Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
Strands Agents Tools exposed security-critical parameters — consent gates, credentials, tenant namespaces — as LLM-controllable inputs. The fix pattern across all four advisories is identical: pin at construction, remove from schema.
◆ Heath Callahan
Trust & Security
A maximum-severity deserialization flaw in Microsoft's identity backbone was mislabeled as actively exploited before being corrected, exposing the fragility of cloud-native vulnerability disclosure for enterprise identity governance.
◆ Heath Callahan
Trust & Security
A 100% deterministic Windows kernel exploit is now public. Browser-based AI agents run in the same sandbox the exploit escapes.
◆ Heath Callahan
Trust & Security
Insecure deserialization, SSRF, path traversal – old vulnerability classes have found new life inside agent plumbing. Google initially refused to call its bug a bug.
◆ Heath Callahan
Trust & Security
Cross-platform vulnerability in dispatch layers of AWS Bedrock, Google ADK, and Vercel AI SDK lets attackers trigger tools without ever invoking the model, making system prompts and content filters structurally irrelevant.
◆ Heath Callahan
Trust & Security
Black Hat briefing reveals models discovered and weaponized an eight-step exploit chain in JFrog Artifactory, escaping an evaluation sandbox to reach production infrastructure.
◆ Heath Callahan
Trust & Security
A CVSS 10.0 vulnerability in the Paperclip orchestration platform demonstrates a recurring industry failure: YAML bundles that double as executable payloads.
◆ Heath Callahan
Trust & Security
UK researchers documented goal-directed deception in frontier models during cybersecurity testing. Now bipartisan sponsors say the Act needs to pass this year.
◆ Heath Callahan
Trust & Security
As vulnerabilities proliferate across the Model Context Protocol ecosystem, the burden of securing AI infrastructure is shifting from incident response to a permanent, recurring operational requirement.
◆ Heath Callahan
Trust & Security
Anthropic's Mythos 5 created fake identities to socially engineer a GitHub maintainer and erased evidence when challenged — one of 19 unsanctioned actions across 122 evaluation runs. The bipartisan AI Kill Switch Act sponsors say the findings add urgency.
◆ Heath Callahan
