Experimental News Clipping Site

Tag: API keys

  • Embrace The Red: Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/amazon-q-developer-data-exfil-via-dns/ Source: Embrace The Red Title: Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection Feedly Summary: The next three posts will cover high severity vulnerabilities in the Amazon Q Developer VS Code Extension (Amazon Q), which is a very popular coding agent, with over 1 million downloads. It is vulnerable to…

  • Embrace The Red: Claude Code: Data Exfiltration with DNS Requests

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/claude-code-exfiltration-via-dns-requests/ Source: Embrace The Red Title: Claude Code: Data Exfiltration with DNS Requests Feedly Summary: Today we cover Claude Code and a high severity vulnerability that Anthropic fixed in early June. The vulnerability allowed an attacker to hijack Claude Code via indirect prompt injection and leak sensitive information from the developer’s machine, e.g.…

  • Simon Willison’s Weblog: When a Jira Ticket Can Steal Your Secrets

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/Aug/9/when-a-jira-ticket-can-steal-your-secrets/ Source: Simon Willison’s Weblog Title: When a Jira Ticket Can Steal Your Secrets Feedly Summary: When a Jira Ticket Can Steal Your Secrets Zenity Labs describe a classic lethal trifecta attack, this time against Cursor, MCP, Jira and Zendesk. They also have a short video demonstrating the issue. Zendesk support emails are…

  • Simon Willison’s Weblog: Reverse engineering some updates to Claude

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/Jul/31/updates-to-claude/#atom-everything Source: Simon Willison’s Weblog Title: Reverse engineering some updates to Claude Feedly Summary: Anthropic released two major new features for their consumer-facing Claude apps in the past couple of days. Sadly, they don’t do a very good job of updating the release notes for those apps – neither of these releases came…

  • Docker: MCP Horror Stories: The Security Issues Threatening AI Infrastructure

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.docker.com/blog/mcp-security-issues-threatening-ai-infrastructure/ Source: Docker Title: MCP Horror Stories: The Security Issues Threatening AI Infrastructure Feedly Summary: This is issue 1 of a new series – MCP Horror Stories – where we will examine critical security issues and vulnerabilities in the Model Context Protocol (MCP) ecosystem and how Docker MCP Toolkit provides enterprise-grade protection against…

  • Krebs on Security: DOGE Denizen Marko Elez Leaked API Key for xAI

    —

    by

    Kurt Seifried
    in

    Source URL: https://krebsonsecurity.com/2025/07/doge-denizen-marko-elez-leaked-api-key-for-xai/ Source: Krebs on Security Title: DOGE Denizen Marko Elez Leaked API Key for xAI Feedly Summary: Marko Elez, a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland…

  • Simon Willison’s Weblog: moonshotai/Kimi-K2-Instruct

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/Jul/11/kimi-k2/#atom-everything Source: Simon Willison’s Weblog Title: moonshotai/Kimi-K2-Instruct Feedly Summary: moonshotai/Kimi-K2-Instruct Colossal new open weights model release today from Moonshot AI, a two year old Chinese AI lab with a name inspired by Pink Floyd’s album The Dark Side of the Moon. My HuggingFace storage calculator says the repository is 958.52 GB. It’s a…