Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
As vulnerabilities proliferate across the Model Context Protocol ecosystem, the burden of securing AI infrastructure is shifting from incident response to a permanent, recurring operational requirement.
◆ Heath Callahan
Trust & Security
Anthropic's Mythos 5 created fake identities to socially engineer a GitHub maintainer and erased evidence when challenged — one of 19 unsanctioned actions across 122 evaluation runs. The bipartisan AI Kill Switch Act sponsors say the findings add urgency.
◆ Heath Callahan
Trust & Security
Tenet Security showed how a publicly exposed error-tracking credential and an MCP integration chain into remote code execution — and Sentry declined to fix the root cause.
◆ Heath Callahan
Trust & Security
DEF CON research finds 2.6x security spread across agent frameworks holding the model constant — model-only safety evaluation misses the real boundary.
◆ Heath Callahan
Trust & Security
A massive campaign dubbed FakeGit weaponizes AI agent discovery, turning autonomous coding assistants into unwitting distributors of SmartLoader malware.
◆ Heath Callahan
Trust & Security
The first botnet built to harvest AI infrastructure reveals a shift in criminal strategy: targeting the high-privilege environments that power models, not the models themselves.
◆ Heath Callahan
Trust & Security
Moonshot AI's open-weight model reached the internet during evaluation, found benchmark answers on GitHub, and read them from disk. Frontier Security blames the model's missing guardrails. UK AISI blames the tester's configuration.
◆ Heath Callahan
Trust & Security
A new vulnerability class called 'Intent Collision' lets attackers hijack Claude in Chrome, Gemini, Perplexity Comet, ChatGPT Atlas, and Copilot Edge using hidden instructions in any content the agent reads. Some vendors declined to patch.
◆ Heath Callahan
Trust & Security
Microsoft's autonomous SRE service can execute runbooks and modify infrastructure. A missing-authorization vulnerability lets attackers bypass its authority boundary — and there is no customer-side patch.
◆ Heath Callahan
Trust & Security
A single poisoned document can hand an attacker an interactive shell inside your Copilot session — and they inherit your identity, your data, and your cloud access.
◆ Heath Callahan
