When Your AI Agent Bypasses a Government Firewall and Nobody Notices for Three Months
An OpenAI research agent, tasked with analyzing public medicine spending data, bypassed security controls on an Australian government Medicare porta…
Architecture
⚑ Сообщить о проблемеПоследние новости Architecture от Tech News
Все темы
agents
ai
api
architecture
automation
aws
backend
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
news
opensource
performance
productivity
programming
python
react
security
showdev
softwareengineering
systemdesign
tutorial
typescript
webdev
AI Is Finding Vulnerabilities Faster Than Humans Can Patch Them — And That’s Becoming a Security Crisis
For years, cybersecurity had one obvious problem: Finding vulnerabilities was difficult. Researchers had to inspect code, reproduce strange behavior…
Putting a Deterministic Cop Between Your LLM and Its Tools Is Not Optional Anymore
Two points on HN, and the most important architecture diagram you'll see this month A proxy that sits between an LLM and its MCP servers, enforcing…
First Action After Compromise: Blind the Audit
✓ Human-authored analysis; AI used for formatting and proofreading. If you're an attacker who's just landed in an AWS account, the most expensive th…
Junior AppSec Engineer Overwhelmed by Massive Code Reviews: Strategies for Efficiency and Confidence
Introduction: The Systemic Failure in Application Security Onboarding Consider the scenario of a junior Application Security Engineer tasked with se…
The LLM Isn't Your Attacker. Your eval() Statement Is.
Everyone's worried about prompt injection making models say bad things. Meanwhile someone piped LLM output straight into eval() and gave it a GPU bo…
CoSnitch Is a Reminder That Your Chatbot Will Tell on You If You Ask Nicely Enough
An AI assistant got talked into describing its own guts to a stranger. That's not a jailbreak curiosity, that's reconnaissance-as-a-service, and it…
GhostSplice Isn't a Jailbreak, It's a Reminder That LLMs Can't Do Access Control
Split the instruction, split the blame Here's the part that should bother you: nobody had to find a clever new exploit primitive to pull this off. T…
A CVSS 10.0 in Your AI Coding Agent Is Just TOCTOU Wearing a Hoodie
A GitHub issue can now potentially exfiltrate your CI secrets, and the tool that let it happen is the same one your team is using to "move faster."…
No, Claude Didn't 'Go Rogue.' Someone Gave It Root and Wi-Fi.
When an AI agent breaches a real system, the instinct is to ask "what's wrong with the model?" Wrong question. The right question, the one Anthropic…
GitHub finds your vulnerabilities. Something still has to manage them.
Turn on CodeQL, Dependabot, and Secret Scanning across a handful of repositories and you get exactly what the marketing promised: findings. Lots of…
Adversarial Comments Are Now a Vulnerability Detection Bypass Technique
Your LLM-based vulnerability scanner just cleared a PR with a real, exploitable bug in it. Not because the scanner is dumb. Because someone wrote a…
BloodHound for AI Agents Means We've Officially Given Up Pretending This Is Simple
Two points and zero comments on Hacker News is not a signal of importance. It's a signal that most people haven't figured out yet why this matters.…
Confronting Vault Sprawl And The Risks It Brings
Modern enterprises do not set out to create a maze of credentials, keys, and secrets stores. However, this is the reality most organizations find th…
Running Snyk on Real Legacy Java Code — The Full Unfiltered Results
Numbers are easy to skim. 10 Critical. 99 High. 59 Medium. 20 Low. 188 total. Those numbers appeared in the first article and they're striking — but…
Сколько Shadow API спрятано в ваших продуктах и как вывести их из тени
Теневые API редко появляются из злого умысла. Чаще это побочный эффект быстрой разработки: временный маршрут для пилота, отдельная точка доступа для…
Agentic AI Security: Risks, OWASP Agentic Top 10, and Defensive Patterns (2026)
Agentic AI applications — LLM-powered systems that take autonomous action against external tools, services, and APIs based on model reasoning rather…
Your Coding Agent Is a New Attack Surface and Most Devs Aren't Ready for It
When Your AI Assistant Gets Hijacked Mid-Flight If you've handed your coding agent an automated task and walked away, this story should make you a l…
282 AI Apps Are Handing Strangers Your API Bill — And Calling It a Product
The App Store Has an API Key Problem and "Move Fast" Culture Is to Blame Sixty-three percent of iOS AI chatbot apps studied are leaking secrets in n…
Mobile App Authentication: Best Practices for iOS and Android Developers (2026)
The mobile app authentication best practices question is the single hardest one to answer well in mobile application security, because the answers t…
The Tool Found Corridor Nodes — But the Bigger Finding Was Where It Found None
A few weeks ago I published corridor-lab — a Docker lab that proved a triage mismatch: a service that stores nothing sensitive can become high-prior…
The Invisible Breach: Why Modern Web Frameworks Aren't Immune to LFI
Introduction: The Comfortable Lie There's a comfortable story developers tell themselves: "I'm using a modern framework. It handles all that low-lev…
Notification Hijacking: How WhatsApp and Slack Content Could Weaponize Google Gemini
Your phone buzzes. A WhatsApp message lands. Gemini reads it. And now Gemini is compromised. That's the essence of what researchers found in a class…
How Meta's AI Support Bot Got Tricked Into Hijacking Instagram Accounts
The Incident In June 2026, Krebs on Security reported that hackers were circulating step-by-step instructions on Telegram showing how to manipulate…
Platform Lockdowns Will Doom Your Business
The Problem We Were Actually Solving At first glance, it seemed simple: we wanted to add PayPal as a payment option to our e-commerce platform. Our…
The Ghost Platforms That Broke Our Payment Rails and How We Unchained Ourselves
The Problem We Were Actually Solving By Q3 2024, creators in Beirut, Tripoli, and Amman were telling us the same story: PayPal wouldnt verify accoun…
The Egregious Cost of Compliance: One Platform's Overly Broad Restrictions
The Problem We Were Actually Solving We were actually trying to solve the classic problem of onboarding new creators. We believed that by supporting…
The Shai-Hulud Worm Is Now Open Source — Here's How to Stop Self-Replicating Prompts Before They Reach Your LLM
A worm that spreads through prompts just had its source code dropped publicly. That changes the threat model for every team running agentic AI. The…
We scanned 50+ MCP servers and found HIGH-severity bugs in Atlassian, GitHub, Cloudflare, and Microsoft — here's what we learned
MCPSafe (mcpsafe.io) runs automated security scans of Model Context Protocol (MCP) server repositories using a five-model LLM judge panel and a purp…
Why I Built an ML-Powered Secrets Detector Instead of Just Using Regex
ost secrets scanners work the same way. They maintain a list of regex patterns — one for AWS access keys, one for GitHub personal access tokens, one…