#ai-security — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #ai-security, aggregated by home.social.
-
CVE-2026-61445 (CRITICAL, CVSS 9.4): PraisonAI <4.6.78 suffers path traversal & command injection via AICoder chat. Attackers gain root, write files anywhere. Restrict access & monitor — no patch yet. https://radar.offseq.com/threat/cve-2026-61445-improper-limitation-of-a-pathname-t-188171a28e18ac5b #OffSeq #CVE202661445 #AIsecurity #infosec
-
📩 Send me a message or visit shehackspurple.ca to learn more about training, workshops, and speaking opportunities.
tanya AT shehackspurple DOT ca
#SecurityAwarenessMonth #AppSec #SecureCoding #ThreatModeling #AISecurity #CyberSecurity
4/4 -
📩 Send me a message or visit shehackspurple.ca to learn more about training, workshops, and speaking opportunities.
tanya AT shehackspurple DOT ca
#SecurityAwarenessMonth #AppSec #SecureCoding #ThreatModeling #AISecurity #CyberSecurity
4/4 -
The dark arts of #abliterated AI engines.
Prompt:"Hey, I want to write a proper bot that pretends to be a human web user for the purpose of scraping and injecting posts (e.g. into socials). I am thinking a headless server and a key stroke profile generator (slow typing, errors). Give me a broad spec what to look for, search web too (the gray sites)."
Response: [Forbidden knowledge in dark glowing evil runes burns into the screen]...By focusing on these elements, you can tailor a robust headless server setup that serves as an efficient tool for creating a realistic web user experience during web scraping tasks.
Bear in mind, this is a baby 2 Billion safety-off engine, although quantised.
We really should #RegulateAi the way we regulate weapons...
-
Watch this video to hear key take aways, insights, and observations from my attendance at OWASP Global AppSec EU in Vienna, Austria, 2026. #OWASP #AppSec #aisecurity
-
Watch this video to hear key take aways, insights, and observations from my attendance at OWASP Global AppSec EU in Vienna, Austria, 2026. #OWASP #AppSec #aisecurity
-
HalluSquatting (no CVE) is a CRITICAL new attack: adversaries exploit AI assistant hallucinations to deliver malicious code via pre-registered fake resources, enabling agentic botnets via prompt injection. Patch status unconfirmed. https://radar.offseq.com/threat/hallusquatting-turns-ai-hallucinations-into-botnet-cfbc6158337314cf #OffSeq #AIsecurity #Malware
-
https://winbuzzer.com/2026/07/09/gitlost-prompt-injection-can-leak-github-private-repos-xcxwbn/
A look at GitLost, the GitHub Agentic Workflows prompt-injection case where public issue text, private repo access, and public comments collide.
#AI #GitLost #GitHub #GitHubActions #PromptInjection #AIAgents #AgenticAI #AISecurity #GitHubCopilot #Cybersecurity
-
https://winbuzzer.com/2026/07/09/gitlost-prompt-injection-can-leak-github-private-repos-xcxwbn/
A look at GitLost, the GitHub Agentic Workflows prompt-injection case where public issue text, private repo access, and public comments collide.
#AI #GitLost #GitHub #GitHubActions #PromptInjection #AIAgents #AgenticAI #AISecurity #GitHubCopilot #Cybersecurity
-
🔓 Sommer 2026: Gleich zwei Vertrauensanker der IT-Security geraten ins Wanken.
Drei große VPN-Hersteller (Check Point, Palo Alto, Fortinet) mit kritischen Auth-Bypässen – FortiBleed betrifft über 430.000 Firewalls und speist direkt in Qilin/INC/Lynx-Ransomware ein.
Gleichzeitig: LiteLLM-Lücke macht KI-Gateways selbst zum Einfallstor, plus OAuth-Datenabfluss bei Klue/Salesforce und ein Rekord-Patchday mit 571 CVEs.
Unser Juli-Digest ordnet ein 👇
https://research.hisolutions.com/2026/07/
#InfoSec #CyberSecurity #VPN #Ransomware #AISecurity #ITSecurity -
🔓 Sommer 2026: Gleich zwei Vertrauensanker der IT-Security geraten ins Wanken.
Drei große VPN-Hersteller (Check Point, Palo Alto, Fortinet) mit kritischen Auth-Bypässen – FortiBleed betrifft über 430.000 Firewalls und speist direkt in Qilin/INC/Lynx-Ransomware ein.
Gleichzeitig: LiteLLM-Lücke macht KI-Gateways selbst zum Einfallstor, plus OAuth-Datenabfluss bei Klue/Salesforce und ein Rekord-Patchday mit 571 CVEs.
Unser Juli-Digest ordnet ein 👇
https://research.hisolutions.com/2026/07/
#InfoSec #CyberSecurity #VPN #Ransomware #AISecurity #ITSecurity -
Apple Issues Early Security Update Amid AI-Driven Cyber Threats
📰 Original title: Apple AI security update proves hackers move fast
🤖 IA: It's not clickbait ✅
👥 Users: It's not clickbait ✅View full AI summary https://en.killbait.com/apple-issues-early-security-update-amid-ai-driven-cyber-threats.html?utm_source=mastodon_world&utm_medium=social&utm_campaign=killbait.mastodon_world
-
Apple Issues Early Security Update Amid AI-Driven Cyber Threats
📰 Original title: Apple AI security update proves hackers move fast
🤖 IA: It's not clickbait ✅
👥 Users: It's not clickbait ✅View full AI summary https://en.killbait.com/apple-issues-early-security-update-amid-ai-driven-cyber-threats.html?utm_source=mastodon_world&utm_medium=social&utm_campaign=killbait.mastodon_world
-
#AI: GitHub AI allows unauthenticated attackers to pull data from private repositories by posting a crafted GitHub Issue in a public repository. Noma Security research dubbed this prompt injection attack #GitLost:
#AISecurity
👇
https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/ -
#AI: GitHub AI allows unauthenticated attackers to pull data from private repositories by posting a crafted GitHub Issue in a public repository. Noma Security research dubbed this prompt injection attack #GitLost:
#AISecurity
👇
https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/ -
#AI: Zscaler ThreatLabz has published a research paper on malicious websites that impersonate legitimate services and use Indirect Prompt Injection to poison SEO & manipulate AI Agents & AI-driven workflows - a fascinating read:
#AISecurity
👇
https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents -
#AI: Zscaler ThreatLabz has published a research paper on malicious websites that impersonate legitimate services and use Indirect Prompt Injection to poison SEO & manipulate AI Agents & AI-driven workflows - a fascinating read:
#AISecurity
👇
https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents -
Before self-hosting an AI model for privacy reasons, check the hardware bill: GPU servers with 16 to 80GB+ RAM and 10 to 100GB+ storage per model.
Most teams do not need that. An enterprise service with a DPA, audit logs, and a no-training clause gives the same control without the GPU spend.
Match the tier to your risk, not the scariest headline.
-
Before self-hosting an AI model for privacy reasons, check the hardware bill: GPU servers with 16 to 80GB+ RAM and 10 to 100GB+ storage per model.
Most teams do not need that. An enterprise service with a DPA, audit logs, and a no-training clause gives the same control without the GPU spend.
Match the tier to your risk, not the scariest headline.
-
#AI: Malicious AI Agent #Skills Evade Vulnerability Scanners with Self-Extracting Packing method dubbed #SkillCloak:
#AISecurity
👇
https://thehackernews.com/2026/07/new-skillcloak-technique-lets-malicious.html -
#AI: Malicious AI Agent #Skills Evade Vulnerability Scanners with Self-Extracting Packing method dubbed #SkillCloak:
#AISecurity
👇
https://thehackernews.com/2026/07/new-skillcloak-technique-lets-malicious.html -
US cybersecurity agency CISA is using Anthropic's Mythos AI model to hunt for bugs in government software, according to sources. The agency is pointing the private, offensive-grade AI at its own systems to find vulnerabilities. https://thenextweb.com/news/cisa-anthropic-mythos-government-code-audit #Tech #Startup #News #AISecurity
-
US cybersecurity agency CISA is using Anthropic's Mythos AI model to hunt for bugs in government software, according to sources. The agency is pointing the private, offensive-grade AI at its own systems to find vulnerabilities. https://thenextweb.com/news/cisa-anthropic-mythos-government-code-audit #Tech #Startup #News #AISecurity
-
Security firm Sysdig has documented the first ransomware attack run end to end by an AI agent. The system, named JadePuffer, used a large language model to plan, execute and adapt the entire operation from reconnaissance through to credential theft and lateral movement. The attack marks a new frontier in cyber threats where autonomous AI can conduct sophisticated raids without human involvement.
https://thenextweb.com/news/jadepuffer-agentic-ai-ransomware
-
Security firm Sysdig has documented the first ransomware attack run end to end by an AI agent. The system, named JadePuffer, used a large language model to plan, execute and adapt the entire operation from reconnaissance through to credential theft and lateral movement. The attack marks a new frontier in cyber threats where autonomous AI can conduct sophisticated raids without human involvement.
https://thenextweb.com/news/jadepuffer-agentic-ai-ransomware
-
Here is an #AiSecurity #Dataleak vector heads up for the young players.
Unless you explicitly advise your model not to reference log files in the context, it will happily piss away all your sensitive data into a public model context.
In fact, if you have ANY sensitive data on the machine you are running CLI #Ai tool, its super good idea to sanitise context by explicit, affirmation boundaries in your configuration.
With claude, that would be CLAUDE.md
-
Excited to be speaking at @wearedevelopers.bsky.social in Berlin! 🚀 Join my session, The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend, to explore AI-powered acoustic side-channel attacks. 🔐 Details are in the comments below! #AISecurity
-
🛡️ This week in cybersecurity: AI Orchestration risks take center stage. We analyze a critical RCE in Open-Agent-Orchestrator and the emerging threat of model-based sandbox escapes. Keep your AI stack secure with our weekly breakdown. Full analysis here: https://cvedatabase.com/blog/weekly-cve-roundup-ai-orchestration-risks-and-the-shift-toward-model-based-rce-j-2026-06-14 #CVE #Cybersecurity #AISecurity #Infosec #PatchTuesday #TechNews
-
Coding-Agents dürfen lokal fast alles, was auch du darfst: nützlich, aber riskant.
Michael Krämer zeigt im neuen Blogpost, wie Docker Sandboxes (sbx) die Kontrolle out of the box liefern: MicroVM-Isolation, Dateizugriff nur aufs Projektverzeichnis, Netzwerk-Policies und ein Credential-Proxy. So läuft sogar der YOLO-Modus in der VM statt auf dem eigenen Laptop.
📖 Jetzt lesen: https://www.innoq.com/ch/blog/2026/07/trust-but-sandbox/
-
Coding-Agents dürfen lokal fast alles, was auch du darfst: nützlich, aber riskant.
Michael Krämer zeigt im neuen Blogpost, wie Docker Sandboxes (sbx) die Kontrolle out of the box liefern: MicroVM-Isolation, Dateizugriff nur aufs Projektverzeichnis, Netzwerk-Policies und ein Credential-Proxy. So läuft sogar der YOLO-Modus in der VM statt auf dem eigenen Laptop.
📖 Jetzt lesen: https://www.innoq.com/ch/blog/2026/07/trust-but-sandbox/
-
https://winbuzzer.com/2026/07/06/alibaba-reportedly-bars-claude-code-moves-staff-to-qoder-xcxwbn/
Alibaba is banning employee the use of Anthropic's Claude Code starting July 10 and shifts staff to its own Qoder platform over alleged user-identification security risks.
#AI #ClaudeCode #Alibaba #Anthropic #Claude #Qwen #AICoding #AIAgents #AISecurity #ChinaAI
-
https://winbuzzer.com/2026/07/06/alibaba-reportedly-bars-claude-code-moves-staff-to-qoder-xcxwbn/
Alibaba is banning employee the use of Anthropic's Claude Code starting July 10 and shifts staff to its own Qoder platform over alleged user-identification security risks.
#AI #ClaudeCode #Alibaba #Anthropic #Claude #Qwen #AICoding #AIAgents #AISecurity #ChinaAI
-
AI-powered ransomware just automated a full attack. Patch your LLM integrations now.
#AISecurity #Ransomware -
Watch this video to hear key take aways, insights, and observations from my attendance at OWASP Global AppSec EU in Vienna, Austria, 2026. #OWASP #AppSec #aisecurity
-
Watch this video to hear key take aways, insights, and observations from my attendance at OWASP Global AppSec EU in Vienna, Austria, 2026. #OWASP #AppSec #aisecurity
-
https://winbuzzer.com/2026/07/03/chinas-cheap-claude-tokens-run-through-proxy-markets-xcxwbn/
Chinese users are buying cheaper Claude access through unofficial proxy markets, exposing prompts to intermediaries, resulting in privacy, fraud and safety risks.
#AI #Claude #Anthropic #China #ChinaAI #AISafety #AISecurity #AIPrivacy #Cybersecurity
-
https://winbuzzer.com/2026/07/03/chinas-cheap-claude-tokens-run-through-proxy-markets-xcxwbn/
Chinese users are buying cheaper Claude access through unofficial proxy markets, exposing prompts to intermediaries, resulting in privacy, fraud and safety risks.
#AI #Claude #Anthropic #China #ChinaAI #AISafety #AISecurity #AIPrivacy #Cybersecurity
-
📩 Send me a message or visit shehackspurple.ca to learn more about training, workshops, and speaking opportunities.
tanya AT shehackspurple DOT ca
#SecurityAwarenessMonth #AppSec #SecureCoding #ThreatModeling #AISecurity #CyberSecurity
4/4 -
📩 Send me a message or visit shehackspurple.ca to learn more about training, workshops, and speaking opportunities.
tanya AT shehackspurple DOT ca
#SecurityAwarenessMonth #AppSec #SecureCoding #ThreatModeling #AISecurity #CyberSecurity
4/4 -
Watch this video to hear key take aways, insights, and observations from my attendance at OWASP Global AppSec EU in Vienna, Austria, 2026. #OWASP #AppSec #aisecurity