Tag: vectors
-
Simon Willison’s Weblog: The Hidden Risk in Notion 3.0 AI Agents: Web Search Tool Abuse for Data Exfiltration
Source URL: https://simonwillison.net/2025/Sep/19/notion-lethal-trifecta/ Source: Simon Willison’s Weblog Title: The Hidden Risk in Notion 3.0 AI Agents: Web Search Tool Abuse for Data Exfiltration Feedly Summary: The Hidden Risk in Notion 3.0 AI Agents: Web Search Tool Abuse for Data Exfiltration Abi Raghuram reports that Notion 3.0, released yesterday, introduces new prompt injection data exfiltration vulnerabilities…
-
Bulletins: Vulnerability Summary for the Week of September 8, 2025
Source URL: https://www.cisa.gov/news-events/bulletins/sb25-258 Source: Bulletins Title: Vulnerability Summary for the Week of September 8, 2025 Feedly Summary: High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info Adobe–Acrobat Reader Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the…
-
Google Online Security Blog: Supporting Rowhammer research to protect the DRAM ecosystem
Source URL: http://security.googleblog.com/2025/09/supporting-rowhammer-research-to.html Source: Google Online Security Blog Title: Supporting Rowhammer research to protect the DRAM ecosystem Feedly Summary: AI Summary and Description: Yes Summary: The text discusses the Rowhammer vulnerability in DRAM memory, which allows attackers to manipulate memory cells leading to unauthorized access or data corruption. It highlights the inadequacy of current mitigations…
-
Simon Willison’s Weblog: My review of Claude’s new Code Interpreter, released under a very confusing name
Source URL: https://simonwillison.net/2025/Sep/9/claude-code-interpreter/ Source: Simon Willison’s Weblog Title: My review of Claude’s new Code Interpreter, released under a very confusing name Feedly Summary: Today on the Anthropic blog: Claude can now create and edit files: Claude can now create and edit Excel spreadsheets, documents, PowerPoint slide decks, and PDFs directly in Claude.ai and the desktop…
-
The Register: Nx NPM packages poisoned in AI-assisted supply chain attack
Source URL: https://www.theregister.com/2025/08/27/nx_npm_supply_chain_attack/ Source: The Register Title: Nx NPM packages poisoned in AI-assisted supply chain attack Feedly Summary: Stolen dev credentials posted to GitHub as attackers abuse CLI tools for recon Nx is the latest target of a software supply chain attack in the NPM ecosystem, with multiple malicious versions being uploaded to the NPM…
-
Tomasz Tunguz: The Second-Order Effects of AI
Source URL: https://www.tomtunguz.com/mdb-earnings-2025-08-27/ Source: Tomasz Tunguz Title: The Second-Order Effects of AI Feedly Summary: AI vendor revenue will double classic software in terms of new bookings this year. This trend is so large it’s starting to have second-order effects. MongoDB reported strong Q2 FY’26 results, delivering $591M in revenue with 24% year-over-year growth. AI is…
-
Embrace The Red: Cline: Vulnerable To Data Exfiltration And How To Protect Your Data
Source URL: https://embracethered.com/blog/posts/2025/cline-vulnerable-to-data-exfiltration/ Source: Embrace The Red Title: Cline: Vulnerable To Data Exfiltration And How To Protect Your Data Feedly Summary: Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub. Unfortunately, Cline is vulnerable to data exfiltration through the rendering…
-
Microsoft Security Blog: Storm-0501’s evolving techniques lead to cloud-based ransomware
Source URL: https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/ Source: Microsoft Security Blog Title: Storm-0501’s evolving techniques lead to cloud-based ransomware Feedly Summary: Financially motivated threat actor Storm-0501 has continuously evolved their campaigns to achieve sharpened focus on cloud-based tactics, techniques, and procedures (TTPs). While the threat actor has been known for targeting hybrid cloud environments, their primary objective has shifted…
-
Schneier on Security: We Are Still Unable to Secure LLMs from Malicious Inputs
Source URL: https://www.schneier.com/blog/archives/2025/08/we-are-still-unable-to-secure-llms-from-malicious-inputs.html Source: Schneier on Security Title: We Are Still Unable to Secure LLMs from Malicious Inputs Feedly Summary: Nice indirect prompt injection attack: Bargury’s attack starts with a poisoned document, which is shared to a potential victim’s Google Drive. (Bargury says a victim could have also uploaded a compromised file to their own…
-
The Register: Uncle Sam speedruns AI chatbot adoption for federal workers
Source URL: https://www.theregister.com/2025/08/26/gsa_ai_chatbot_speedrun/ Source: The Register Title: Uncle Sam speedruns AI chatbot adoption for federal workers Feedly Summary: The GSA is letting AI chatbot makers jump the FedRAMP queue The US government wants more AI chatbots in fed employees’ hands, and its push to do so means that tech companies keen to provide other services…