Appsec adventures

AbliteratedOutTheBox is a fork of llama.cpp that makes supported models answer flagged harmful prompts at inference time while leaving the original weights on disk unchanged—no fit, training, or extra files required. For each prompt, `llama-abliterate` derives two directions from the prompt itself by forcing the assistant into comply vs. refuse (and clean vs. disclaimered) openings, diffing activations, and using a look-ahead gate to decide per prompt whether to remove them. The edit happens at the `build_cvec` layer-output site shared by 131 of 165 model architectures, so one recipe covers them without per-model code. On Qwen3-8B, refusal dropped from 96.3% to 7.9% on broad held-out harmful prompts and from 82.0% to 0.0% on JailbreakBench, while benign output remained bit-identical when the gate did not fire (0.4% of alpaca prompts). The same recipe worked across Qwen3-8B, Llama-3.1-8B, and Gemma-4-e4b without per-model tuning. Unlike weight-baked abliteration, which perturbs every pr...

Glow Labs found AI coding agents installing deprecated MCP servers from archived, never-to-be-patched repositories—a pattern called MCPhantom. In 98% of affected sessions the agent pulled the package name from model training data; only 2% came from users naming it. The issue spans Claude Code, Cursor, Codex CLI, Claude Cowork and chat, and models from Anthropic, OpenAI and xAI. In one case the agent skipped GitHub's own MCP server for an archived Anthropic reference server. Four high-severity flaws exist in these servers, worst being remote code execution in the Puppeteer server via prompt injection. The report was closed as out of scope; no patch is coming. Deprecated packages were downloaded over 17.3 million times from npm since July 2025, with five in npm's top MCP 100. Existing controls miss them: no dependency manifest, no CVEs, and EDR sees routine installs—even an agent that saw "deprecated" installed anyway. Possible fixes: harness-level blocking (only works ...

The paper presents VulnBench 2.0, a benchmark of 108 hand-curated, attacker-reachable vulnerabilities across 20 open-source web apps (Go, JavaScript/TypeScript, Python, Java), credited only when a finding locates both the attacker-controlled source and dangerous sink within two lines. Nine productized configurations were evaluated blind, including Snyk Code, Claude Code's /security-review, Codex Security with GPT-5.6 variants, and DeepSec. Snyk Code reached 82.4% macro recall (89/108) and Claude Code with Opus 5 at xhigh effort 79.3% (85/108), disagreeing on 28 vulnerabilities (16–12, too few to distinguish them). Neither sufficed alone: combined they reached 101/108, the ceiling of all seven comparable configurations, and AI tools also found at least seven real vulnerabilities missing from the reference set. What AI engines miss depends heavily on the harness as well as the model, and coverage was only loosely tied to cost. All harnesses, fixtures, reference sets, and run data are...

The guide presents threat modeling as a way to identify security risks during the design phase, when architecture changes can be simpler than fixing a flaw after the code has been developed and deployed. By structuring the analysis of assets, threats, and controls, including approaches such as STRIDE, teams can anticipate problems like missing authorization checks and build security requirements into development earlier. Source: https://techgenyz.com/threat-modeling-stride-guide/

A community post on the DevSecOps subreddit presents a report that monitors the latest releases of 78 open source security tools. The checks mentioned include vulnerable dependencies, binary reachability analysis, presence in known-exploited-vulnerability catalogs, release verification, and OpenSSF Scorecard signals. The initiative illustrates how to automate the monitoring of supply chain risk in tooling. Source: https://www.reddit.com/r/devsecops/comments/1xlxx5g/weekly_supplychain_report_for_78_oss_security/

A community discussion follows the proposal of a seven-day waiting period before new packages or versions are made available in the npm, PyPI, and pub ecosystems. The idea is to create time to detect signs of compromise or suspicious behavior before newly published dependencies spread to downstream projects. The post reports on the measure after its first days and debates its possible effects on security and the development workflow. Source: https://www.reddit.com/r/devsecops/comments/1xlfz6l/a_7day_package_cooldown_for_npm_pypi_and_pub_12/