Experimental News Clipping Site

Tag: external server

  • Embrace The Red: Cline: Vulnerable To Data Exfiltration And How To Protect Your Data

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/cline-vulnerable-to-data-exfiltration/ Source: Embrace The Red Title: Cline: Vulnerable To Data Exfiltration And How To Protect Your Data Feedly Summary: Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub. Unfortunately, Cline is vulnerable to data exfiltration through the rendering…

  • Embrace The Red: Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/amazon-q-developer-data-exfil-via-dns/ Source: Embrace The Red Title: Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection Feedly Summary: The next three posts will cover high severity vulnerabilities in the Amazon Q Developer VS Code Extension (Amazon Q), which is a very popular coding agent, with over 1 million downloads. It is vulnerable to…

  • Slashdot: Google Releases Pint-Size Gemma Open AI Model

    —

    by

    Kurt Seifried
    in

    Source URL: https://tech.slashdot.org/story/25/08/14/2150230/google-releases-pint-size-gemma-open-ai-model?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Google Releases Pint-Size Gemma Open AI Model Feedly Summary: AI Summary and Description: Yes Summary: Google has introduced the Gemma 3 270M, a compact AI model optimized for local deployment, which offers significant advantages in terms of privacy and efficiency. While it may not match the performance of larger…

  • Embrace The Red: Claude Code: Data Exfiltration with DNS Requests

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/claude-code-exfiltration-via-dns-requests/ Source: Embrace The Red Title: Claude Code: Data Exfiltration with DNS Requests Feedly Summary: Today we cover Claude Code and a high severity vulnerability that Anthropic fixed in early June. The vulnerability allowed an attacker to hijack Claude Code via indirect prompt injection and leak sensitive information from the developer’s machine, e.g.…

  • Embrace The Red: How Devin AI Can Leak Your Secrets Via Multiple Means

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/devin-can-leak-your-secrets/ Source: Embrace The Red Title: How Devin AI Can Leak Your Secrets Via Multiple Means Feedly Summary: In this post we show how an attacker can make Devin send sensitive information to third-party servers, via multiple means. This post assumes that you read the first post about Devin as well. But here…

  • Slashdot: Apple Lets Developers Tap Into Its Offline AI Models

    —

    by

    Kurt Seifried
    in

    Source URL: https://apple.slashdot.org/story/25/06/09/1859253/apple-lets-developers-tap-into-its-offline-ai-models?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Apple Lets Developers Tap Into Its Offline AI Models Feedly Summary: AI Summary and Description: Yes Summary: Apple is set to introduce the Foundation Models framework, enabling developers to leverage its AI models on devices while ensuring user privacy and reducing cloud dependency. This innovation allows for personalized experiences…

  • Simon Willison’s Weblog: Remote Prompt Injection in GitLab Duo Leads to Source Code Theft

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/May/23/remote-prompt-injection-in-gitlab-duo/ Source: Simon Willison’s Weblog Title: Remote Prompt Injection in GitLab Duo Leads to Source Code Theft Feedly Summary: Remote Prompt Injection in GitLab Duo Leads to Source Code Theft Yet another example of the classic Markdown image exfiltration attack, this time affecting GitLab Duo – GitLab’s chatbot. Omer Mayraz reports on how…

  • Cisco Talos Blog: UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware

    —

    by

    Kurt Seifried
    in

    Source URL: https://blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/ Source: Cisco Talos Blog Title: UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware Feedly Summary: Talos has observed exploitation of CVE-2025-0994 in the wild by UAT-6382, a Chinese-speaking threat actor, who then deployed malware payloads via TetraLoader. AI Summary and Description: Yes **Summary:** The text describes the exploitation of a significant remote-code-execution…

  • Cloud Blog: A guide to Google ADK and MCP integration with an external server

    —

    by

    Kurt Seifried
    in

    Source URL: https://cloud.google.com/blog/topics/developers-practitioners/use-google-adk-and-mcp-with-an-external-server/ Source: Cloud Blog Title: A guide to Google ADK and MCP integration with an external server Feedly Summary: For AI-powered agents to perform useful, real-world tasks, they need to reliably access tools and up-to-the-minute information that lives outside the base model. Anthropic’s Model Context Protocol (MCP) is designed to address this, providing…