How Block builds AI protectors that shift left, manage context, and continuously evolve to keep systems aligned with their world model.

We're connecting AI tools to everything, and we're making them controllable from anywhere. That combination is a fundamental challenge to how we've been thinking about defense in depth.

Claude Code's deny rules are silently bypassed when a shell command exceeds 50 subcommands, a performance cap in bashPermissions.ts. The secure fix (tree-sitter parser) exists in Anthropic's codebase but was never deployed to production, enabling credential theft via malicious CLAUDE.md files.

Wiz Research traces six waves of pull_request_target exploitation to one actor, starting three weeks before public disclosure. 500+ malicious PRs, 10% success.

Unit 42 red-teamed Amazon Bedrock's multi-agent collaboration framework, demonstrating a four-stage attack chain: operating mode detection, collaborator agent discovery, payload delivery via prompt injection, and exploitation (instruction/tool schema extraction, malicious tool invocation). No Bedrock vulnerabilities were found; enabling Bedrock Guardrails mitigates all demonstrated attacks.

This blog explores how computer use agents can be used to build an agentic command-and-control framework. By combining LLM reasoning with desktop interaction tools, attackers could automate endpoint control while blending into normal system behavior. Here, we break down the architecture, abuse scenarios, and detection opportunities.

NomShub is a critical vulnerability chain in the Cursor AI code editor where a malicious repository can silently hijack a developer's machine, combining indirect prompt injection, a sandbox escape via shell builtins, and Cursor's built-in remote tunnel to give attackers persistent, undetected shell access triggered simply by opening a repo.

When routing VPC peering traffic through an internal NAT gateway in AWS, response traffic bypasses route tables via connection tracking, making all subnets in the peered VPC reachable even without return routes configured. AWS confirmed this is "expected behaviour.".

A look at GitHub Actions' 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain end to end.

A simple static password generator.

Did you contain the compromised identity? notyet.

Open source vulnerability DB and triage service.

A terminal-first approach to CodeQL multi-repo variant analysis.

S3 is now deploying a new default bucket security setting which will automatically disable server-side encryption with customer-provided keys (SSE-C) for all new general purpose buckets.

Amazon S3 Files makes S3 buckets accessible as high-performance file systems on AWS compute resources, eliminating the tradeoff between object storage benefits and interactive file capabilities while enabling seamless data sharing with ~1ms latencies.