Posts tagged “security”

• Google’s Agentic Privacy Report: Map Data Flows Before Granting Access

  Apply Google Research’s contextual-integrity report to agent design: define purpose, fields and recipients before granting calendar access or sending authority.

• llama.cpp b11393 Fixes Tool-Call Parser Use-After-Free

  llama.cpp b11393 clears a stale tool-call pointer. See which parser configurations warrant an upgrade and why the earlier b11390 CUDA fix is separate.

• Pydantic AI 2.54.0: Streaming Concurrency Fix and Upgrade Checklist

  Check which Pydantic AI streaming apps need the concurrency fix, why 2.53.0 is the minimum patched version, and how to validate cleanup before rollout.

• OpenAI’s DNS Sandbox Bypass Exposed a Broken Stop Path

  OpenAI’s DNS sandbox bypass paused frontier tool-use work. What builders should test: indirect network access, alert severity, and verified shutdown.

• Mistral Patched Six Vibe Shell Bypasses. The Approval Prompt Saw the Wrong Action

  Mistral Vibe 2.25.4 fixes six shell-permission CVEs. The deeper lesson is how coding agents must bind approvals to actual runtime effects.

• OpenAI Agents Were Linked to RubyGems. The Confirmed Failure Is Permission Design

  Reports link OpenAI agents to May’s RubyGems abuse. The confirmed lesson is to gate identities, registry writes, and downstream execution.

• Broadcom’s AgentMinder Turns Every AI Agent Tool Call Into a Policy Decision

  Broadcom’s AgentMinder governs AI agent tool calls at runtime, while VMware AI Factory builds the private-cloud stack around it. Here’s what ships now.

• OpenAI's Hugging Face Incident Turned 1,200 Sandboxes Into One System

  OpenAI's Hugging Face report shows how 1,200 nominally isolated agents turned shared caches, credentials, and retries into one attack system.

• Anthropic’s Risk Report: Safeguards Failed Before the Classifier Could Help

  Anthropic’s August 2026 Risk Report shows how disabled classifiers, vendor access, agent permissions, and data lineage became the real safety frontier.

• OpenAI Computer History Turns Desktop Activity Into Agent Memory

  OpenAI Computer History gives ChatGPT and Codex event-based Mac memory. Here is how the data path works, what it risks, and how teams should test it.

• RufRoot Turned One MCP Port Into an Agent Compromise Domain

  CVE-2026-59726 gave unauthenticated attackers RCE, provider keys, conversations, swarms, and durable agent memory writes. Here is the builder response.

• OpenAI’s Codex Security CLI Makes Missing Evidence Fail the Build

  OpenAI's open-source Codex Security CLI turns findings, coverage, scan history, and remediation into a CI contract builders can audit.

← Back to blog