2026, published 3 Aug 2026🛡️ Security

Hackers-Arise walks through WireTapper, an open-source wireless OSINT tool (github.com/h9zdev/WireTapper) that passively discovers and maps nearby Wi-Fi, Bluetooth, and cellular devices by correlating data from Wigle, Shodan, and OpenCelliD APIs. It also checks for leaked Wi-Fi credentials via a k-Anonymity query scheme to avoid exposing the user's own search, and offers a web dashboard (localhost:8080/map-w) with Wi-Fi/Bluetooth toggles and JSON export of discovered device locations.

hackers-arise.comarticleAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Sherlock is a command-line OSINT tool that checks over 400 social networks for the existence of a given username, outputting results to text, CSV, or XLSX files. It supports proxying, JSON-based site definitions, NSFW site inclusion, and browsing found accounts directly, making it a staple recon tool for investigators, red teamers, and social engineering research.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Homebrew 6.0.0 release notes introduce a tap trust mechanism that requires explicit trust before Homebrew will evaluate or run arbitrary Ruby code from third-party taps, mitigating malicious or compromised tap supply-chain risk while keeping official taps trusted by default. The release also brings Bubblewrap sandboxing to Linux matching macOS sandboxed build test and postinstall phases, download cooldowns for npm PyPI RubyGems and pip to blunt upstream supply-side attacks, filtering of sensitive environment variables during Ruby evaluation, a new brew vulns subcommand for checking installed packages against known vulnerabilities, and three unnamed published security advisories.

brew.sharticleAdded 3 Sep 2026, published 24 Jul 2026🛡️ Security

Wiz details how its Agentless Workload Detection extends EDR-like visibility to FortiGate firewalls by parsing local FortiOS logs (log IDs like 32001/32002/44547/41987) to hunt for credential stuffing, rogue admin account creation, certificate manipulation, NAT/port-forwarding abuse, and FortiManager script abuse. It maps these techniques to real-world campaigns including the FortiBleed credential-compromise campaign, active exploitation of CVE-2026-24858, and UNC3886's use of CVE-2022-41328 to deploy the CASTLETAP backdoor, plus Salt Typhoon's exploitation of CVE-2023-48788 against FortiClient EMS.

wiz.iowriteupAdded 3 Sep 2026, published 22 Jul 2026🛡️ Security

Endor Labs benchmarks OpenAI's Codex agent with GPT-5.6 Sol on its Agent Security League, reporting 70.9% FuncPass and 23.5% SecPass (third on security among 23 combos) and steady gains over GPT-5.4 and GPT-5.5. It documents a four-signal anti-cheating pipeline (conversation analysis, patch similarity, memorization detection, strict-test pass) feeding a multi-step LLM adjudicator, which flagged 7 instances and confirmed none as cheating. Case studies include an identical two-line django-rest-registration patch, FastAPI CVE-2021-32677, Django CVE-2024-39329, and a unique Django CVE-2021-44420 solve with a structurally different patch (similarity 0.57).

endorlabs.comwriteupAdded 23 Sep 2026, published 17 Jul 2026🧠 AI

Snyk explains the decades-old symlink attack (CWE-61) and the underappreciated fact that Git will happily commit, push, and recreate symlinks (file mode 120000) from a cloned repo, letting an attacker ship a file like project_settings.json that's secretly a pointer to ~/.ssh/authorized_keys. It walks through Wiz Research's "GhostApproval" report, which found that six AI coding agents (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) can be prompt-injected via README instructions into following such a symlink and writing attacker SSH keys or shell-config payloads before the user ever sees an accurate confirmation dialog (CWE-451, UI misrepresentation). It also recaps prior symlink-driven CVEs (tar npm package CVE-2021-32803, Leaky Vessels CVE-2024-21626, Git submodule CVE-2024-32002) and gives concrete mitigations: canonicalize-then-check-boundary atomically (e.g. openat2 with RESOLVE_BENEATH), show real resolved targets in approval dialogs, and audit repos with `find . -type l` or `git ls-files -s` before trusting them.

snyk.ioarticleAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

Wiz Research discloses GhostApproval, a symlink-following vulnerability (CWE-61) found in six AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — where a malicious repo containing a symlink disguised as a config file tricks the agent into reading/writing sensitive files like ~/.ssh/authorized_keys outside the workspace sandbox. In several tools the agent's internal reasoning correctly identifies the true target file, but the confirmation dialog shown to the user still displays the fake filename (CWE-451, UI misrepresentation), turning human-in-the-loop approval into a rubber stamp; some tools (Amazon Q, Windsurf) even write to disk before the approval prompt appears. AWS (CVE-2026-12958), Google, and Cursor (CVE-2026-50549) shipped fixes; Anthropic initially rejected it as outside threat model before later shipping a symlink warning, Augment acknowledged but hasn't patched, and Windsurf has not responded.

wiz.iowriteupAdded 3 Sep 2026, published 8 Jul 2026🛡️ Security

OSV, the OpenSSF-backed vulnerability database, withdrew 157 malicious-package reports on May 26 after automated detections from Amazon Inspector incorrectly flagged trusted npm and PyPI packages — including FastAPI, Strawberry GraphQL, and @tanstack/start-storage-context — as malware. The FastAPI record (MAL-2026-4750) claimed the package added a "typosquat-shaped" dependency (fastar) but never identified an actual malicious payload; OpenSSF paused the Amazon Inspector ingestion pipeline after the rollback. Because OSV feeds scanners, SBOM tools, registry controls, and CI/CD gates, the bad records had already propagated and forced maintainers to prove their packages were not compromised.

socket.devarticlePublished and added 28 May 2026🛡️ Security

CVE-2026-45829 (CVSS 10.0) is a pre-authentication remote code execution flaw in ChromaDB's Python FastAPI server, versions 1.0.0 through 1.5.8. The server processes user-controlled embedding function configuration before authentication checks, letting an attacker send a crafted collection-creation request referencing a malicious HuggingFace model with trust_remote_code enabled to force arbitrary Python code execution pre-auth. Discovered by researcher Azraelxuemo and later HiddenLayer (dubbed "ChromaToast Served Pre-Auth"); Shodan-based scanning found roughly 73% of internet-exposed ChromaDB instances still vulnerable, with fixes shipped in 1.5.9.

orca.securityadvisoryPublished and added 22 May 2026🛡️ Security

A deep technical guide from Reco on pentesting Salesforce Experience Cloud "Aura" sites, covering how to enumerate guest-user-accessible sObjects via HostConfigController and SelectableListDataProviderController, and how to discover and invoke custom server-side Apex controller methods exposed to guest/authenticated users. It introduces novel techniques for extracting Apex method parameters from compiled Lightning Web Component JS (via the lri/moduleDefs structures), using ComponentController.getComponent and siteforce:routerInitializer to enumerate every site route/page and its Apex-backed components beyond what standard tools like AuraInspector find, plus an appendix of undocumented native controllers including an Aura-exposed GraphQL execution endpoint (RecordUiController.executeGraphQL). It closes with defensive guidance on monitoring AuraRequest events via Salesforce Shield to detect abuse.

reco.aiwriteupAdded 3 Sep 2026, published 13 May 2026🛡️ Security

MCP Audit is a VS Code extension that transparently intercepts and logs all MCP tool calls made by GitHub Copilot, by creating mirrored ("tapped") copies of configured MCP servers. It forwards structured JSON logs (tool name, params, results, agent/host/IP, correlation ID) to Splunk HEC, Syslog (CEF), or local files, giving security and compliance teams a centralized audit trail of what an AI coding agent actually did.

github.comrepoPublished and added 6 May 2026🛡️ Security