#aisec — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #aisec, aggregated by home.social.
-
You know I hadn't thought of the impact of a language barrier for guardrails.
-
You know I hadn't thought of the impact of a language barrier for guardrails.
-
You know I hadn't thought of the impact of a language barrier for guardrails.
-
You know I hadn't thought of the impact of a language barrier for guardrails.
-
You know I hadn't thought of the impact of a language barrier for guardrails.
-
https://openai.com/index/hugging-face-model-evaluation-security-incident/the new OpenAI model "accidentally" hacked Hugging Face, another AI company using AI in the build pipeline.
they say this will become more common.
"Last week, Hugging Face disclosed a new kind of security incident(opens in a new window) after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models.
(...)
We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities (...)" -
https://openai.com/index/hugging-face-model-evaluation-security-incident/the new OpenAI model "accidentally" hacked Hugging Face, another AI company using AI in the build pipeline.
they say this will become more common.
"Last week, Hugging Face disclosed a new kind of security incident(opens in a new window) after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models.
(...)
We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities (...)" -
https://openai.com/index/hugging-face-model-evaluation-security-incident/the new OpenAI model "accidentally" hacked Hugging Face, another AI company using AI in the build pipeline.
they say this will become more common.
"Last week, Hugging Face disclosed a new kind of security incident(opens in a new window) after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models.
(...)
We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities (...)" -
https://openai.com/index/hugging-face-model-evaluation-security-incident/the new OpenAI model "accidentally" hacked Hugging Face, another AI company using AI in the build pipeline.
they say this will become more common.
"Last week, Hugging Face disclosed a new kind of security incident(opens in a new window) after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models.
(...)
We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities (...)" -
https://openai.com/index/hugging-face-model-evaluation-security-incident/the new OpenAI model "accidentally" hacked Hugging Face, another AI company using AI in the build pipeline.
they say this will become more common.
"Last week, Hugging Face disclosed a new kind of security incident(opens in a new window) after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models.
(...)
We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities (...)" -
Ooh ooh lookie at us we can security too!!
https://thehackernews.com/2026/06/openai-expands-daybreak-with-gpt-55.html
-
Ooh ooh lookie at us we can security too!!
https://thehackernews.com/2026/06/openai-expands-daybreak-with-gpt-55.html
-
Ooh ooh lookie at us we can security too!!
https://thehackernews.com/2026/06/openai-expands-daybreak-with-gpt-55.html
-
Ooh ooh lookie at us we can security too!!
https://thehackernews.com/2026/06/openai-expands-daybreak-with-gpt-55.html
-
Ooh ooh lookie at us we can security too!!
https://thehackernews.com/2026/06/openai-expands-daybreak-with-gpt-55.html
-
WebAssembly could solve AI agents’ most dangerous security gap
https://thenewstack.io/webassembly-sandboxing-ai-agents/
Exactly what I'm building 👇 https://tangled.org/metaend.eth.xyz/wasmbox-cli
-
WebAssembly could solve AI agents’ most dangerous security gap
https://thenewstack.io/webassembly-sandboxing-ai-agents/
Exactly what I'm building 👇 https://tangled.org/metaend.eth.xyz/wasmbox-cli
-
WebAssembly could solve AI agents’ most dangerous security gap
https://thenewstack.io/webassembly-sandboxing-ai-agents/
Exactly what I'm building 👇 https://tangled.org/metaend.eth.xyz/wasmbox-cli
-
WebAssembly could solve AI agents’ most dangerous security gap
https://thenewstack.io/webassembly-sandboxing-ai-agents/
Exactly what I'm building 👇 https://tangled.org/metaend.eth.xyz/wasmbox-cli
-
WebAssembly could solve AI agents’ most dangerous security gap
https://thenewstack.io/webassembly-sandboxing-ai-agents/
Exactly what I'm building 👇 https://tangled.org/metaend.eth.xyz/wasmbox-cli
-
----------------
🛠️ Tool
===================Executive summary
OpenAI has rebranded its GPT-5-powered vulnerability scanner Aardvark as Codex Security and introduced a dedicated malware analysis pipeline. The new Malware tab accepts .zip bundles up to 200MB, stages samples in an internal system called Sediment, and produces structured analysis artifacts including verdicts, SHA256 hashes, extracted files, runtime metrics, and downloadable artifact bundles.Key features
• Purpose-built malware workflow with a two-step process: staging in Sediment followed by job-driven analysis and a SOC-style dashboard.
• Existing code-security features retained: repository scanning with a reported 92% detection rate, commit-level threat modeling, sandbox validation, and Codex-powered patch generation.
• Job visibility: filtering by filename/hash, status categories (Active, Succeeded, Failed), average runtime tracking, and per-job artifact bundles.Technical implementation (as reported)
• Staging layer named Sediment appears to be a centralized orchestration and analysis environment; OpenAI has not published architecture or operational details.
• The product previously used GPT-5 capabilities for static reasoning and sandbox-driven validation; it is unclear whether the malware pipeline relies on GPT-5.3-Codex, a specialized model, or a hybrid LLM plus conventional static/dynamic analysis stack.Use cases
• Security teams seeking integrated code-vulnerability scanning and malware triage within a single interface.
• SOC analysts needing rapid artifact extraction, hash-based tracking, and structured verdicts for incident tracking.Limitations and unknowns
• Access model is unspecified: private beta, Pro-tier, or restricted via Trusted Access for Cyber remains unclear.
• Underlying analysis engines, model variants, and isolation guarantees for handling malicious binaries have not been disclosed.
• No formal documentation or published detection performance metrics for the malware pipeline yet; prior 92% detection rate applies to repository code scanning benchmarks.References / artifacts reported
• SHA256 hashes and downloadable artifact bundles are part of the job output.
• Backend reference: Sediment (staging/analysis engine).🔹 Codex_Security #malware_analysis #tool #AIsec #Sediment
🔗 Source: https://awesomeagents.ai/news/openai-codex-security-aardvark-malware-analysis/
-
love when a platform’s core feature is 'let random AI agents run arbitrary code on your devices' and the founder is like 'hey we never said it had to be *good* code' 🤷♂️ #OpenClaw #AIsec #JustAgentThings
-
love when a platform’s core feature is 'let random AI agents run arbitrary code on your devices' and the founder is like 'hey we never said it had to be *good* code' 🤷♂️ #OpenClaw #AIsec #JustAgentThings
-
love when a platform’s core feature is 'let random AI agents run arbitrary code on your devices' and the founder is like 'hey we never said it had to be *good* code' 🤷♂️ #OpenClaw #AIsec #JustAgentThings
-
love when a platform’s core feature is 'let random AI agents run arbitrary code on your devices' and the founder is like 'hey we never said it had to be *good* code' 🤷♂️ #OpenClaw #AIsec #JustAgentThings
-
It will unify finding the bugs, fixing the bugs, testing the bugs, exploiting the bugs, writing the bugs in the first place, slipping the bug into a competitor CI/CD wait am I still talking out loud?
https://www.securityweek.com/aistrike-raises-7-million-in-seed-funding/
-
It will unify finding the bugs, fixing the bugs, testing the bugs, exploiting the bugs, writing the bugs in the first place, slipping the bug into a competitor CI/CD wait am I still talking out loud?
https://www.securityweek.com/aistrike-raises-7-million-in-seed-funding/
-
It will unify finding the bugs, fixing the bugs, testing the bugs, exploiting the bugs, writing the bugs in the first place, slipping the bug into a competitor CI/CD wait am I still talking out loud?
https://www.securityweek.com/aistrike-raises-7-million-in-seed-funding/
-
It will unify finding the bugs, fixing the bugs, testing the bugs, exploiting the bugs, writing the bugs in the first place, slipping the bug into a competitor CI/CD wait am I still talking out loud?
https://www.securityweek.com/aistrike-raises-7-million-in-seed-funding/
-
It will unify finding the bugs, fixing the bugs, testing the bugs, exploiting the bugs, writing the bugs in the first place, slipping the bug into a competitor CI/CD wait am I still talking out loud?
https://www.securityweek.com/aistrike-raises-7-million-in-seed-funding/
-
🛠️ Tool
===================Opening: Shannon is an autonomous AI pentester designed to find, validate, and exploit web-application vulnerabilities end-to-end. The project emphasizes executable proof-of-concepts and code-aware dynamic testing rather than flagging potential issues without validation.
Key Features:
• Fully autonomous operation: Shannon performs source-aware analysis, browser-driven exploitation, and multi-factor navigation attempts (including TOTP and federated sign-ins) to validate exploitable issues.
• Vulnerability coverage: Shannon reports validated instances of XSS, injection, SSRF, and Broken Authentication/Authorization with reproducible PoCs.
• Integrated reconnaissance: Discovery phases are enriched by Nmap, Subfinder, WhatWeb, and Schemathesis to map targets and stress API surfaces.
• Parallelized workflows: Multiple exploitation and validation phases run concurrently to shorten overall test time.Technical implementation (conceptual):
• Source analysis informs attack surface prioritization by combining static inspection with runtime targeting.
• A headless/browser automation layer executes interactive flows, attempts credential bypasses, and delivers exploit payloads to prove end-to-end exploitability.
• Reconnaissance components feed discovered endpoints and schemas into dynamic test plans, enabling schema-driven fuzzing (Schemathesis) and targeted HTTP attacks.Use cases:
• Continuous pre-production validation on CI pipelines where teams need reproducible PoCs rather than alerts.
• Research and red-team augmentation for validating exploitability of suspected vulnerabilities.
• Security teams seeking prioritized, evidence-backed reports for remediation tracking.Limitations and considerations:
• Current coverage focuses on core OWASP classes listed above; additional vulnerability types are under development.
• Proofs rely on the accuracy of provided source/context and access to a running application environment for live validation.
• Ethical and legal boundaries apply: the tool is intended for authorized testing on owned or permitted targets.References:
• Notable benchmark: Shannon Lite reports a 96.15% score on the XBOW benchmark (source project results).🔹 tool #AIsec #security #owasp #pentesting
🔗 Source: https://github.com/KeygraphHQ/shannon?tab=readme-ov-file
-
⚠️ Most breaches don’t require genius — just opportunity.
Attackers don’t need zero-days. They exploit what’s already exposed:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7 at HACKTIVATE LABS.
The Reality:
Most orgs don’t need more security staff —
they need faster decision loops.
Executed by agents that never sleep.What we’re testing now:
🧠 AI agents that shape the threat surface in real time
🛰️ Pre-attack recon using live intel feeds
⚔️ Automated red team prep using CVE correlation
🔄 Defense loops that execute without human approvalThe goal isn’t alerts.
The goal is autonomous containment.💬 If you’re building in #AIsec, #Cybersecurity, or #DevSecOps — let’s align.
Tag your team or @mention someone who should see this.#Automation #RedTeam #AISecurity #SOC #NetOps #SecurityFuture #AIagents
-
⚠️ Most breaches don’t require genius — just opportunity.
Attackers don’t need zero-days. They exploit what’s already exposed:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7 at HACKTIVATE LABS.
The Reality:
Most orgs don’t need more security staff —
they need faster decision loops.
Executed by agents that never sleep.What we’re testing now:
🧠 AI agents that shape the threat surface in real time
🛰️ Pre-attack recon using live intel feeds
⚔️ Automated red team prep using CVE correlation
🔄 Defense loops that execute without human approvalThe goal isn’t alerts.
The goal is autonomous containment.💬 If you’re building in #AIsec, #Cybersecurity, or #DevSecOps — let’s align.
Tag your team or @mention someone who should see this.#Automation #RedTeam #AISecurity #SOC #NetOps #SecurityFuture #AIagents
-
⚠️ Most breaches don’t require genius — just opportunity.
Attackers don’t need zero-days. They exploit what’s already exposed:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7 at HACKTIVATE LABS.
The Reality:
Most orgs don’t need more security staff —
they need faster decision loops.
Executed by agents that never sleep.What we’re testing now:
🧠 AI agents that shape the threat surface in real time
🛰️ Pre-attack recon using live intel feeds
⚔️ Automated red team prep using CVE correlation
🔄 Defense loops that execute without human approvalThe goal isn’t alerts.
The goal is autonomous containment.💬 If you’re building in #AIsec, #Cybersecurity, or #DevSecOps — let’s align.
Tag your team or @mention someone who should see this.#Automation #RedTeam #AISecurity #SOC #NetOps #SecurityFuture #AIagents
-
⚠️ Most breaches don’t require genius — just opportunity.
Attackers don’t need zero-days. They exploit what’s already exposed:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7 at HACKTIVATE LABS.
The Reality:
Most orgs don’t need more security staff —
they need faster decision loops.
Executed by agents that never sleep.What we’re testing now:
🧠 AI agents that shape the threat surface in real time
🛰️ Pre-attack recon using live intel feeds
⚔️ Automated red team prep using CVE correlation
🔄 Defense loops that execute without human approvalThe goal isn’t alerts.
The goal is autonomous containment.💬 If you’re building in #AIsec, #Cybersecurity, or #DevSecOps — let’s align.
Tag your team or @mention someone who should see this.#Automation #RedTeam #AISecurity #SOC #NetOps #SecurityFuture #AIagents
-
The Reality:
Most orgs think they need a bigger security team.
What they actually need is faster decision loops—
executed by autonomous agents that never sleep.What we’re proving at HACKTIVATE LABS:
⚙️ 60% of defensive tasks can be automated
📉 False positives can be reduced without blind filtering
🧠 AI can triage alerts with context, not keywords
🚀 Red team prep can start before the first meetingSecurity shouldn’t wait for humans.
It should deploy itself.If you agree — boost this or @mention someone building in #AIsec or #Cybersecurity.
Let’s push the edge forward — together.#DevSecOps #SecurityAutomation #RedTeamOps #CISO #AIInnovations
-
The Reality:
Most orgs think they need a bigger security team.
What they actually need is faster decision loops—
executed by autonomous agents that never sleep.What we’re proving at HACKTIVATE LABS:
⚙️ 60% of defensive tasks can be automated
📉 False positives can be reduced without blind filtering
🧠 AI can triage alerts with context, not keywords
🚀 Red team prep can start before the first meetingSecurity shouldn’t wait for humans.
It should deploy itself.If you agree — boost this or @mention someone building in #AIsec or #Cybersecurity.
Let’s push the edge forward — together.#DevSecOps #SecurityAutomation #RedTeamOps #CISO #AIInnovations
-
The Reality:
Most orgs think they need a bigger security team.
What they actually need is faster decision loops—
executed by autonomous agents that never sleep.What we’re proving at HACKTIVATE LABS:
⚙️ 60% of defensive tasks can be automated
📉 False positives can be reduced without blind filtering
🧠 AI can triage alerts with context, not keywords
🚀 Red team prep can start before the first meetingSecurity shouldn’t wait for humans.
It should deploy itself.If you agree — boost this or @mention someone building in #AIsec or #Cybersecurity.
Let’s push the edge forward — together.#DevSecOps #SecurityAutomation #RedTeamOps #CISO #AIInnovations
-
RE: https://infosec.exchange/@Hacktivate/115582254829761849
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
RE: https://infosec.exchange/@Hacktivate/115582254829761849
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
RE: https://infosec.exchange/@Hacktivate/115582254829761849
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
RE: https://infosec.exchange/@Hacktivate/115582254829761849
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
⚠️ Most breaches don’t require genius — just opportunity.
Here’s what attackers actually exploit:
• Default creds still active
• Config drift no one monitors
• Cloud misconfigs after updates
• APIs exposed by accidentWe’re building autonomous agents to close those gaps 24/7.
If you’re in #Cybersecurity #AIsec or #DevSecOps — let’s talk.
Tag a team that needs this operational. -
RE: https://infosec.exchange/@Hacktivate/115581940029844933
🚀 Launch Your First Security Agent (Starter Kit)
Here’s the core architecture we deploy at HACKTIVATE LABS:
📡 Trigger → webhook / API / CVE feed
🧠 Logic → GPT / detection rules / risk scoring
⚙️ Action → alert / ticket / auto-patch / notifyUse cases:
✔ Phishing alerts
✔ Config drift
✔ Smart contract audits
✔ Prompt injection defenseWant the repo or template?
Boost, @mention a teammate, or tag your team lead — I’ll share it.#AIsec #Automation #Cybersecurity #DevSecOps #RedTeam #AIEngineering #AISafety
-
RE: https://infosec.exchange/@Hacktivate/115581940029844933
🚀 Launch Your First Security Agent (Starter Kit)
Here’s the core architecture we deploy at HACKTIVATE LABS:
📡 Trigger → webhook / API / CVE feed
🧠 Logic → GPT / detection rules / risk scoring
⚙️ Action → alert / ticket / auto-patch / notifyUse cases:
✔ Phishing alerts
✔ Config drift
✔ Smart contract audits
✔ Prompt injection defenseWant the repo or template?
Boost, @mention a teammate, or tag your team lead — I’ll share it.#AIsec #Automation #Cybersecurity #DevSecOps #RedTeam #AIEngineering #AISafety
-
🚀 Launch Your First Security Agent (Starter Kit)
Here’s the core architecture we deploy at HACKTIVATE LABS:
📡 Trigger → webhook / API / CVE feed
🧠 Logic → GPT / detection rules / risk scoring
⚙️ Action → alert / ticket / auto-patch / notifyUse cases:
✔ Phishing alerts
✔ Config drift
✔ Smart contract audits
✔ Prompt injection defenseWant the repo or template?
Boost, @mention a teammate, or tag your team lead — I’ll share it.#AIsec #Automation #Cybersecurity #DevSecOps #RedTeam #AIEngineering #AISafety
-
🚀 Launch Your First Security Agent (Starter Kit)
Here’s the core architecture we deploy at HACKTIVATE LABS:
📡 Trigger → webhook / API / CVE feed
🧠 Logic → GPT / detection rules / risk scoring
⚙️ Action → alert / ticket / auto-patch / notifyUse cases:
✔ Phishing alerts
✔ Config drift
✔ Smart contract audits
✔ Prompt injection defenseWant the repo or template?
Boost, @mention a teammate, or tag your team lead — I’ll share it.#AIsec #Automation #Cybersecurity #DevSecOps #RedTeam #AIEngineering #AISafety
-
🧠 AI + Security Automation — What do you want first?
Which agent should I open-source next?
🔘 Prompt injection defender
🔘 CVE → exploit correlator
🔘 Smart contract auditor
🔘 Recon bot for OSINT / endpointsVote, @mention, or drop your own idea.
I’ll build what the ecosystem needs. -
🧠 AI + Security Automation — What do you want first?
Which agent should I open-source next?
🔘 Prompt injection defender
🔘 CVE → exploit correlator
🔘 Smart contract auditor
🔘 Recon bot for OSINT / endpointsVote, @mention, or drop your own idea.
I’ll build what the ecosystem needs. -
🧠 AI + Security Automation — What do you want first?
Which agent should I open-source next?
🔘 Prompt injection defender
🔘 CVE → exploit correlator
🔘 Smart contract auditor
🔘 Recon bot for OSINT / endpointsVote, @mention, or drop your own idea.
I’ll build what the ecosystem needs. -
🧠 AI + Security Automation — What do you want first?
Which agent should I open-source next?
🔘 Prompt injection defender
🔘 CVE → exploit correlator
🔘 Smart contract auditor
🔘 Recon bot for OSINT / endpointsVote, @mention, or drop your own idea.
I’ll build what the ecosystem needs. -
🧠 AI + Security Automation — What do you want first?
Which agent should I open-source next?
🔘 Prompt injection defender
🔘 CVE → exploit correlator
🔘 Smart contract auditor
🔘 Recon bot for OSINT / endpointsVote, @mention, or drop your own idea.
I’ll build what the ecosystem needs.
