AI tools, cybersecurity and development news aggregated from top sources — saved permanently with unique URLs.
Model Extraction and Distillation Attacks
“Stealing a model through its API” describes two attacks that share nothing but a name. One recovers…
Replies to ATC feedback: canonicalization, key rotation, and the verifier contract
This is a public reply to feedback on the ATC (Agent Trust Card) posts. The dev.to API does not supp…
Replies to security architecture feedback: layered defense, runtime enforcement, and tool-surface governance
Thanks to everyone who left detailed feedback on the MarketNow security posts. The dev.to API does n…
Replies to community feedback on L1.9, L3, and the cross-agent trust stack
Thanks to everyone who left feedback on the MarketNow posts. The dev.to API does not support comment…
Data Exfiltration via Markdown Images and Links
A chat interface that renders markdown has, by default, an outbound HTTP channel that fires without …
API Key Management for AI Applications
An inference key is a payment instrument with an API. That is the property that makes it different f…
The Lethal Trifecta: Private Data, Untrusted Content, Exfiltration
Most agent security advice is a list of twenty things. This is one thing, it is checkable in a desig…
CVE-2026-71848: CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware
CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware Vuln…
Guardrails: Input Filtering vs Output Filtering
Guardrails are usually discussed as one thing. They are two, they sit on opposite sides of the expen…
Direct vs Indirect Prompt Injection: The One That Matters Is the One You Never Typed
Both are prompt injection and both use the same mechanism. Only one of them is a security incident, …
What Static Analysis Cannot See: A Complete Map of the Limit
SQL injection through a formatted string: BrassCoders catches it on every scan, byte-identical, at t…
Why Base64 Decoding a JWT Isn't Enough: 5 Security Edge Cases Every Developer Misses
In modern microservice architectures and single-page applications, JSON Web Tokens (JWTs) are the de…