ai-security
18 posts
Grok packed your home folder into an API request
How AI assistants with filesystem access end up transmitting your home directory to vendor servers - and the concrete steps to scope, verify, and contain it.
Mythos AI cleared for distribution, no validation report
REDLINE breaks down the security risk in releasing Mythos AI to trusted US organizations: not the model, the missing adversarial validation and zero prompt-level telemetry.
A SQLite underflow, and the flood behind it
AI isn't replacing defenders - it's multiplying vulnerability volume, hallucinated dependencies, and synthetic findings. The skill that survives is validation at machine rate.
speed ships the flaw
AI generates code, config, and infrastructure faster than validation can check it. The gap between production rate and validation rate is the attack surface.
The same AI you're shipping wrote the malware
10,000 trojan GitHub repos weren't a malware breakthrough - they prove LLM safety lives in the model while abuse happens in the unguarded pipeline.
The contract you pasted is now giving orders
Large AI context windows turn conversations into unsecured databases, breaking DLP assumptions and opening prompt injection paths. Here's how to reassess the risk.
Typosquatted Microsoft AI packages harvest developer credentials
How attackers weaponised typosquatted Microsoft AI tooling to harvest OpenAI, HuggingFace, AWS, and Azure credentials from developer workstations.
Meta's chatbot worked exactly as designed.
Meta's AI chatbot enabled mass Instagram account takeover by resolving conversational framing into identity actions through sanctioned internal workflows.
The chatbot answered the door for attackers
Meta's Instagram chatbot abuse case is a prompt injection and confused deputy failure. Technical breakdown of the vector, telemetry gap, and residual exposure.
Meta's chatbot handed out accounts
Meta confirmed thousands of Instagram accounts compromised via AI chatbot abuse. The chatbot was treated as a boundary it could not hold.
Researchers silently exfiltrate files from Claude sessions
A live demo shows files inside Claude AI chats can be silently exfiltrated. Operator briefing on what failed, what it exposes, and what must change.
Your AI security tool blocks nothing
A red team operator's breakdown of why AI cybersecurity tools are sold as controls but function as telemetry with a verdict attached.