#PATH hijacking attack
38 related articles
·3 min
Git Worktree Is Not an Isolation Boundary for AI Coding Agents: Real Sandboxing Solutions Explained
Analysis of why Git worktree fails as a security boundary for AI coding agents like Claude Code and Cursor, and why containers and VMs are the real solution.
Read more →
·3 min
Bo AI: Putting an AI Personal Assistant in Your Text Messages, Serving Everyday People with Zero Barriers
Bo AI is an AI personal assistant delivered through SMS, requiring no app download to manage schedules, save time, and get health advice. A deep analysis of its positioning and the SMS-first approach.
Read more →
·3 min
Bo AI: Putting an AI Personal Assistant in Your Text Messages, Serving Everyday People with Zero Barriers
Bo AI is an AI personal assistant that works through text messages—no app needed. It manages schedules, saves time, and answers questions. A deep analysis of its positioning, SMS-based approach, and the last-mile challenge of AI consumerization.
Read more →
·3 min
Fast Remediation Replaces Zero Vulnerabilities: A New Trust Model for Software Security in the AI Era
In the AI era, zero vulnerabilities is unrealistic. Explore why fast remediation is becoming the new security trust model and how MTTR metrics are reshaping software supply chain security.
Read more →
·2 min
Cursor 0-Day Vulnerability: Opening a Repository Silently Executes Malicious Code — Developers Beware
A critical 0-day in Cursor AI editor lets attackers execute code just by having you open a malicious Git repo. Learn how it works and how to protect yourself.
Read more →
Claude Hit by Prompt Injection Attacks…
·2 min
Claude Hit by Prompt Injection Attacks: AI Security Blind Spots and a Defense Guide
A viral Hacker News post reveals how prompt injection attacks can trick AI assistants like Claude into leaking user data. Learn how indirect injection works and how to defend against it.
Read more →
·3 min
AI Coding Agents Explosion: CodeWell Goes Open Source, Kimi K3 Launches, Claude Gets Browser Access
CodeWell open-sources a multi-model terminal coding agent, Kimi K3 launches with ultra-long context, MiniMax Code 2.0 rebuilds its Agent architecture, and Claude gets browser access. AI is accelerating from content generation to task execution.
Read more →
·3 min
jscrambler npm Package Compromised: Supply Chain Attack Incident Response and Protection Guide
The jscrambler npm package v8.14.0 was hit by a supply chain attack, with malicious code able to steal environment variables, CI secrets, and deployment credentials. This guide covers self-inspection, credential rotation, and dependency hardening.
Read more →
·4 min
Surge in Claude Mythos Preview Vulnerabilities: How Can We Ensure LLM Security?
After the release of Claude Mythos Preview, critical security vulnerabilities surged, raising widespread concern. This article analyzes the tension between rapid iteration and security, explores LLM attack surface challenges, and offers practical defense strategies.
Read more →
·2 min
GhostLock: A Deep Dive into the 15-Year-Old Linux Stack UAF Vulnerability
GhostLock is a stack use-after-free (stack-UAF) vulnerability affecting all major Linux distributions, lurking for 15 years. A deep dive into its mechanics, severity, scope, and practical mitigation.
Read more →
·7 min
OpenClaw vs Hermes: An In-Depth Comparison and Selection Guide for AI Agent Tools
An in-depth comparison of OpenClaw and Hermes Agent, covering skill management, memory mechanisms, security, and gateway configuration to help you find the right AI agent solution.
Read more →
·6 min
GPT-5.6 Sol Limited Preview: The Safety Boundaries Behind AI's Capability Expansion
OpenAI's flagship GPT-5.6 advances on three fronts—Sol, Kara, Luna tiered rollout; ByteDance CGN 5.0 Pro and Meta Muse push image generation toward controllable workflows; AI coding agents expose new supply chain risks.
Read more →
·3 min
Espionage Infiltration of the European Parliament: A Deep Warning for Government Cybersecurity
The European Parliament faces state-sponsored espionage via spear-phishing, supply chain attacks, and long-term persistence. This analysis explores why legislatures are prime targets and key defenses like Zero Trust and EDR.
Read more →
·7 min
Google's $250K Bounty: Linux VM Escape Vulnerability Sets a Historic Record
Google paid a security researcher $250K for a Linux kernel VM escape vulnerability, setting a VRP record. An in-depth analysis of VM escape principles, kCTF incentives, and cloud security impact.
Read more →
·5 min
Scalping Bots, Tampered Exam Applications, Hacked Robots: The Legal Boundaries of Computer Crime in the AI Era
Scalper ticket bots, tampered exam applications, hacked robot vacuums—do these acts violate criminal law? Drawing on Luo Xiang's legal analysis, this article explores the crime of destroying computer information systems.
Read more →
LLM Security Benchmarking: Current Sta…
·4 min
LLM Security Benchmarking: Current State, Challenges, and Practical Guide
Why is it so hard to establish unified LLM security benchmarks? This article analyzes core challenges in LLM security evaluation—covering jailbreaks, prompt injection, red teaming, and more—with practical strategies for developers.
Read more →
·7 min
LLM Evaluation: The Testing Industry's Scarcest Career Pivot and the Timing to Enter
LLM evaluation roles are growing over 100% year-over-year, with top companies offering 50K/month yet unable to fill positions. This article explores how testing pros can seize the window.
Read more →
·6 min
Unsloth Major Update: DeepSeek-V4 Support and a Deep Dive into NVFP4 Quantized Export
Unsloth v0.1.481-beta adds full DeepSeek-V4-Flash support, NVFP4/FP8/imatrix GGUF quantized export, 1.3x faster GRPO, 3-5x faster MoE training, and an OpenAI-compatible API service in Studio.
Read more →
·6 min
Decoding the Obfuscated Bash Script on a Uniqlo T-Shirt: Tech Easter Eggs and Security Lessons
A tech enthusiast decoded an obfuscated Bash script on a Uniqlo T-shirt. This article breaks down the reverse-analysis approach, obfuscation tricks, and safe-execution principles.
Read more →
·5 min
6 Self-Hosted AI Agents Compared: Which One Is a Truly Self-Evolving Digital Employee?
An open-source AI Agent with 380K stars ranks only third? This comparison of 6 self-hosted AI Agents scores them on persistence, self-evolution, and data control—revealing why Generic Agent won with just 3,000 lines of code.
Read more →