Trusted coding-agent projects can execute repository-controlled code before the first user prompt via MCP server configs or PATH hijacking in .claude/settings.json. Developers should treat project trust like running an arbitrary setup script.
https://securitylabs.datadoghq.com/articles/coding-agent-project-trust-code-execution-before-first-prompt
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
Wiz Research found CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API enabling sandbox escape via .NET reflection. Attackers could obtain a platform-wide Cosmos Master Key granting full read/write access to any customer database and enumeration of all accounts.
https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db
#azure
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
Google Cloud CISO Chris Betz argues that AI-native threat defense is now a board-level requirement. Boards should govern five areas: business enablement, remediation cycle speed, platform consolidation, contextual vulnerability prioritization, and AI safety policy to enable secure, AI-driven business agility.
https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-why-ai-threat-defense-is-the-new-boardroom-baseline
#gcp
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
🔶 HIPAA Security Rule on AWS
AWS released a whitepaper guiding covered entities and business associates on implementing HIPAA Security Rule Technical Safeguards on AWS, covering access control, audit, MFA, encryption, and 2025 NPRM proposed changes, with shared responsibility mapping and ePHI architecture guidance.
https://aws.amazon.com/ru/blogs/security/hipaa-security-rule-on-aws-technical-safeguards-implementation-and-readiness-guidance
#aws
AWS released a whitepaper guiding covered entities and business associates on implementing HIPAA Security Rule Technical Safeguards on AWS, covering access control, audit, MFA, encryption, and 2025 NPRM proposed changes, with shared responsibility mapping and ePHI architecture guidance.
https://aws.amazon.com/ru/blogs/security/hipaa-security-rule-on-aws-technical-safeguards-implementation-and-readiness-guidance
#aws
❤2👍1🔥1
Cloudflare built a CI-native AI code review system using OpenCode, orchestrating up to 7 specialised agents (security, performance, code quality, etc.) per merge request.
https://blog.cloudflare.com/ai-code-review
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
🔶 How AWS IAM role manager rethinks the starting point for IAM roles
AWS IAM role manager automates IAM role creation within supported service consoles, eliminating manual role setup. Using managed role templates and a new AcquireRole API, it provisions and attaches least-privilege roles automatically. Roles remain fully customer-controlled and refinable via IAM Access Analyzer.
https://aws.amazon.com/ru/blogs/security/how-aws-iam-role-manager-rethinks-the-starting-point-for-iam-roles
#aws
AWS IAM role manager automates IAM role creation within supported service consoles, eliminating manual role setup. Using managed role templates and a new AcquireRole API, it provisions and attaches least-privilege roles automatically. Roles remain fully customer-controlled and refinable via IAM Access Analyzer.
https://aws.amazon.com/ru/blogs/security/how-aws-iam-role-manager-rethinks-the-starting-point-for-iam-roles
#aws
❤1👍1🔥1
🔶 A few notes on AWS Nitro Enclaves: KMS integration
This third installment in Trail of Bits' Nitro Enclaves series catalogs passive and active attack classes against enclave-KMS communication, covering CMK substitution, data key swapping, replay attacks, policy misconfigurations, key commitment gaps, and operational risks.
https://blog.trailofbits.com/2026/08/05/a-few-notes-on-aws-nitro-enclaves-kms-integration
#aws
This third installment in Trail of Bits' Nitro Enclaves series catalogs passive and active attack classes against enclave-KMS communication, covering CMK substitution, data key swapping, replay attacks, policy misconfigurations, key commitment gaps, and operational risks.
https://blog.trailofbits.com/2026/08/05/a-few-notes-on-aws-nitro-enclaves-kms-integration
#aws
❤1👍1🔥1
How to build a production-grade agentic harness using typed Pydantic tools, a DAG planner with parallel asyncio execution, tiered memory, Planner/Worker/Critic role separation, multi-dimensional budgeting with graceful degradation, and structured tracing for observability.
https://data4sci.com/blog/building-an-advanced-agentic-harness
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
⚠️ Going depthfirst: Achieving GitLab RCE via Two Ruby Memory. Corruption Vulnerabilities
Researchers chained two memory-safety flaws in Oj, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities
#RCE
Researchers chained two memory-safety flaws in Oj, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities
#RCE
❤1👍1🔥1
🔶 Threat hunt AI: How we built an AI security analyst on AWS for under $500/month
Grow Therapy built a Claude-powered threat hunting system on ECS Fargate and Lambda, querying Snowflake and Datadog logs across 15 sources. A five-phase AI pipeline (data gathering, baseline comparison, enrichment, confidence scoring, adversarial validation) reduces false positives. Total cost: under $500/month.
https://engineering.growtherapy.com/post/threat-hunt-ai-how-we-built-an-ai-security-analyst-on-aws-for-under-500-month
#aws
Grow Therapy built a Claude-powered threat hunting system on ECS Fargate and Lambda, querying Snowflake and Datadog logs across 15 sources. A five-phase AI pipeline (data gathering, baseline comparison, enrichment, confidence scoring, adversarial validation) reduces false positives. Total cost: under $500/month.
https://engineering.growtherapy.com/post/threat-hunt-ai-how-we-built-an-ai-security-analyst-on-aws-for-under-500-month
#aws
❤2👍1🔥1
Datadog tested Claude Sonnet 5, Composer 2.5, and GPT 5.5 in plan vs. default mode for secure code generation. No meaningful correlation between plan mode and improved security was found; explicit prompt-level security constraints had greater impact than mode selection.
https://securitylabs.datadoghq.com/articles/putting-models-to-the-secure-coding-test-plan-vs-default-mode
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
👍3❤1🔥1
CloudSEK's research on the LiteLLM supply chain attack, the largest AI supply chain breach of 2026, names the organizations potentially exposed: 2,500+ companies and 434,000 CI/CD pipelines worldwide.
https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
🔶 Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway
AgentCore Gateway supports OAuth 2.0, IAM, and API keys natively, but a request Lambda interceptor enables legacy Basic Auth integration. The interceptor validates the inbound JWT, retrieves system credentials from Secrets Manager, and constructs the Basic Auth header before forwarding to the downstream tool.
https://aws.amazon.com/ru/blogs/security/implement-custom-authentication-for-tools-integration-using-request-lambda-interceptor-in-agentcore-gateway
#aws
AgentCore Gateway supports OAuth 2.0, IAM, and API keys natively, but a request Lambda interceptor enables legacy Basic Auth integration. The interceptor validates the inbound JWT, retrieves system credentials from Secrets Manager, and constructs the Basic Auth header before forwarding to the downstream tool.
https://aws.amazon.com/ru/blogs/security/implement-custom-authentication-for-tools-integration-using-request-lambda-interceptor-in-agentcore-gateway
#aws
❤1👍1🔥1
This blog describes the methodology that powers a Mandiant internal tool for point-in-time AI vulnerability discovery. It has discovered hundreds of vulnerabilities in customer codebases and resulted in dozens of vendor notifications with either assigned or pending CVE numbers.
https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review
#gcp
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
Anthropic's stage-by-stage playbook for the AI-native SDLC: how teams plan, design, build, test, deploy, and maintain software with Claude.
https://claude.com/blog/the-ai-native-sdlc-playbook
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
Practical LLM evaluation lessons from GitHub secret scanning: define product goals and guardrails first, treat offline evaluation as repeatable integration testing, keep eval data close to production, audit labels, use error analysis, and apply LLM-as-judge for human review triage.
https://github.blog/ai-and-ml/llms/how-to-evaluate-llms-before-production
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2👍1🔥1
🔶 Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation
A guide to detecting multi-stage AWS attacks by correlating signals across CloudTrail, VPC Flow Logs, and Route 53 DNS logs. Covers four business-context-aware patterns: unexpected S3 access, abnormal role chains, KMS key misuse, and off-hours privileged changes, with CloudWatch Logs Insights queries and Lambda automation.
https://aws.amazon.com/ru/blogs/security/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation
#aws
A guide to detecting multi-stage AWS attacks by correlating signals across CloudTrail, VPC Flow Logs, and Route 53 DNS logs. Covers four business-context-aware patterns: unexpected S3 access, abnormal role chains, KMS key misuse, and off-hours privileged changes, with CloudWatch Logs Insights queries and Lambda automation.
https://aws.amazon.com/ru/blogs/security/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation
#aws
❤1👍1🔥1
🔶 From clickops to governed IaC: CloudFormation drift detection in practice
A guide for migrating ClickOps-managed AWS infrastructure to governed CloudFormation IaC using IaC Generator for template generation, stack organization by lifecycle/ownership, and automated drift detection via EventBridge for continuous compliance monitoring.
https://aws.amazon.com/ru/blogs/devops/from-clickops-to-governed-iac-cloudformation-drift-detection-in-practice
#aws
A guide for migrating ClickOps-managed AWS infrastructure to governed CloudFormation IaC using IaC Generator for template generation, stack organization by lifecycle/ownership, and automated drift detection via EventBridge for continuous compliance monitoring.
https://aws.amazon.com/ru/blogs/devops/from-clickops-to-governed-iac-cloudformation-drift-detection-in-practice
#aws
❤1👍1🔥1