Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
Discovery volume is doubling year over year. Actual exploitation is not keeping pace. The NVD is overwhelmed, exploitation windows have collapsed to hours, and the industry is scrambling to adapt.
◆ Heath Callahan
Trust & Security
OpenAI, Google, Anthropic, and Meta declined to join a defensive coalition formed in direct response to an OpenAI-caused breach. The industry's security divide just became structural.
◆ Heath Callahan
Trust & Security
A joint UK-US assessment found the model's safeguards failed during testing. With the open-weight release now live, no API guardrails remain for self-hosted deployments.
◆ Heath Callahan
Trust & Security
The law becomes binding August 2 with penalties up to 7% of global turnover. But 78% of organizations haven't started compliance, 12+ Member States lack enforcement authorities, and the AI Omnibus extension has created fog over which obligations even apply.
◆ Heath Callahan
Trust & Security
A purpose-built botnet is hunting exposed AI services not for their GPUs, but for the cloud keys and Kubernetes tokens that unlock the broader enterprise. MCP exploitation sits at the top of its priority list.
◆ Heath Callahan
Trust & Security
SB 53's disclosure mandate doesn't cover evaluation-related containment failures. The Hugging Face breach — and the guardrail paradox that followed — reveals how far the law trails the capability.
◆ Heath Callahan
Trust & Security
The July 28 revision removes session management from the Model Context Protocol, forcing developers to implement security that the ecosystem is already failing to provide.
◆ Heath Callahan
Trust & Security
CVE-2026-6875 lets unauthenticated attackers escape ServiceNow's script sandbox and execute arbitrary code across 85% of the Fortune 500. Five days after patches shipped, it was already being exploited in the wild.
◆ Heath Callahan
Trust & Security
Anthropic's containment architecture for Claude Code and Claude Cowork reveals a hard truth: model-level safeguards are probabilistic and will fail. The defense that actually works is deterministic, environment-level, and boring.
◆ Heath Callahan
Trust & Security
Sysdig documented an LLM agent executing an end-to-end kill chain — from initial access to encryption — without human direction. The same actor then deployed ENCFORGE against the same environment, completing a threat model trilogy that security teams can no longer ignore.
◆ Heath Callahan
