#taint-analysis
#taint-analysis
[ follow ]
#cybersecurity #malware #claude-code #supply-chain-attack #anthropic #ai #ai-security #axios #security
#ai
Artificial intelligence
fromFuturism
2 days agoThe Fact That Anthropic Has Been Boasting About How Much Its Development Now Relies on Claude Makes It Very Interesting That It Just Suffered a Catastrophic Leak of Its Source Code
Anthropic's Claude Code AI agent leaked internal source code, raising cybersecurity concerns despite claims of no sensitive data exposure.
Artificial intelligence
fromFuturism
2 days agoThe Fact That Anthropic Has Been Boasting About How Much Its Development Now Relies on Claude Makes It Very Interesting That It Just Suffered a Catastrophic Leak of Its Source Code
Anthropic's Claude Code AI agent leaked internal source code, raising cybersecurity concerns despite claims of no sensitive data exposure.
#ai-security
Artificial intelligence
fromInfoQ
6 days agoTeleport Report Finds Over-Privileged AI Systems Linked to Fourfold Rise in Security Incidents
Excessive access permissions to AI systems lead to significantly more security incidents in enterprises.
Information security
fromTechzine Global
1 month agoClaude can now scan for complex vulnerabilities, but who will find them?
Claude Code Security uses AI to scan entire codebases for complex, context-dependent vulnerabilities beyond traditional static analysis, offered in limited preview to enterprise customers.
DevOps
fromTechzine Global
2 weeks agoBloodHound sniffs out attack paths in Okta, GitHub, and Mac environments
BloodHound Enterprise expands to Okta, GitHub, and Mac environments via OpenGraph extensions, enabling identity attack path management across hybrid platforms with integrations to Palo Alto, Microsoft Sentinel, and ServiceNow.
Business intelligence
fromSecuritymagazine
3 weeks agoAI Security and Forensic Accounting: Protecting Financial Systems in an Automated World
AI-enhanced forensic accounting is essential for detecting financial fraud and payment manipulation in automated financial systems vulnerable to sophisticated, AI-driven attacks.
DevOps
fromTechzine Global
2 weeks agoNinjaOne launches Vulnerability Management for detection and remediation
NinjaOne's Vulnerability Management solution enables real-time vulnerability detection and automated remediation integrated into a single workflow, eliminating delays from traditional periodic scanning approaches.
#application-security
Software development
fromTechzine Global
2 weeks agoCheckmarx Focuses AppSec on AI Development
Checkmarx One integrates AI-driven security with autonomous agents to continuously monitor code throughout development, shifting security from a separate step to an embedded process that addresses vulnerabilities earlier in the cycle.
Software development
fromTechzine Global
2 weeks agoCheckmarx Focuses AppSec on AI Development
Checkmarx One integrates AI-driven security with autonomous agents to continuously monitor code throughout development, shifting security from a separate step to an embedded process that addresses vulnerabilities earlier in the cycle.
Information security
fromThe Hacker News
2 weeks agoClaude Code Security and Magecart: Getting the Threat Model Right
Magecart attacks hide malicious code in dynamically loaded third-party assets and EXIF metadata, bypassing repository-based static analysis tools like Claude Code Security because the code never enters the source repository.
Information security
fromBleepingComputer
2 weeks agoGlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
GlassWorm supply-chain campaign compromised 433 components across GitHub, npm, and VSCode/OpenVSX, using a single Solana blockchain address for command-and-control across coordinated attacks targeting cryptocurrency wallets and developer credentials.
Information security
fromThe Hacker News
2 weeks agoAI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE
Amazon Bedrock AgentCore Code Interpreter's sandbox allows outbound DNS queries, enabling attackers to exfiltrate data and establish command-and-control channels despite network isolation configuration.
fromSecurityWeek
1 month agoHow to Eliminate the Technical Debt of Insecure AI-Assisted Software Development
This extends to the software development community, which is seeing a near-ubiquitous presence of AI-coding assistants as teams face pressures to generate more output in less time. While the huge spike in efficiencies greatly helps them, these teams too often fail to incorporate adequate safety controls and practices into AI deployments. The resulting risks leave their organizations exposed, and developers will struggle to backtrack in tracing and identifying where - and how - a security gap occurred.
Artificial intelligence
fromThe Hacker News
3 weeks agoInvestigating a New Click-Fix Variant
Atos Researchers identified a new variant of the popular ClickFix technique, where attackers convince the user to execute a malicious command on their own device through the Win + R shortcut. In this variation, a "net use" command is used to map a network drive from an external server, after which a ".cmd" batch file hosted on that drive is executed.
Information security
Information security
fromComputerWeekly.com
3 weeks agoVulnerability reports: Increase in quantity, decrease in quality? | Computer Weekly
Bug bounty programs face sustainability challenges due to increased low-quality submissions, prompting cURL founder Daniel Stenberg to shut down his HackerOne program and switch to GitHub for vulnerability reporting.
Artificial intelligence
fromInfoWorld
2 months agoOutput from vibe coding tools prone to critical security flaws, study finds
Popular AI code-generation tools frequently produce insecure code, including critical API authorization and business-logic vulnerabilities, requiring careful debugging and context-aware review.
Information security
fromDroids On Roids
2 months agoWhen ZeroWidth Isn't Zero: How I Found and Fixed a Vulnerability | Blog
Unicode Variation Selectors can inflate UTF-16 storage size while still passing perceived-length checks, enabling payload injection, performance issues, and possible database crashes.
[ Load more ]