Appsec adventures

cuzinho.dev is a satirical Brazilian website presenting itself as an "agile methodology" for delivering software at the last second. Branded "Obra nº 001" with version 0.0.1-rc-final-agora-vai, it lists an official deadline of Friday 17:59 and displays a countdown with the note that there is still time to procrastinate. The site's featured "axiom of the day" jokes that every five-minute task comes with a five-day blocker, usually a permission only one person in the world can grant, and that person is on vacation. It also offers a README badge reading "deploy no cuzinho" that developers can add to their repositories to signal they follow the methodology.  https://cuzinho.dev/

This Resilient Cyber essay argues that human-in-the-loop approval is not a functioning security control for AI agents, citing Anthropic's own disclosure that users approve 93 percent of Claude Code permission prompts, which leads to approval fatigue rather than meaningful review. The piece examines Claude Code's new Auto Mode, which replaces per-action approval with a two-layer classifier system: an input-side prompt injection probe that scans tool outputs, and an output-side transcript classifier on Sonnet 4.6 that evaluates each action, with tool results deliberately excluded from the classifier's input so hostile content cannot manipulate its decisions. Anthropic reports a 0.4 percent false-positive rate and a 17 percent false-negative rate on real overeager actions, and Auto Mode hard-blocks actions such as piping curl to bash, production deployments, and force-pushing to main. Supporting data shows auto-approve use rising from about 20 percent among new users to over 4...

Google's Head of Red Teams outlines how AI is forcing a fundamental transformation in offensive security testing. While the core mission remains preparing organizations for real-world attackers, the threat landscape is shifting toward autonomous agentic attacks that operate at machine speed and scale.  The post predicts that within 6-12 months, open-weight models will match today's frontier cyber capabilities—enabling industrialized social engineering, automated attack chains, cheap supply chain compromises, and machine-speed exploitation of poor security hygiene. Defenders hold structural advantages (home-field knowledge and first access to defensive tools), but Red Teams must evolve to simulate agentic threats by iteratively building modular AI subagents for reconnaissance, lateral movement, and other attack phases, eventually connecting them via orchestrators for end-to-end autonomous simulations.  The window to prepare is short, but Red Teams can begin now by automating is...

Irregular researchers argue that while AI security's long-term equilibrium may be defense-dominant (with AI continuously auditing and patching vulnerabilities), the transition period will sharply favor offense—a dynamic they term the "end-state fallacy."  Drawing on their work with frontier labs, they document rapid capability gains: a custom CPU exploit task went from unsolvable in February 2026 to reliably solvable for ~$20 by June, and open-weight models are now only months behind frontier cyber capabilities.  They frame offensive progress across three dimensions (range, complexity, orchestration), noting costs are falling ~10x annually and diffusion is accelerating—with frontier-grade offensive capabilities expected to proliferate by Q1 2027.  The essay identifies structural asymmetries favoring offense: collapsing exploit-to-patch windows, defender accountability tax, AI's dual-use nature, and the difficulty of verifying fixes versus exploits.  They propose a st...

Security veteran JS0N Haddix pushes back against post-DEF CON panic that AI will destroy cybersecurity careers, arguing the industry has survived similar technological shifts before and will again.  Drawing from his Black Hat review board experience, consulting work, and 16 DEF CONs, he contends that AI is a force multiplier on expertise—not a replacement—and that genuinely novel research still originates from human intuition, not models. While acknowledging legitimate concerns about the erosion of junior-level triage roles, he proposes restructuring entry pathways through deliberate apprenticeships, training programs, and skill verification that measures judgment over output.  He argues that enterprise adoption lags far behind the frontier, AI-generated patches remain dangerously flawed (citing research showing only 26% fully fix vulnerabilities), and adversarial AI will increase rather than decrease demand for defenders. The piece frames the anxiety as grief over changing sk...

This article argues that the traditional, gate-based software security model is being structurally dismantled by the rise of AI coding agents that generate, review, and deploy code at machine speed, with a documented 37.6% increase in critical vulnerabilities after five agent iterations without embedded security checks. The author contends that while SAST remains necessary, it is insufficient, and the real crisis is governance failure—as demonstrated by 100% of surveyed companies having AI-generated code in production while 81% of security teams lack visibility into it. The solution lies in a "shift-everywhere" architecture with three layers: embedded agent-native security (using MCP servers and policy files as critical infrastructure), gate-based controls for audit and AI-assisted remediation, and runtime behavioral monitoring with agent identity and least-privilege principles. The paper calls for concrete changes: updating SSDLC policies with an "agentic annex" co...

GEICO explores the evolution toward an agentic software development lifecycle, where AI agents assist across planning, coding, testing, security, and deployment activities. The article discusses how autonomous agents can improve developer productivity and automate repetitive tasks, while highlighting the need for strong governance, security controls, human oversight, and new engineering practices to manage risks introduced by AI-driven development workflows.   https://www.geico.com/techblog/the-agentic-sdlc/

Ben Goertzel argues that the Zcash Orchard bug, which allowed potential counterfeit ZEC creation and was undetected for four years until an AI model (Anthropic's Opus 4.8) found it, is an early tremor of a coming wave where AI will expose latent vulnerabilities across all software, from crypto to traditional finance. He contends the solution is well-known—formal verification and "correct-by-construction" derivation from mathematical specifications, as being implemented in the ASI:chain project—but the software industry has avoided it due to cost and speed pressures. Goertzel concludes that the same AI capabilities driving this reckoning can also enable large-scale formal verification, making the threat and remedy essentially the same technology, and urges a broad shift toward making mathematical proof the default expectation in software development.   https://bengoertzel.substack.com/p/the-orchard-bug-and-the-unfolding

This ICML 2026 paper by Ye, Cui, and Hadfield-Menell presents a theory that prompt injection attacks succeed because LLMs perceive roles (like user , assistant , tool , think ) through insecure surface features like writing style rather than through the secure structural tags themselves. Using role probes to measure internal token perceptions, the authors demonstrate that sounding like a privileged role (e.g., mimicking reasoning style) overrides the actual tag, enabling attacks like CoT Forgery where fake reasoning in a user prompt achieves a ~60% success rate, while simply destyling the text drops success to 10%. They argue that roles are a hacked-together format trick that became critical cognitive and security infrastructure, and that unless models achieve genuine role perception, defense will remain a whack-a-mole game, opening the door to subtler threats like subconscious steering of LLM states for commercial or adversarial purposes.   https://role-confusion.github.io/

Filippo Valsorda argues that vulnerability reports are no longer "special" for open source maintainers because LLMs have made finding potential security issues cheap and abundant, shifting the bottleneck to triage and remediation rather than discovery. Confidentiality and embargoes matter less since attackers can also use AI to find flaws, so maintainers should focus on rapid triage, prevention, and integrating AI analysis into CI, while still treating truly exceptional reports from trusted sources with special care. https://words.filippo.io/vuln-reports

This article explains Anthropic's Model Context Protocol (MCP) in three levels of difficulty. Level one covers why MCP matters: it solves the integration problem of connecting multiple AI clients to multiple tools by replacing M times N custom adapters with just M plus N protocol implementations. Level two details the architecture, explaining how hosts, clients, and servers work together, and the key primitives: tools, resources, and prompts. Level three addresses real-world deployment concerns, including transport options (stdio for local, HTTP for remote), security considerations like authentication and sandboxing, and decisions around local versus remote hosting. The article concludes that MCP provides a scalable, standardized foundation for building AI systems that reliably interact with external data and software.  https://machinelearningmastery.com/model-context-protocol-explained-in-3-levels-of-difficulty/

Perfectly "un-jailbreakable" AI models don't exist—it's an unrealistic goal. But the best way to get close is neural-symbolic AI combined with open-source models, not closed proprietary systems. The real threat isn't simple prompt injection, but "capability-elicitation attacks"—where an AI follows instructions but is gradually coaxed over hundreds of prompts into producing something dangerous. The solution: a "generate, then verify" pipeline. Let the neural model generate outputs, but quarantine risky ones and pass them through a symbolic verification layer (formal analyzers, sandboxes, logic engines) that rigorously judges what the output actually does. This is more reliable than just using another LLM to check things. Why openness helps: An open ecosystem can field a diverse ensemble of specialist verifiers—far better than any single company. Independent verifiers with different blind spots make the system harder to game. While bad actors can...

This article from Martin Fowler's site explores the emerging concept of Spec-Driven Development (SDD) by examining three tools that claim to implement it: Kiro, GitHub's spec-kit, and the Tessl Framework. The author defines SDD as a "documentation-first" approach where a structured specification is written before code and serves as a source of truth. The tools vary significantly in their implementation, from lightweight workflows to more elaborate artifact generation, and in their ambition—ranging from "spec-first" to "spec-anchored" (maintaining the spec over time) to "spec-as-source" (where the spec is the primary artifact). The author raises critical questions about the practical utility of these tools, noting that their rigid workflows may be overkill for small tasks, the generated markdown files can be tedious to review, and the approach risks creating a false sense of control due to LLM non-determinism. The article concludes by draw...

This blog post from AI Village examines how missing authorization in AI agent tool-calling workflows can turn normal support actions (like email changes) into account takeover paths. The core issue is not LLM manipulation, but the absence of an authorization boundary between the user, the agent, and privileged tools. It presents three common design patterns: 1) Agent initiates but does not perform mutations (reduces direct risk but can still be abused for harassment); 2) Privileged tools require separate verification (stronger, but verification flows can still be abused); 3) A policy layer sits between agent and tools (cleanest, with centralized enforcement). The post introduces a "Maze Design" pattern with multiple security gates (intent classification, identity verification, ownership, policy, rate limiting, step-up verification) to force controlled execution paths. It emphasizes that this is a classic IAM problem amplified by agents, and advises assessing where agents can ...

This essay explores the concern that AI, by automating tasks and removing inefficiency, may inadvertently eliminate the repetitive, mistake-filled apprenticeship that has traditionally built human expertise. The author argues that expertise is formed through accumulated error—debugging broken code, triaging false positives, writing bad drafts—and that AI's ability to bypass this struggle risks creating a generation that can produce output but lacks the judgment to evaluate it. The piece frames this as a critical governance challenge: as AI takes more action, humans may lose the opportunities to develop the intuition needed to supervise it, making the preservation of learning conditions as important as controlling the technology itself.  https://arksher.substack.com/p/controlled-agency-issue-10-the-hidden

This research report from MMC Ventures, based on conversations with 30+ CISOs and founders, outlines three distinct approaches to securing AI agents: Runtime AppSec (instrumenting applications to confirm exploitability), Contextual Agentic Security (steering agent behavior in real time with deterministic and probabilistic methods), and Structural Security (embedding hard boundaries at the infrastructure level). The report notes that enterprises are actively deploying agents, incidents are already happening (e.g., Meta data exposure), and the market is fragmented but moving fast. It highlights the importance of GTM strategy (developer-led vs. CISO-led) and looks for startups with depth of visibility, layered security, deliberate GTM, and native architecture for the agentic paradigm.  https://mmc.vc/research/the-next-wave-of-agentic-security/

This analysis explores Israel's dominance in cybersecurity startups, attributing it to cultural factors like strong founder networks from military service, active early-stage VCs who provide hands-on support, and a flywheel effect of successful exits and reinvestment. However, it also notes challenges facing Israeli startups, including AI reducing technical moats, crowded markets making differentiation harder, and the over-reliance on established playbooks becoming a liability. The piece advises non-Israeli founders that success is still achievable through authentic branding, customer proximity in the US, and embracing different approaches. It concludes that while Israel excels at building companies for acquisition, the largest independent security firms remain American, and the market can support many winners.  https://ventureinsecurity.net/p/what-israeli-dominance-in-cyber-means

This opinion piece argues that AI-native operating systems, like those being integrated by Google and Apple, could fundamentally change the fight against social engineering. It explains that social engineering has historically succeeded due to three weaknesses: the burden of authentication on users, the lack of cross-context understanding in systems, and the speed that forces quick user decisions. By operating across all apps and data, these new OS-level AIs can continuously authenticate users, detect coordinated manipulation attempts in real time, and intervene during or after an attack. This shifts the responsibility from user vigilance to system vigilance, potentially making social engineering attacks more costly and complex, similar to how widespread antivirus changed the economics of computer viruses.  https://www.darkreading.com/cyberattacks-data-breaches/beginning-end-social-engineering

This opinion piece warns that Anthropic's AI coding assistant, Claude Code, has a critical security vulnerability involving the Model Context Protocol (MCP). Researchers at Mitiga Labs demonstrated an attack chain where a malicious npm package with a post-install hook rewrites a single configuration file (~/.claude.json), which controls how Claude Code routes MCP traffic. This redirects authenticated requests and OAuth tokens (stored in plaintext) to attacker-controlled infrastructure instead of legitimate services like Jira, Confluence, or GitHub. The attacker then holds valid long-lived bearer tokens. The attack is difficult to detect because provider audit logs show Anthropic’s IP range and a valid user session — nothing appears wrong, but the user did not initiate the actions. Anthropic responded that the issue was out of scope, reasoning that prior code execution requires user consent to install the package, and as of this writing no patch exists. The article notes previous vu...

Pieter Levels (@levelsio) posted that within 1.5 hours he replaced all his Chrome extensions with his own "vibe-coded" extension called SuperLevels, after one of his existing extensions updated and suddenly wanted to read his entire browser history (which he suspected was to sell to an ad company). The SuperLevels extension includes: Tab Cleaner (auto-closes tabs after inactivity with host-based exclusions), Cookie Editor (nuke all cookies or edit any), Redirect Tracer (view redirect chains), Dark Mode (per-site or all sites), X Dim (changes X background back to dark blue), Music Finder (records and identifies songs), and restores Maps and View Image links that are hidden in the EU. He stated he deleted all other extensions except uBlock Origin, because controlling the source code is much safer.  https://x.com/levelsio/status/2046271694042505451 (I completely understand this guy. Bob has brought back that lovely feeling of coding again.)