Security & Privacy Engineering

12+ hour, 33+ min ago   (470+ words) The compromised SDK is used to create and manage Tensorlake environments, a cloud-native platform for running isolated AI agents and untrusted AI-authored code. Socket warned that the malicious installation script executes on the developer's machine or build server, outside Tensorlake's…...

11+ hour, 17+ min ago   (902+ words) A malicious release of TensorLake's TypeScript SDK, [email protected], used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its GitHub fallback could create a public repository and commit collected data, including a…...

6+ hour, 8+ min ago   (410+ words) What each MCP Streamable HTTP error means and the fix: 404 on /sse, 406 Not Acceptable, 415, session 400s, 405 on GET, x402 402 quotes, timeouts. Tagged with mcp, ai, api, debugging. MCP Streamable HTTP is one URL. The client POSTs JSON-RPC to it and may open…...

1+ day, 6+ hour ago   (548+ words) See every AI tool and SDK in your org. Audit every action your AI agents take. Block malicious packages in your pipeline. Block threats inside your AI coding agent. Threat intelligence API for custom agents. Package events & AI inventory in…...

16+ hour, 58+ min ago   (465+ words) GitHub, with Microsoft Applied Sciences, introduced an AI-powered ModernBERT classifier that detects hidden passwords before code is pushed, expanding push protection beyond known token patterns. GitHub says it checks batches of possible secrets in under two milliseconds and could more…...

19+ hour, 58+ min ago   (1744+ words) AI coding assistants are unpredictable by design. Learn how AI hooks add deterministic controls and how GitGuardian ggshield blocks secrets before agents can use them. GitGuardian Developer Advocate - Dwayne has been working as a Developer Relations professional since 2016 and has…...

20+ hour, 58+ min ago   (270+ words) Security researchers at Cycode uncovered a vulnerability in Anthropic’s Model Context Protocol (MCP) Python SDK that could allow a malicious MCP server to steal OAuth credentials and potentially take over user accounts. The vulnerability, detailed in new research from Cycode,…...

17+ hour, 28+ min ago   (403+ words) A threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The malicious package activates through a preinstall lifecycle hook that invokes node lib/setup.mjs. The…...

15+ hour, 17+ min ago   (810+ words) This blog was originally published on Descope. You'd think the most secure OAuth flow wouldn't need a patch, but the standard Authorization Code flow has a blind spot. It can't guarantee that the app redeeming an authorization code is the…...

15+ hour, 17+ min ago   (500+ words) I've shipped all four approaches at different times, and the mistake I made early was treating this as a code decision. It's an operations decision. Below is the framework I use now, the concrete trade-offs, and the failure modes each…...