Security Insights
Deep dives, expert analysis, and practical guidance on exposure management, adversarial validation, and the future of AI-driven exposure management.
Where your data goes during an AI pentest
Session tokens, customer records, error traces. Here's exactly where that data goes during an agentic pentest, and what to ask any vendor.
5 Vulnerabilities in Every Vibe-Coded App
The 5 security flaws AI coding assistants ship by default: missing authz, leaked secrets, weak JWTs, IDOR, eval RCE — with detection queries and fixes for each.
Why AI-Generated Exploit Code Must Run in Isolation
Agent-written exploit code is the new RCE vector aimed at the tester. Here's why per-task isolation and egress control are non-negotiable.
A Poisoned PyPI Package Quietly Hit 36 Percent of Cloud Environments Through LiteLLM
LiteLLM 1.82.7 and 1.82.8 silently swept AWS credentials, Kubernetes configs, and SSH keys from 3.4 million daily installs. Here is exactly what the payload did and how Strobes AI detects and shuts it down.
MCP (Model Context Protocol) and Its Critical Vulnerabilities
Model Context Protocol connects AI assistants to external tools and data. Think of it as a bridge between Claude, ChatGPT, or Cursor and your Gmail, databases, or file systems. Released by Anthropic in November 2024, it's gaining traction fast. But it has serious security problems. What Model Contex