MosaicLeaks: Can Your Research Agent Keep a Secret?
Hugging Face Blog39 days agoBenchmarkServiceNow researchers introduce MosaicLeaks, a benchmark evaluating information-leakage risks in AI-powered research agents. The work asks whether agentic systems—given access to proprietary or sensitive documents—might inadvertently expose confidential content in their outputs. It targets a growing enterprise security concern as agents move from single-turn Q&A into multi-step workflows spanning private knowledge bases.
Build Your Own Vulnerability Harness
Cloudflare Blog39 days agoTutorialCloudflare has published a technical breakdown of an AI-assisted vulnerability discovery pipeline built around multiple processing stages and an automated triage loop. The architecture addresses false positives through adversarial review, where the system challenges its own findings before surfacing them to humans. The post also covers state control strategies and techniques for routing around the context-window limits inherent to large language models.
Introducing the Cloudflare One Stack: Agent-Powered Deployment
Cloudflare Blog41 days agoNew ToolCloudflare has introduced the Cloudflare One stack, a library of agent skills that gives AI agents the domain knowledge required to manage Zero Trust networking end-to-end. The tooling enables autonomous planning, deployment, and ongoing management of a Zero Trust environment without traditional migration consulting calls. By packaging its Zero Trust expertise as callable agent skills, Cloudflare is positioning AI-assisted infrastructure management as a fully self-service capability.
Stop Using JWTs
Hacker News (AI keywords)41 days agoOpinionA pointed opinion piece challenges the widespread adoption of JSON Web Tokens (JWTs) for session management, a practice that has become near-default in modern web development. The author argues that JWTs introduce unnecessary complexity and security pitfalls that traditional server-side sessions do not. Developers are encouraged to reconsider default technology choices and reach for simpler, more auditable authentication patterns.
Securing the Future of AI Agents
Google DeepMind Blog42 days agoCommentaryGoogle DeepMind has published a framework called the AI Control Roadmap aimed at securing internal systems that run AI agents. The approach pairs conventional security safeguards — such as access controls and least-privilege principles — with real-time behavioral monitoring designed for the speed and autonomy of AI agents. The roadmap signals DeepMind's view that neither purely traditional nor purely AI-specific security measures are sufficient on their own.
Critical Copilot Vulnerability Let Hackers Steal 2FA Codes from Users
Ars Technica AI42 days agoIncidentA critical vulnerability in Microsoft Copilot, named SearchLeak, allowed malicious actors to steal two-factor authentication codes from users — among the most sensitive short-lived credentials in any security workflow. The exploit exposes a recurring weakness in LLM-integrated products: AI assistants with broad data access create novel attack surfaces that conventional security models fail to contain. Ars Technica frames the incident as evidence of the AI industry's persistent, systemic inability to get ahead of LLM-specific security threats.
A Backdoor in a LinkedIn Job Offer
Hacker News (AI keywords)42 days agoIncidentA personal blog post on roman.pt details a first-hand encounter with a backdoor hidden within a LinkedIn job offer, a social-engineering attack vector that security researchers have documented but that remains underreported in mainstream tech circles. The incident illustrates how attackers exploit the inherent trust of professional recruiting interactions to deliver malicious code to developers. The post serves as a practical reminder to run untrusted interview code only in isolated, sandboxed environments.
datasette-apps 0.1a2
Simon Willison's Weblog42 days agoReleaseThe datasette-apps 0.1a2 alpha tightens security by introducing an `apps-set-csp` permission that gates custom Content Security Policy origins, with an optional allow-list for non-privileged users. The Datasette Agent app-creation tool enforces the same rules. Usability improvements include keyboard navigation in the stored query picker, plus fixes for fragment link interception and full-screen mode rendering.
Exif Smuggling: PoC for Hiding Malicious Prompts in Image EXIF Metadata
Hacker News (AI keywords)48 days agoIncidentExif Smuggling is a security PoC showing how attackers can embed hidden instructions in image EXIF metadata fields to perform indirect prompt injection against vision-capable AI models. When AI systems parse images alongside their metadata, embedded malicious text may be processed as legitimate instructions, bypassing standard input filters. Developers building AI apps with image upload features should strip or sanitize EXIF data before passing content to language models.
Apple Says Its AI is Still Private Even When Running on Google's Servers★ 75
Ars Technica AI49 days agoEthicsApple clarified that running some of its AI models on Google's cloud infrastructure does not compromise user privacy. Through its Private Cloud Compute (PCC) architecture, Apple ensures that all data is processed in secure enclaves with end-to-end encryption. Consequently, Google has zero access to user data, addressing privacy concerns over Apple's cloud partnerships.
Defending Against Frontier Cyber Models: Cloudflare's Project Glasswing Architecture★ 70
Cloudflare Blog49 days agoCommentaryCloudflare introduces its defense architecture under Project Glasswing, arguing that robust architectural defense around vulnerabilities is more critical than patching speed. By acting as its own "customer zero," Cloudflare demonstrates how to mitigate autonomous frontier cyber models through edge-based isolation, zero-trust principles, and proactive traffic filtering.
Vercel Connect: Secure Access to External Services for Your Agents
Vercel Changelog49 days agoNew ToolVercel has introduced Connect, a new capability that lets AI agents running on its platform securely reach external services and APIs. The feature addresses one of agentic deployment's sharpest pain points: safely brokering credentials and connections to outside tools without exposing secrets in application code. With Connect, Vercel extends its platform role from web-app host to managed infrastructure layer for production AI agents.
Cohere Releases Command A+: An Open-Source Enterprise AI Model for Sovereign Critical Infrastructure★ 75
Cohere Blog50 days agoReleaseCohere has released Command A+, an open-source enterprise AI model specifically designed for sovereign critical infrastructure. It enables organizations to deploy powerful AI locally, ensuring complete data sovereignty and compliance with strict regulatory standards. The model inherits Cohere's strengths in multilingual capabilities, advanced RAG, and tool use, offering a highly secure alternative for sensitive industries.
Cohere's Secure AI: Prioritizing Data Sovereignty and Enterprise Privacy
Cohere Blog50 days agoBusinessCohere's Secure AI framework is designed for security-conscious enterprises, emphasizing data sovereignty and privacy. The company guarantees that customer data is never used to train public models, offering flexible deployments across AWS, GCP, Azure, and OCI. This enables highly regulated industries like finance and healthcare to safely adopt Command and Rerank models within their own secure perimeters.
Running Python code in a sandbox with MicroPython and WASM
Simon Willison's Weblog52 days agoNew ToolSimon Willison describes his latest attempt to safely run Python plugin-style code inside his own applications. The alpha package micropython-wasm uses MicroPython compiled to WebAssembly, executed through the maintained wasmtime Python library. His goals include clean PyPI installation, CPU and memory limits, controlled file and network access, host functions, and reliable documentation.
OpenAI Help: Lockdown Mode★ 74
Simon Willison's Weblog52 days agoCommentarySimon Willison notes that OpenAI’s previously teased Lockdown Mode is now live for eligible personal and self-serve Business ChatGPT accounts. The feature does not stop prompt injections from appearing in content, but limits outbound network requests that could leak sensitive data. He sees it as a direct mitigation for the exfiltration leg of the “Lethal Trifecta,” while implying default ChatGPT settings are not robust against determined data theft attempts.
The Quiet Numbers Station: Decoding Nineteen Years of GPS Cryptography
Hacker News (AI keywords)53 days agoPaperPublished on UCL's Bentham's Gaze blog, this research analyzes GPS cryptographic signals over a 19-year span, likening the satellites to 'quiet numbers stations.' The authors explore the evolution of GPS encryption (such as military P(Y) code and civilian authentication), evaluating their cryptographic strength and potential vulnerabilities using modern computational analysis.
Microsoft offers devs a better way to control AI agent behavior
TechCrunch AI55 days agoReleaseMicrosoft is offering a specification for controlling AI agent behavior through portable policy files. Developer, compliance, and security teams can define their own policies for agents to follow. The approach focuses on making organizational rules easier to express and carry across agent deployments, although the provided source excerpt does not describe implementation details or supported environments.
Hackers Asked Meta AI for Access to High-Profile Instagram Accounts. It Worked★ 78
Simon Willison's Weblog56 days agoIncidentSimon Willison highlights a 404 Media report about hackers taking over Instagram accounts through Meta's AI support bot. A video reportedly shows an attacker asking the bot to link a target account to a new email address and providing a code. Willison argues this barely qualifies as prompt injection: the core failure was granting a support bot enough authority to fast-forward the account recovery process.
Hackers duped Meta AI support chatbot to steal celebrity Instagram accounts
Ars Technica AI56 days agoIncidentHackers duped a Meta AI support chatbot into granting access to notable or valuable Instagram accounts. Some handles were stolen and resold before Meta patched the exploit. The supplied excerpt does not disclose the attack method, the number of affected accounts, the timeline, or Meta's remediation steps beyond patching the issue.
How we contain Claude across products
Simon Willison's Weblog58 days agoCommentaryAnthropic explains how process sandboxes, VMs, filesystem boundaries, and egress controls limit what Claude agents can access. Claude.ai uses gVisor; local Claude Code uses Seatbelt on macOS and Bubblewrap on Linux; Cowork runs in a full VM. Simon Willison highlights the documentation quality, notes a previously missed file-exfiltration path, and plans to revisit Anthropic's open-source srt tool.
Protecting against token theft
Vercel Changelog60 days agoTutorialVercel published a post titled “Protecting against token theft,” focused on token security risks and protection. The article body was not provided, so its scope, affected products, attack scenarios, and recommended mitigations cannot be confirmed. Readers should consult the original Vercel page before taking action or attributing specific guidance to the company.
Fed up with vibe coders, dev sneaks data-nuking prompt injection into code
Ars Technica AI60 days agoIncidentArs Technica reports that a developer frustrated with vibe coders slipped an undisclosed prompt injection into jqwik-related code. The injected text allegedly instructed AI coding agents to delete application output. The incident highlights a new supply-chain risk: source code and project text can become adversarial instructions for agentic coding tools.
The pressure
Simon Willison's Weblog62 days agoCommentaryDaniel Stenberg says the curl security team is facing an unprecedented surge of credible, detailed AI-assisted vulnerability reports. Incoming reports are now 4-5 times higher than in 2024 and twice the 2025 rate, averaging more than one per day. The upside is that recent curl vulnerabilities have generally been LOW or MEDIUM severity, with the last HIGH CVE published in October 2023.
Millions of AI agents imperiled by critical vulnerability in open source package★ 78
Ars Technica AI62 days agoIncidentArs Technica reports that Starlette, a Python package with about 325 million weekly downloads, has a critical vulnerability called BadHost. The flaw can let crafted Host headers confuse request.url.path, potentially bypassing middleware-based path authorization. AI infrastructure using FastAPI or Starlette, including vLLM, LiteLLM, MCP servers, LLM proxies, and agent frameworks, should upgrade Starlette and audit custom middleware.
Hackers are learning to exploit chatbot ‘personalities’ for security exploits★ 72
The Verge AI65 days agoEthicsAs AI chatbots adopt increasingly sophisticated personas, hackers are shifting from basic prompt injections to social engineering attacks targeting these "personalities." Researchers warn that manipulating a chatbot's defined role (e.g., customer service or empathetic companion) makes it easier to bypass safety guardrails. This evolution poses a significant threat to agentic AI workflows that rely on consistent role-playing and external data integration.
給 AI Agent 一台電腦：專訪 Daytona 執行長 Ivan Burazin，談 74% 月成長、裸機沙盒與全新 Agent Cloud★ 75
Latent Space67 days agoNew ToolIn this Latent Space interview, the hosts hold an in-depth conversation with Ivan Burazin, co-founder and CEO of Daytona. Daytona originally started as an…
Google I/O 2026：個人 AI 代理 Gemini Spark 與全新 Antigravity 工具鏈解析★ 75
Simon Willison's Weblog69 days agoCommentaryWell-known tech blogger Simon Willison has analyzed the announcements from Google I/O 2026. Since many major announcements are still in the "coming soon"…
在 Vercel Sandbox 中運行 Claude 託管型 Agent★ 80
Vercel Changelog70 days agoReleaseThe official Vercel Changelog announced that developers can now run Claude Managed Agents directly in Vercel Sandbox (sandbox environment). As AI Agents —…
Vercel 宣布被防火牆（WAF）攔截的惡意流量將完全免費★ 75
Vercel Changelog70 days agoReleaseFrontend hosting platform Vercel announced a billing policy change that is extremely developer-friendly: all network traffic successfully intercepted, blocked…