A vulnerability, called "line jumping", in the way MCP is implemented that undermines its core security promises. It allows malicious MCP servers to execute attacks before any tool is even invoked.   #ai   #attack

A more effective way to exploit line jumping: injecting trigger phrases into tool descriptions to exfiltrate the user's entire conversation history.   #ai   #attack

A post exploring the evolving Model Context Protocol (MCP), its security risks, and how to prepare for safe adoption as LLMs connect to external systems.   #ai   #attack   #defend

A blog post covering tips and tricks that have proven effective for using Claude Code across various codebases, languages, and environments.   #ai   #explain

LLMs sometimes act maliciously, so you must treat LLM output like user input.   #ai   #strategy

With the US Government acting in an erratic and hostile manner towards its traditional allies, it makes sense for companies not typically subject to US Jurisdiction to reconsider their threat models when using the big three cloud providers. All of them are US-based companies, and all three conduct a substantial amount of business with the US Government.   #aws   #azure   #gcp   #strategy

Post diving into cross-account trust policies, explaining four major misconceptions repeatedly seen in organizations, which often lead to the creation of cross-account trust paths from less secure accounts to more sensitive accounts.   #aws   #design

The Datadog threat research and detection engineering efforts throughout Q1 revealed several significant patterns in the cloud threat landscape, with some notable shifts from previous quarters.   #attack   #defend   #monitor   #strategy

A deliberately vulnerable implementation of the Model Context Protocol (MCP) for educational purposes.

The Auth0 MCP Server integrates with LLMs and AI agents, allowing you to perform various Auth0 management operations using natural language.

Open-source AI Agent workflow builder.

Pacu's newest scenario, enumerating Elastic Beanstalk for Secrets, was built to save users hours of testing during an AWS penetration test.

Provides an emulation layer for Cloud Provider IMDS APIs.

The examples include two comprehensive capabilities focusing on secure model inference and RAG implementations, covering a wide range of security best practices using AWS generative AI services.

How to help prevent hotlinking by using header inspection in AWS WAF, while still taking advantage of the improved user experience from a CDN such as CloudFront.

A new SDK plugin that simplifies AWS resource authorization for applications that authenticate with external identity providers (IdPs) such as Microsoft EntraID, Okta, and others.

Learn how MCP Toolbox for Databases can help you deliver secure and standardized ways to have your agents communicate with one another and access enterprise data.

SaaS Runtime is a fully managed service management platform for SaaS providers to simplify and automate the complexities of infrastructure operations.

Microsoft released and updated the threat matrix for Kubernetes, an active knowledge base for security threats that target Kubernetes clusters, to systematically map the attack surface of Kubernetes.