7 posts tagged with “boundaries”
Anthropic's Project Glasswing deployed Claude Mythos Preview to autonomously discover thousands of zero-days with a 72.4% exploit success rate. Less than 1% of findings have been patched. The bottleneck is no longer discovery — it's everything that comes after.
A penetration testing firm audited 15 applications built with AI coding assistants. They found 69 exploitable vulnerabilities, 6 critical. The estimated remediation cost: $1.5 million. Teams shipping AI-generated code need to focus on the security debt accumulating underneath.
Static AI guardrails are failing in production. Langflow was exploited within 20 hours. Cline was compromised through a GitHub issue title. Here's what actually works instead.
Claude found 22 Firefox vulnerabilities in two weeks. XBOW discovered a 9.8-rated Windows CVE without source code. But 50% of AI-generated code ships with exploitable flaws. AI is better at finding bugs than avoiding them — and that gap defines the next era of application security.
820 malicious packages. 30,000 exposed instances. Fortune 500 breaches. The AI agent ecosystem has a supply chain problem that traditional AppSec isn't built to catch.
Everyone optimizes the token window. Almost nobody manages the environment. Active context is what your agent thinks about. Latent context is what your agent can reach. The blast radius of a compromised agent is determined by the latter.
Indirect prompt injection has moved from theory to active exploitation. Unit 42 confirms in-the-wild attacks, PleaseFix hijacks AI agents through calendar invites, and a Claude Code CVE exposed 150,000 developers. Here is what security teams need to know.