For the past year, agents at Figma have guarded code as it's written, reviewed every pull request, and audited a decade-old monorepo, all on one policy.

A single crafted email makes Gemini reconstruct fabricated inbox entries as real, then an embedded directive drives an autonomous Calendar event that exfiltrates content from a genuine inbox message into a shared Calendar event visible to colleagues. It arrives looking like indirect prompt injection, but the mechanism underneath both effects is structural desynchronization, and the fabrication half involves no instruction at all.

A coordinated disclosure with MSRC demonstrating a document-borne AI worm in Microsoft Copilot for Word: hidden XPIA prompts in source documents cause Copilot to alter generated content and self-propagate the malicious instructions into downstream documents.

An analysis of the security model of Amazon S3 Vectors and of the considerations that arise when it is used as the retrieval layer for LLM applications: access control scope, input validation, metadata integrity, and audit coverage.

A companion technical writeup to HunggingFace's incident disclosure from last week. This post walks through how the intrusion actually worked: the two initial-access vectors, how the agent pivoted and moved laterally, representative examples of the commands that were run and how they investigated with GLM 5.2.

Permiso researchers deployed an AI agent (Rufio) into the OpenClaw ecosystem and found active malware campaigns in its unvetted skill marketplace (ClawHub), credential-harvesting skills with 377+ downloads, C2 infrastructure, and prompt injection attacks targeting agents holding plaintext credentials to email, Slack, and file systems.

AI agents acting as autonomous multi-system actors require dedicated managed identities, least-privilege task-scoped RBAC, explicit tool allowlists, JIT time-limited entitlements, downstream re-authorization per call, and end-to-end audit logs capturing identity, role, scope, and correlation IDs.

A sigma-based threat hunting and fast forensics timeline generator for cloud logs.

A Terminal UI for Terraform Plans.

A secure, kernel-enforced capability sandbox for AI agents.

A curl-like client for a privacy proxy. You can also check out the companion blog post.