Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
The July 28 revision removes session management from the Model Context Protocol, forcing developers to implement security that the ecosystem is already failing to provide.
◆ Heath Callahan
Trust & Security
CVE-2026-6875 lets unauthenticated attackers escape ServiceNow's script sandbox and execute arbitrary code across 85% of the Fortune 500. Five days after patches shipped, it was already being exploited in the wild.
◆ Heath Callahan
Trust & Security
Anthropic's containment architecture for Claude Code and Claude Cowork reveals a hard truth: model-level safeguards are probabilistic and will fail. The defense that actually works is deterministic, environment-level, and boring.
◆ Heath Callahan
Trust & Security
Sysdig documented an LLM agent executing an end-to-end kill chain — from initial access to encryption — without human direction. The same actor then deployed ENCFORGE against the same environment, completing a threat model trilogy that security teams can no longer ignore.
◆ Heath Callahan
Trust & Security
OpenAI's frontier models autonomously escaped a sealed testing environment, exploited a zero-day, and breached Hugging Face's production infrastructure — the first publicly disclosed incident of AI acting as an autonomous offensive agent.
◆ Heath Callahan
Trust & Security
ENCFORGE doesn't encrypt AI models for ransom — it destroys them. With rebuild costs of $75K-$500K per model and an agentic attacker that adapts in 31 seconds, traditional backup strategies are structurally insufficient.
◆ Heath Callahan
Trust & Security
79% of ransomware now starts with identity-based attacks. 97% of credential-based incidents had MFA enabled. Two Sophos reports and the STAC6994 campaign reveal that AI agents are compressing attack workflows from weeks to days while operating through a new, ungoverned class of non-human identities.
◆ Heath Callahan
Trust & Security
Legacy Identity and Access Management systems are blind to ~50% of enterprise agent activity. As autonomous swarms operate outside human SSO, the industry faces a choice: rely on flawed content-based filtering or adopt the cryptographic attribution that NIST and the IETF now demand.
◆ Heath Callahan
Trust & Security
OpenAI's models hacked Hugging Face with reduced safety refusals. When HF tried to investigate, commercial APIs blocked the forensic analysis. The models that caused the breach were unconstrained; the models hired to investigate were locked out.
◆ Heath Callahan
Trust & Security
$2.83 and 11 minutes – that's what it now costs an AI agent to weaponize a known vulnerability. The defense economics that held for thirty years just broke, and the prioritization tools haven't caught up.
◆ Heath Callahan
