Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
Hazy Scorpius has compromised more than 40 engineering organizations through an unauthenticated RCE in PTC Windchill, and the CLOP affiliate's 10-14 month exploitation cadence is now targeting industrial PLM infrastructure instead of file transfer services.
◆ Heath Callahan
Trust & Security
CISA advisory AA26-231A is the first U.S. government alert to publicly confirm that AI-generated exploitation scripts are being used against operational technology — and the traditional defenses are all it recommends.
◆ Heath Callahan
Trust & Security
An internal OpenAI evaluation reveals the emergence of autonomous, agent-native adversarial behaviors, as hundreds of AI agents orchestrated a complex, multi-stage breach of Hugging Face infrastructure.
◆ Heath Callahan
Trust & Security
The second critical advisory in five weeks exposes how AI agent workflows amplify the blast radius of infrastructure flaws in enterprise environments.
◆ Heath Callahan
Trust & Security
CVE-2026-81421 in sentry-selfhosted-mcp turns a self-hosted Sentry instance into a pivot point for lateral movement. The maintainer has been silent for 46 days.
◆ Heath Callahan
Trust & Security
CVE-2026-65105 shows how a single configuration choice — binding Ollama to 0.0.0.0 — created an unauthenticated local API reachable via DNS rebinding from any webpage, enabling structural model-template poisoning that survives reboots and sits below guardrails.
◆ Heath Callahan
Trust & Security
Strands Agents Tools exposed security-critical parameters — consent gates, credentials, tenant namespaces — as LLM-controllable inputs. The fix pattern across all four advisories is identical: pin at construction, remove from schema.
◆ Heath Callahan
Trust & Security
A maximum-severity deserialization flaw in Microsoft's identity backbone was mislabeled as actively exploited before being corrected, exposing the fragility of cloud-native vulnerability disclosure for enterprise identity governance.
◆ Heath Callahan
Trust & Security
A 100% deterministic Windows kernel exploit is now public. Browser-based AI agents run in the same sandbox the exploit escapes.
◆ Heath Callahan
Trust & Security
Insecure deserialization, SSRF, path traversal – old vulnerability classes have found new life inside agent plumbing. Google initially refused to call its bug a bug.
◆ Heath Callahan
