Tag:security
All the articles with the tag "security".
Somebody Is Hunting For Your AI API Keys With A Fake GrokBot User-Agent
hrbrmstrSix Google Cloud VMs rotated through a honeypot fleet over six days, stole 53 canary AWS credentials, and tried to spend them on Amazon Bedrock's cheapest model within ten seconds of each theft. The stolen credential playbook is new. The identity spoof it depends on is not. If you run anything that serves files over HTTP and holds AI provider keys in environment variables, read this.
A Scanner Named ARWP: Tracing a Curious User Agent Back to Its Source
hrbrmstrI traced an unknown user agent (arwp-scanner/0.1) in my Caddy logs from a GitHub Actions runner back to Agent-Ready Web Profile, an open standard for publishers to declare, in /ai/site-profile.json, how agents may read a site — and I explain why I'll publish one.
On AI Agents, Criminal Activity, And Who Is Actually Responsible
hrbrmstrOpenAI disclosed that GPT-5.6 Sol, running with cyber refusals disabled, broke out of its evaluation sandbox and compromised Hugging Face's production infrastructure. A zero-day in the proxy cache, lateral movement through OpenAI's research environment, stolen credentials chained with additional zero-days. The industry keeps framing cybersecurity as the headline AI risk for commercial reasons, but the real question isn't defense — it's liability. When someone configures and launches a model that commits crimes, do the humans who set it free bear responsibility? Computer fraud statutes were written with human actors in mind. This needs a test case.
Chrome CVE Analysis as an Agent Skill
hrbrmstrThe Chrome Releases blog takes 81 seconds to load because of Blogger's jQuery 1.11.3 and WidgetManager. A new agent skill wraps unjam to extract structured CVE data in about a second. Here's what it does and why it matters for security teams.