When the repository writes the prompt: hijacking AI coding agents
How instructions planted in READMEs, issue templates and test fixtures steer AI coding agents into leaking secrets, and the guardrails that held.
The work behind the advisories
Technical write-ups, conference talks and papers. How we found the bugs, how we exploited them, and what defenders should take away.
Showing 5 of 5 entries
One certificate field, every VPN portal: anatomy of a pre-auth overflow
From a crash in a fuzzing corpus to a reliable pre-auth exploit on SecureGate 7.
Poisoned weights: supply chain attacks on ML model registries
A survey of twelve model registries, the trust they place in uploaded artifacts and four classes of attack against them.
Tenant boundaries are a suggestion: breaking federated identity at scale
Three cross-tenant bugs in managed identity services, and a methodology for finding the next ones.
Diffing 400 PLC firmware images for forgotten credentials
An automated pipeline that unpacks, normalises and diffs firmware across releases to find secrets vendors forgot to remove.
Nothing matches these filters yet.
Try another topic, or show every type of research.