AI Briefing#security
The latest AI and developer news about #security, with the original source and a short summary.
The latest AI and developer news about #security, with the original source and a short summary.
Amazon has open-sourced Kiro Crew, an AI agent system that autonomously coordinates multiple development tasks.
A scan of live MCP servers in operation found that about 40% expose tools without any authentication process, revealing a security vulnerability.
Turborepo and Vercel Remote Cache now support OIDC, enhancing the security of CI/CD workflows.
A project-scoped token feature has been added that limits permissions so access is restricted to a specific project's resources when using the Vercel API.
OpenAI has open-sourced the CLI and related tools for Codex Security, a security vulnerability detection tool.
Vercel has launched a WAF beta feature that can protect traffic to Blob stores without any code changes.
OpenAI and Hugging Face are collaborating to resolve a security incident that occurred during the model evaluation process.
A popular Claude SEO tool has been automatically adding promotional footers to monitoring results without user consent.
This covers the operation and improvement process of an NACL automation tool built by Woowa Brothers' security team to efficiently block attacker IPs across dozens of AWS accounts.
GitHub Tools now supports Vercel Connect, enabling more secure GitHub agent implementations based on short-lived tokens.
It provides a disposable Linux VM environment that safely isolates a coding agent's code execution and package installation.
It was confirmed that xAI's Grok Build CLI transmits users' entire source code and .env secrets without authorization.
In 45 days, GitHub sorted out ownership ambiguity across more than 14,000 repositories and assigned a validated owner to every active repository.
Vercel has introduced a masking feature to prevent sensitive environment variable values from being exposed in build logs.
Chat SDK now supports Vercel Connect, enabling secure bot credential management without separate token handling.
Claude Code's Slack integration feature Claude Tag has been introduced, along with updates to agent security and tool control features.
US investigative agencies have begun classifying opposition activities targeting AI and data center infrastructure under a new domestic threat category called 'anti-tech extremism.'
Alibaba has banned the use of Anthropic's programming tool Claude Code citing security risks and instructed employees to use its own tool instead.
Hugging Face announced a major update to the Kernels project for packaging, distributing, and securing custom kernels.
It has been discovered that Claude Code inserts hidden markers into the system prompt based on specific API URLs and time zones.
Vercel has launched Private Blob for general availability, letting users securely store and control access to sensitive files.
Claude Code's system prompt has been updated regarding agent security monitoring and tool-use metadata.
Vercel has strengthened security by issuing OIDC tokens with an Audience customized for specific services.
Fabrica-STAR, an open-source tool that checks security vulnerabilities in Claude Desktop and MCP servers, has been released.