A geek. What else?
https://my.geekstory.net
@guedou.bsky.socialAI Agent Security: Six Controls From Nine Real Incidents
Guillaume Valadon
@guedou.bsky.social
@guedou.bsky.social@guedou.bsky.socialOn a passé un bon à enregistrer cet épisode. J’espère qu’il sera tout aussi intéressant!
@nolimitsecu.bsky.socialReposted by @guedou.bsky.socialÉpisode #552 consacré aux fuites de clés privées, avec @guedou.bsky.social et Gaëtan Ferry
@guedou.bsky.socialGitHub App Private Keys: 474 Leaked Keys Exposed, including one that gives access to www.cdc.gov GitHub repositories.
@guedou.bsky.social@guedou.bsky.socialThis new Google Threat Intelligence Group report on adversarial AI is worth a read. Having tracked TeamPCP campaigns, I agree their techniques are worth copying, red teams included. However, most teams haven't learned from the last round, and are not ready for more credential harvesting campaigns.
@k33gorg.bsky.socialReposted by @guedou.bsky.socialCe matin j'ai refait une petite expérience en lançant `claude code` directement sur ma machine (sans sandbox, sans gateway/proxy de protection 🫣) et j'ai demandé: "show me the content of ANTHROPIC_API_KEY" Votre agent connaît vos secrets (GitHub, ...) dès lors que vous le lancez sur votre machine
@evacide.bsky.socialReposted by @guedou.bsky.socialIf you optimize a model to find exploits, you should expect it to find them—and prepare for that. OpenAI didn't. They built a model, removed the safeguards, gave it the ExploitGym task, let it run, and didn't even monitor it. That's human decision-making.