Author
Jason Miller
11 min read
GitSpawn: The Git Performance Flag That Turns Coding Agents Into Command Runners
GitSpawn abuses the core.fsmonitor Git setting to run attacker commands when AI coding agents call git status. See affected tools, patch status, and defenses.…
11 min read
One Laptop, 469 Credential Hiding Spots: What the New Shai-Hulud Worm Is Really After
Shai-Hulud now scans 469 credential paths on developer machines. Learn where tokens hide, from npm configs to AI agent settings, and audit your own laptop.…
14 min read
An Agent Swarm That Takes Over the Internet Needs Four Capabilities. July's Sandbox Escape Proved One.
Dario Amodei warns an AI agent swarm could seize the internet within a year. Here is the four-capability scorecard, and what July's sandbox escape proved.…
11 min read
Patching Elementor Pro Doesn't Remove the Webshell. Here's How to Check
Patching Elementor Pro for CVE-2026-32475 does not remove webshells already dropped. Learn the log, filesystem, and WP-CLI checks that confirm compromise.…
10 min read
A Forgotten DNS Record Just Handed a Stranger Hundreds of Thousands of Military Base Call Logs
An orphaned DNS record gave a stranger hundreds of thousands of US military base call logs. Learn how telephony DNS fails silently and how to audit yours.…
7 min read
GPT-6 Astra Fell in Under 24 Hours to a Prompt With Nothing Malicious in It
GPT-6 Astra was reportedly jailbroken in under 24 hours using Task-in-Prompt attacks with no malicious instruction. Learn why static evals miss this class and.…
12 min read
Your Detections Assume a Single Attacker. The Hugging Face Swarm Had 700
Readers learn which single-attacker detection assumptions fail against coordinated AI agent swarms and get concrete, no-budget controls and queries to counter them.…
11 min read
AI Slop Cut Bug Bounty Payouts in Half. The Talent Pipeline Gets the Bill
GitHub halved bug bounty payouts after AI-generated reports flooded triage queues. Learn why four major programs restructured and how to adapt your intake.…
12 min read
Your Coding Agent Installed 23 Packages in a Minute. Your SBOM Saw Zero.
AI coding agents install unvetted packages before scanners see them. Learn how registry proxies, egress rules, and policy as code close the SBOM blind spot.…
13 min read
Check the Socket, Not the Installer: An Audit and Lockdown Playbook for the NemoClaw Ollama Flaw
Audit and lock down the NemoClaw Ollama flaw: verify the true socket binding, spot poisoned chat templates, re-pull models, and secure unpatched Windows hosts.…
11 min read
An AI Found a 20-Year-Old RCE in One Evening, and the Game Is the Least Interesting Part
An AI agent found a 20-year-old RCE in Call of Duty 1's Linux server in one evening. Learn why that price collapse matters and how to audit your own binaries.…
12 min read
Your SOC 2 Pentest Proves a Week. The Report Implies a Year.
SOC 2 does not require a pentest, but every auditor expects one. Learn what the report actually proves and how to close the assurance gap between tests.…