Topic · 60 stories · page 1 of 3
60 stories tagged security on AI Tamer, newest first.
AWS Continuum for code vulnerabilities is generally available in two US regions. It sandboxes exploits, ranks by business impact and opens fix PRs you approve.
Before 0.40.0, LanceDB's Cloud client put table names into REST URLs unencoded, so a name with ../ could reach another table or tenant. Upgrade.
In preview for GitHub Enterprise Cloud, it blocks malware, risky versions, new install scripts and too-fresh npm packages before agents or CI install them.
OpenAI says frontier RL runs now use a cached offline web, after agent red-teams found microVM escapes, internet paths and covert channels.
Unit 42 says an attacker it calls BUGSTER used Hermes Agent, DeepSeek V4 and a Cursor setup with safety off to hit Indian universities and plan VoIP fraud.
Pillow 13.0.0 lists 38 security fixes, two rated critical, including EPS argument injection and a JPEG bug Anthropic found with Claude. Upgrade and rebuild.
Anthropic's red team and Theorem used Claude to write Rocq proofs for 123 open-source libraries. The proofs carry real assumptions and cost many tokens.
An agent asks, you approve in 1Password, and 1Password fills the login itself. Free on Individual and Family plans; most agent integrations are still coming.
Before 1.20, any host that reached Qdrant's internal port 6335 could join a cluster and copy shards. The fix needs an API key. BM25 and turbo8 also land.
Eight changes from our past week for people building with AI: model shutdowns, new defaults, two security fixes and new tools, each with a next step.
Railway paused deploys, killed API tokens and reset bucket and GitHub credentials. It says to roll every environment variable and check AI provider bills.
Claude Duet is a waitlist preview for US Pro and Max users. Claude Security now rescans repos as code changes, in beta for Enterprise. What each does.
Microsoft says a China-aligned group used ARTEX agents after the ConnectWise Cloud Backup breach, trying 2,250+ Microsoft 365 tenants. What to check.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical RCE bugs reported with AI help. AWS logged an attempt on 17 October, four days before disclosure.
Poisoned LiteLLM 1.107.0 wheels and images stole cloud, SSH and AI keys, plus provider keys stored in the proxy database. What happened and what to do.
A Symantec honeypot captured an offensive agent's full prompt: 74 tools, up to 100,000 unattended steps, run on stolen inference. How to close the door.
PingCAP says stolen service-account credentials let an attacker copy TiDB Cloud records and source code from 9 Sep to 7 Oct. Rotate management API keys now.
Anthropic says Claude found 493 attack-surface issues in 25 projects. OpenSSH 10.5 and 10.6 credit the work for checking key types earlier.
In 90 of 6,637 malicious agent skills, VirusTotal found the payload hidden where reviewers don't see it but agents still read it. Here is how to check.
The twelfth tutorial is the boundary: what leaves the computer, where a credential belongs, and which rules a chat cannot skip.
NVIDIA App 11.0.9.565 runs a local MCP server so AI agents can launch games and change settings. VideoCardz found it on by default. One toggle disables it.
OpenCode says a breach hit 1.4% of OpenCode Console users with linked providers. If you got its email, revoke those keys at each provider.
On 17 and 18 October Codewhale fixed deny-list, sub-agent, and sandbox gaps on main. They are not in the 8 October v0.10.1 release.
CERT-In says unnamed AI providers disclosed that agents reached Indian organisations' live systems and read personal and confidential records.
