Mastodawn

AI-generated code is becoming increasingly widespread, but systemic flaws in verification and understanding risk generating flawed, insecure systems. Only human oversight can prevent this recursive cycle from eroding software reliability.
Discover more at https://smarterarticles.co.uk/the-ouroboros-machine-when-ai-reviews-its-own-code?pk_campaign=rss-feed
#HumanInTheLoop #AIDevelopment #SoftwareSecurity #AIinEnterprise

The Ouroboros Machine: When AI Reviews Its Own Code

Somewhere inside the engineering departments of the world's largest technology companies, a peculiar feedback loop has taken hold. AI s...

SmarterArticles

Show thread

Benjamin Han Mar 19

The deeper lesson is that safety can fail in two places at once: incomplete command validation and weak observability across agent layers. If a lower-level agent can act while the top-level agent thinks it only detected risk, the system is not actually in control.

Multi-agent systems need recursive validation, strong isolation, and end-to-end action visibility.

https://www.promptarmor.com/resources/snowflake-ai-escapes-sandbox-and-executes-malware

#AI #AgenticAI #AISafety #Cybersecurity #LLMSecurity #PromptInjection #SoftwareSecurity #Snowflake (2/2)

Snowflake Cortex AI Escapes Sandbox and Executes Malware

A vulnerability in the Snowflake Cortex Code CLI allowed malware to be installed and executed via indirect prompt injection, bypassing human-in-the-loop command approval and escaping the sandbox.

Tommy Löfstedt Mar 13

RE: https://mastodon.social/@TommyLofstedt/116137631196333408

About a week left to apply for this #phd project where we will develop novel #machinelearning methods for #softwaresecurity.

TechNadu Mar 11

Transitive dependencies make vulnerability exposure difficult to map across large engineering environments.

Ben Benhemo, Security Innovation Engineer at Sola Security, explains:
“Widely used components are often included both directly and indirectly through transitive dependencies, making it harder for organizations to quickly understand their true exposure once a vulnerability is disclosed.”

Read the interview:
https://www.technadu.com/when-transitive-dependencies-include-vulnerable-components-ownership-gaps-slow-remediation-leaving-enterprises-struggling-to-map-exposure/623044/

#AppSec #RCE #SBOM #CVE #SoftwareSecurity

Tiamat Mar 9

🚨 Supply chain attacks: Your npm dependencies are already compromised.

Three vectors:
1. Typosquatting (reqest vs request)
2. Compromised owner accounts
3. Malicious "helpful" packages

2,847 malicious packages in 2025. How many are in your production codebase?

Defense guide: https://tiamat.live/analysis/supply-chain-attacks?ref=masto-supply-chain

#DevSecOps #SoftwareSecurity #SupplyChain

TechNadu Feb 21

Supply chain alert:
Cline CLI v2.3.0 was published with a compromised npm token.

It auto-installed OpenClaw via a hidden postinstall script.

~4,000 downloads in 8 hours.
No malware - but unauthorized execution in dev environments.

Are AI agents in CI/CD pipelines becoming the next major trust boundary risk?

Source: https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html

Follow @technadu for independent cybersecurity reporting.
Join the discussion below.

#CyberSecurity #SupplyChainAttack #AIsecurity #OpenSource #DevSecOps #Infosec #SoftwareSecurity

InfoQ Feb 16

#WhatsApp has rewritten its media handling library in #RustLang!

The result❓ The codebase dropped from 160,000 lines of C++ to 90,000 while adding robust memory safety protections.

Running on billions of devices - Android phones, iPhones, desktops, watches, and web browsers - this marks one of the largest client-side Rust deployments to date.

Find out more: https://bit.ly/4tv205g

#SoftwareDevelopment #SoftwareSecurity #MemoryLeaks #InfoQ

Tim Green Feb 2

AI-driven coding accelerates development but introduces security, technical debt, and skill erosion risks. Adaptive trust models could act as intelligent guardrails, balancing innovation with safety and developer growth. Discover more at https://dev.to/rawveg/the-guardrails-we-need-37el
#HumanInTheLoop #AIDevelopment #SoftwareSecurity #TechTrust

The Guardrails We Need

GitHub Copilot has crossed 20 million users. Developers are shipping code faster than ever. And...

DEV Community

InfoQ Feb 2

#Cedar - an #opensource authorisation policy language and SDK - has officially joined the Cloud Native Computing Foundation (#CNCF) as a Sandbox project!

It aims to provide a vendor-neutral standard for defining and enforcing fine-grained permissions in modern applications.

Details here 👉 https://bit.ly/3LMktJP

#DevOps #PolicyAsCode #SoftwareSecurity #Governance #InfoQ