proomt

Search

Search posts, papers, and topics

security

RSS
  1. 61

    GPT-6 Astra Is the First Model OpenAI Classifies as Critical for Cybersecurity

    OpenAI labeled GPT‑6 Astra as “Critical” for cybersecurity under its Preparedness Framework – the first model to meet that bar. In controlled tests the model autonomously discovered zero‑day bugs in a browser and an OS kernel, building working exploit chains in 29 h (browser) and 12 h (kernel). A benchmark of post‑cutoff vulnerabilities confirmed its ability to find unknown flaws. OpenAI reports…

    InfoQinfoq.com3 min
  2. 62

    Running OpenBao on Kubernetes with a CloudNativePG PostgreSQL backend

    Step‑by‑step recipe to run OpenBao (Vault fork) on Kubernetes using CloudNativePG as a password‑less, TLS‑authenticated PostgreSQL storage backend. Shows how to spin up a Kind cluster with the cnpg‑playground, deploy a 3‑node CNPG cluster with synchronous quorum replication, configure DatabaseRole‑based client certificates, set up pg_hba rules, and initialize OpenBao’s schema via a one‑off Job.

    CNCFcncf.io16 minHN2
  3. 63

    Agentic coding in the enterprise: Is your pipeline ready?

    Agentic coding lets AI agents write, test, and submit code autonomously, shifting the bottleneck from writing to governing code in production. Enterprises face rising failures, unclear ownership, growing costs, and weakened controls, which require a unified pipeline visibility layer.

    Codeshipcloudbees.com6 min
  5. 65

    GitHub Actions leaking secrets when Miri output is cached

    Miri writes all environment variables to the target/ directory, and when that directory is cached in GitHub Actions, secrets can be exposed to PRs. A short‑term patch now limits Miri to only preserve CARGO_* vars (excluding tokens) and OUT_DIR; until the fix lands, disable target caching or scope secrets away from Miri steps and clear existing caches.

    Rust Blogrust-lang.org3 min
  6. 66

    Poisoned Documents, Real Risks: Sebastián Passaro Puts AI’s Weakest Link to the Test at Testear.la 2026

    Sebastián Passaro (Qubika) demonstrated a live RAG pipeline attack at Testear.la 2026, showing how a single poisoned document can hijack LLM outputs and trigger unsafe actions. He tied the demo to the OWASP LLM Top 10, highlighted open‑source tooling for finding such weaknesses, and advocated a defense‑in‑depth threat model for QA teams. The talk reframed AI from a testing aid to a security surfa…

    Moove-itqubika.com4 min
  10. 70

    AWS reimagines the getting started experience

    AWS announced a new “project” onboarding flow that lets new users start building with default configurations, free credits, and simplified IAM handling. Sign‑in via Google/GitHub/Apple creates an isolated AWS account, auto‑provisions a CLI/agent toolkit, and lets you invite collaborators by email. Spend limits can be set per project, and advanced features (multi‑region, org policies) can be enabl…

    AWSamazon.com5 minHN33
  11. 71

    Article: Architecting Secure and Scalable Facial Verification Systems

    A real‑world post‑mortem of a high‑volume face verification service that moved from a naïve synchronous API to an async, layered pipeline (edge validation, preprocessing, decoupled detection/verification, decision engine) to achieve 8.5k rpm, p99 < 1.8 s, 30 % cost savings, and strict privacy controls.

    InfoQinfoq.com15 min
  13. 73

    Agent Anomaly Detection, now in Private Preview on the Gemini Enterprise Agent Platform

    Google’s Gemini Enterprise Agent Platform now offers a private‑preview Agent Anomaly Detection service that asynchronously analyzes agents’ OpenTelemetry traces and logs to flag risky behavior (e.g., tool misuse, privilege abuse) without adding latency, surfacing findings in Security Command Center and via an API for automated mitigation.

    Google Developersgoogleblog.com4 min
  14. 74

    AI Security Is an Engineering Problem — How to Solve It at Every Layer of the Agent Stack

    Nvidia frames AI security as an engineering discipline, outlining required controls across the AI agent stack (model, harness, runtime) and advocating for enforceable boundaries, traceable identities, and evidence‑based testing. It highlights OpenShell as a sandboxed runtime, the Open Secure AI Alliance, and several vendor tools for testing and red‑team exercises.

    Nvidianvidia.com4 min
  15. 75
    1 points

    What Stripe data shows about fraud at AI startups

    Stripe’s data shows AI startups face far higher fraud rates than other startups—up to 4.3× more attempted transaction fraud and a 40% rise in multi‑account abuse over six months. The post explains these patterns and how Stripe Radar’s network‑wide signals can block fraud early in the customer lifecycle.

    Stripestripe.com3 minHN2
  16. 76

    How Data 360 Builds Trusted Context: The Enduring Layer for Enterprise AI

    Salesforce’s Data 360 provides a shared runtime that assembles the minimal, authorized slice of enterprise data (“Trusted Context”) for each AI‑agent turn. A six‑stage Agent Context Engine (Resolve, Plan, Reconcile, Govern, Compile, Learn) pulls data from structured, unstructured, and streaming sources across Salesforce, Snowflake, Databricks, etc., applies fine‑grained policy, and returns a toke…

    Salesforce Engineeringsalesforce.com11 min
  17. 77

    Laravel Scalpel Scans for Filesystem Intrusion Evidence

    Laravel Scalpel is a Laravel‑native scanner that looks for post‑deployment filesystem tampering – rogue PHP files, obfuscated backdoors, altered .htaccess/.user.ini, missing or mis‑configured .env, and diffs against a signed baseline. It ships with six built‑in scanners, baseline snapshot commands, fast vs strict hashing modes, CI‑friendly output (JSON, SARIF, GitHub annotations) and a ScanFinish…

    Laravellaravel-news.com5 min
  18. 78

    Cloud CISO Perspectives: How Google monitors AI threats and advances AI defenses

    Google’s Threat Intelligence team outlines three AI‑driven shifts—software build changes, expanded attack surface, and enhanced threat capabilities—then describes their multi‑model, graph‑based defense stack (AI Threat Tracker, in‑editor “spellcheck”, Wiz Security Graph, Gemini‑powered AI Threat Defense) and concrete threat examples like supply‑chain poisoning, LLMJacking, and AI‑orchestrated cre…

    Google Cloud Bloggoogle.com11 min
  21. 81

    Transform and route security logs to Microsoft Sentinel tables using Observability Pipelines

    Datadog Observability Pipelines now ships pre‑built Microsoft Sentinel Packs that map logs from Palo Alto, Fortinet, Cisco ASA, Cisco Meraki, and ExtraHop into Sentinel’s CommonSecurityLog or Syslog tables. Packs handle field extraction, severity derivation, and device‑action mapping, letting you filter or drop low‑value events before ingest, validate mappings with Live Capture, and reduce per‑GB…

    Datadogdatadoghq.com5 min
  22. 82

    One Vault, from Your Phone to the Browser

    CodeName One introduces a new com.codename1.security.vault API to simplify secure, cross-device data encryption and access for mobile and web applications. It manages key derivation, wrapping, and synchronization without exposing the data key to the sync server.

    CodeName Onecodenameone.com5 min
  23. 83

    For SeaVerse, GKE Agent Sandbox reduces infrastructure costs by 60%

    SeaVerse uses GKE Agent Sandbox (Kata Containers + Cloudhypervisor or gVisor) to run isolated AI sandboxes at scale, achieving 300 allocations / s per cluster (90% ≤ 200 ms) and cutting infrastructure spend by up to 60% via flexible VM sizing and per‑sandbox persistent storage, while gaining native Cloud observability.

    Google Cloud Bloggoogle.com5 min
  24. 84

    Cloudflare Introduces the Agent Development Lifecycle to Replace Traditional SDLC

    Cloudflare’s Agent Development Lifecycle (ADLC) replaces the classic SDLC with an autonomous, event‑driven workflow system that lets AI agents handle code generation, testing, deployment, and maintenance. The platform builds on Cloudflare Workflows and the new @cloudflare/ci library to spin up containers, run headless browsers, and chain steps with caching and credential support. Observability is…

    InfoQinfoq.com2 min
  25. 85

    WebAuthn Passkey Recovery: Building Account Fallbacks and Backup Codes in Node.js

    A step‑by‑step tutorial for building a zero‑trust WebAuthn passkey recovery flow in Node.js/TypeScript. It covers generating 128‑bit backup codes, hashing them with Argon2id, rate‑limited verification, time‑boxed JWT recovery sessions, and orchestrating new credential registration with @simplewebauthn/server while revoking lost credentials and rotating codes.

    SitePointsitepoint.com19 min
  27. 87

    Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework

    This podcast discusses the critical challenges of identity, authorization, and security for AI agents. It introduces the DPACT framework (Delegation, Policy, Auditability, Context, Time) as a blueprint for building responsible agentic systems with bounded, delegated authority, moving beyond simple token-based access.

    InfoQinfoq.com29 mintalk
  28. 88

    Kubernetes 1.37 Released: Stable Metrics API and Rootless Kubelet in Beta

    Kubernetes 1.37 (Garhwal) ships GA Metrics API, beta rootless kubelet, GA resilient watchcache, GA pod certificates, and a suite of alpha/beta features (workload‑aware scheduling, pod checkpoint/restore, StatefulSet Recreate strategy). The release focuses on stability, security, and AI/ML cost‑optimisation.

    InfoQinfoq.com2 minrelease
  29. 89

    How to Review AI-Generated Python Code Efficiently

    A practical five‑step workflow for reviewing AI‑generated Python code, covering intent clarification, automated quality checks (linters, type checkers, security scanners, tests), risk‑first manual reading, a checklist of common AI mistakes, and fix‑verify loops, plus a ready‑to‑use dev‑environment setup.

    Real Pythonrealpython.com26 min