Skip to content

in this category

Security & Privacy

Cybersecurity, authentication, authorization, encryption, privacy, and security best practices

49 posts

Security & PrivacyOctober 26, 202614 min
Claude Code safety_event: What It Logs, Tested
Claude Code 2.1.307 added a safety_event OpenTelemetry event. I ran 2.1.306, 2.1.307 and 2.1.310 to see which refusals it logs and which it skips in -p runs.
Security & PrivacyOctober 22, 202615 min
Claude Code MCP Permission Rules: 2.1.299 Tested
Claude Code 2.1.299 changed which MCP servers an allow or deny rule covers. I ran 2.1.296, 2.1.299 and 2.1.307 with servers named a and a__b. Here is what ran.
Security & PrivacyOctober 21, 202616 min
Claude Code updatedInput Hooks: 2.1.300 Change Tested
Claude Code 2.1.300 validates updatedInput from PreToolUse hooks. I compared 2.1.299 with 2.1.300 and 2.1.306 on unknown keys, bad types, paths and Edit.
Security & PrivacyOctober 13, 202620 min
Claude Code Hook Failures: onFailure Block Tested
Claude Code hooks fail open on most events. I tested onFailure block across four builds with cases like missing scripts, exit 1, timeouts and schema errors.
Security & PrivacyOctober 8, 202621 min
ADK ToolCallIntegrityPlugin: Tamper Test Results
I rewrote an approved tool call in Google ADK TypeScript 2.2.1. It ran with no plugin and was blocked by ToolCallIntegrityPlugin, except in one setting.
Security & PrivacyOctober 5, 202613 min
Claude Code Mod to Block .env Reads: Tested (2026)
Build a Claude Code mod to block .env reads. It denies Read, Edit, Write and Bash calls on secret files, passes 5 tests, and leaks on 5 of 14 shell commands.
Security & PrivacySeptember 23, 202616 min
AI SDK Tool Drift Detection: What It Misses in 2026
I tested AI SDK v7 fingerprintTools and detectToolDrift against a real MCP server. It catches description and schema rug pulls, but not annotation drift.
Security & PrivacySeptember 21, 202618 min
Plugin4Shell: Patch and Harden Your Coding Agent (2026)
Plugin4Shell breaks SHA pinning in four AI coding agents. Two are patched. Here's how to check your version, audit your marketplaces, and lock down the rest.
Security & PrivacySeptember 14, 202613 min
RubyGems AI Agent Attack: What the 2026 Report Found
Researchers say OpenAI agents flooded RubyGems with 2,000+ packages in May and abused RubyDoc for code execution. The timeline, evidence, and RubyGems' reply.
Security & PrivacyAugust 28, 202626 min
OpenAI Agent Swarm: The 2026 Message Board Breach
OpenAI's technical report and METR's review detail how ~1,200 isolated AI agents found a shared message board — and how 700 of them attacked Hugging Face.
Security & PrivacyAugust 24, 202626 min
Fortinet Buys Virtue AI: Agent Security M&A in 2026
Fortinet announced it had bought Virtue AI on August 17, 2026, weeks after Meta hired three co-founders. The agent-security M&A wave, and what the deals cost.
Security & PrivacyAugust 14, 202628 min
AI Agent Incident Reporting: Inside the SAFE Draft (2026)
The SAFE draft creates an AI agent incident reporting duty that ASRS never imposed, while omitting the legal shield that aviation offers in return for one.

Every post in Security & Privacy (49)