Engineering
Copilot prompt injection: the AI revealed its own flaw
Copilot prompt injection vulnerability CoSnitch let attackers steal user data through an undocumented parameter the AI assistant disclosed to researchers.
#security
16 stories tagged security.
Databricks
Databricks RBAC public preview: the exclusive access shift
Databricks RBAC lets users assume a role with only that role's permissions for the session, blocking accidental access to sensitive data through accumulated grants. The feature entered Public Preview on July 22, 2026.
Data
Agentic MCP attacks bypass SOTA guardrails 58% of the time
MCP attack chains bypass SOTA guardrails more than half the time because text classifiers miss composed tool-call exploits. The agentic safety gap is architectural, not a tuning problem.
Engineering
HalluSquatting turns AI coding agents into a botnet
Coding agents hallucinate up to 92 percent of newer repo names, and HalluSquatting lets attackers squat those names to ship reverse shells at scale.
Snowflake
Snowflake workload identity federation kills static credentials
With GA workload identity federation, Snowflake acts as an OIDC provider so workloads use short-lived tokens instead of static credentials, at no extra cost.
Engineering
Post-quantum cryptography deadline gets a 2030 clock
Post-quantum cryptography deadline means high-value federal systems must shift key establishment by 2030 and signatures by 2031.
Research
RIFT-Bench tests agents where prompts cannot reach
Attacks activated in 78.9 to 89.3 percent of tested agent runs on RIFT-Bench, a dynamic agentic red-teaming benchmark.
Databricks
Databricks PAT auto-scoping is a quiet job breaker
Databricks PAT auto-scoping narrows long-lived tokens after 30 days of observed API use. Audit automation now before jobs fail.
Engineering
Vibe coding security needs a real publish gate now
About 5,000 AI-built public assets reportedly exposed sensitive data, making vibe coding security a publish-time problem. Add gates before launch.
Engineering
Miasma worm: live coverage of the Red Hat npm attack
Hijacking Red Hat's GitHub Actions OIDC publishing, the Miasma npm worm shipped 96 backdoored versions whose preinstall hook steals and spreads secrets.
AI
Multi-agent safety gets Google’s $10 million test
Google's $10 million multi-agent safety program starts small against the risk of interacting AI agents amplifying each other's failures.
Engineering
Miasma worm turns AI coding agents into repo traps
The Miasma worm credential stealer hit 73 Microsoft GitHub repos. Treat clones opened by agents as compromised, not merely suspicious.
Data
How long would it take to brute force your password with today's computing power?
A random 12-character password can outlast every computer on Earth, but an 8-character one on a weak hash falls in hours. Here is the brute-force math, mapped.
Snowflake
Snowflake RBAC and masking: lock it down without grinding to a halt
Granting privileges to roles instead of users collapses thousands of Snowflake grants to a few hundred, and one masking policy protects many columns.
Engineering
AI agent security failed in Meta’s support desk test
One support bot turned account recovery into takeover at Instagram, showing AI agent security is really privileged access control.
Engineering
TeamPCP: the crew behind the npm worm hitting Red Hat
The crew behind the Shai-Hulud npm worm, TeamPCP open-sourced it in May 2026, then poisoned Red Hat's packages and blurred who to blame.