标签：#SEC

Proteger datos que deben seguir siendo secretos dentro de diez años es un problema de hoy : un adversario puede capturar tu tráfico cifrado ahora y descifrarlo cuando exista la capacidad cuántica ( harvest now, decrypt later ). Quipu es una librería libre de cifrado híbrido post-cuántico para datos en reposo: combina criptografía clásica probada con la nueva, de modo que solo se rompe si ambas caen a la vez. Rust puro, y por qué Quipu nació apuntando a varios lenguajes: un núcleo en Rust con una C ABI encima y bindings para Python, Node y Go. Funcionaba, pero la lección fue clara: mantener una interfaz de C estable más cuatro bindings, cada uno con su empaquetado y sus pruebas de interoperabilidad, era complejidad que no pagaba para el objetivo real —proteger datos en reposo— y ampliaba la superficie de ataque con unsafe que no queríamos. Hoy Quipu es Rust puro : memoria segura, sin garbage collector , sin unsafe de primera parte . Y para quien no programa en Rust, se distribuye como rueda nativa de Python (vía PyO3) — que es la superficie que el cliente que no es de Rust de verdad necesita. Una sola base de código, una sola cosa que auditar. Es la misma filosofía que guía el resto: donde hay buena criptografía, se reutiliza; la simplicidad es una decisión de seguridad, no una comodidad. Instalación cargo add quipu # Rust pip install quipu-crypto # Python (rueda nativa, PyO3) Cifrar y descifrar en Python import quipu # Simétrico con contraseña blob = quipu . encrypt_stream ( b " datos sensibles " , " mi-passphrase " ) assert quipu . decrypt_stream ( blob , " mi-passphrase " ) == b " datos sensibles " # Post-cuántico para un destinatario pub , sec = quipu . generate_keypair () # X25519 + ML-KEM-1024 c = quipu . encode_to_recipient ( b " secreto " , pub ) assert quipu . decode_as_recipient ( c , sec ) == b " secreto " Qué hay debajo Cifrado: XChaCha20-Poly1305 (AEAD autenticado). Derivación de claves: Argon2id (resistente a fuerza bruta) + HKDF. Post-cuántico: X25519

How CAPTCHA evolved from typing distorted text to analyzing behavior, context, and risk When most people hear CAPTCHA, they imagine a small checkbox: ☐ I’m not a robot Or perhaps a challenge asking them to select traffic lights, bicycles, buses, or crosswalks. But modern reCAPTCHA is much more interesting than that. In many cases, you don't actually solve anything. You simply open a webpage, move your mouse, click a button, fill out a form—and somewhere in the background, a risk-analysis system is trying to answer a much harder question: “Does this interaction look like a legitimate human interaction, or automated/abusive traffic?” That is a fundamentally different problem from asking a user to identify a picture. Google describes reCAPTCHA as a service that uses advanced risk-analysis techniques to distinguish humans from bots. Modern versions can return a risk score instead of presenting a visible challenge. 1. The original CAPTCHA problem CAPTCHA originally stood for: Completely Automated Public Turing test to tell Computers and Humans Apart. The basic idea was simple: Humans are good at recognizing distorted characters. Traditional computer programs were not. So the website could display something like: but distort, rotate, or obscure the characters. The user typed: 7hK9P and the website accepted the answer. This created a simple classification: It worked reasonably well. Until machines became better. 2. Then computers learned to read the CAPTCHA This created an interesting security race. CAPTCHA became harder. Then OCR and machine learning became better. So CAPTCHA became even harder. Eventually the system was moving toward: Human intelligence vs machine vision And that created an unfortunate side effect. The better the security became, the worse the experience became for legitimate users. Instead of: «“Are you human?”» the user was suddenly being asked: «“Select every square containing a traffic light.”» And sometimes: «“Select every square containing a traffi

I've spent the better part of a decade building security tooling and responding to incidents across fintech and healthcare. In the last eighteen months, the threat landscape shifted faster than anything I've seen since the ransomware explosion of 2017. The catalyst this time isn't a novel exploit technique or a zero-day in some ubiquitous library. It's AI. Not the hand-wavy "AI will change everything" kind of rhetoric. I'm talking about concrete, measurable changes in how attacks are constructed, how defenses are automated, and how the asymmetry between attacker and defender is being rewritten. The Offensive Side: What Changed Phishing at Scale, Without the Tells The traditional phishing email had signals: broken grammar, generic salutations, mismatched sender domains. Security awareness training worked because humans could learn these patterns. Large language models broke that assumption. We're now seeing spear-phishing campaigns where the attacker feeds a target's LinkedIn profile, recent conference talks, and published papers into a model, then generates contextually perfect emails — referencing real projects, using appropriate jargon, even mimicking the writing style of a known colleague. The cost per attempt dropped from hours of manual OSINT to seconds of API calls. In one engagement last year, our red team used a fine-tuned model to generate pretexting scripts for vishing calls. The success rate against employees who had passed phishing simulations was 3x higher than our traditional approach. That number should concern anyone running a security awareness program. Vulnerability Discovery and Exploit Generation Static analysis tools have used pattern matching for decades. What's different now is that transformer-based models can reason about code semantics in ways that syntactic tools cannot. Feed a model a diff from a security patch, and it can often infer the vulnerability that was fixed — then generate a proof-of-concept for the unpatched version. This isn't

Ever logged into an app, closed the tab, come back, and you're still logged in — no password needed? That's almost always JWT doing its job behind the scenes. JWT (JSON Web Token) is one of the most common ways to handle authentication in modern backends. But a lot of developers use it without really understanding what's happening — and that's exactly where security bugs sneak in. Let's fix that. By the end of this post you'll know what a JWT actually is, how to use it in a Node.js + Express app, and the mistakes that quietly break real apps. What is a JWT, really? A JWT is just a string with three parts , separated by dots: xxxxx.yyyyy.zzzzz │ │ │ header payload signature Header — says which algorithm signed the token (e.g. HS256 ). Payload — the actual data (like userId , role , and an expiry time). This is not encrypted — it's just Base64-encoded. Anyone can read it. Signature — a cryptographic stamp created using a secret only your server knows. This is what stops people from faking tokens. Want to see this for yourself? Paste any token into a free JWT decoder and you'll instantly see the header and payload. Notice you can read everything without the secret — that's the key lesson: never put passwords or sensitive data in a JWT payload. Creating a token (login) Install the library: npm install jsonwebtoken When a user logs in successfully, sign a token: import jwt from ' jsonwebtoken ' // On successful login: const token = jwt . sign ( { userId : user . _id , role : user . role }, // payload process . env . JWT_SECRET , // secret (keep it in .env!) { expiresIn : ' 7d ' } // auto-expiry ) res . json ({ token }) Three things to notice: Keep the payload small — just an id and role, not the whole user object. The secret lives in an environment variable, never hardcoded. Always set expiresIn . A token that never expires is a token that can be stolen forever. Verifying a token (protecting routes) Now create a middleware that checks the token on every protected request

Your AI agent returns a signed receipt: 0 defects found. The signature is valid. The receipt has not been altered. The agent was authorized to run the check. The result can still be wrong. Perhaps the scanner hit a rate limit and silently converted eleven failures into eleven empty results. Perhaps a watchdog inspected 8 machines and issued a conclusion about 68. Perhaps a database health check ran select 1 successfully while the application was failing because a required column did not exist. In every case, the software can produce a well-formed result. It can even sign that result correctly. What it cannot prove is that it measured the claim the business thinks it measured. That distinction is becoming one of the most important problems in agent infrastructure: authentic receipt != adequate measurement authorized action != correct conclusion zero findings != complete inspection A signature answers only part of the question Cryptographic signatures are valuable. They can prove who signed an object and whether its contents changed after signing. They do not prove: that the check actually ran that it reached the intended target that it measured the right population that the sample supports the claimed conclusion that exceptions were not converted into zeros that a passing control answered the business question This is the difference between provenance integrity and measurement integrity . Provenance integrity asks: Who made this statement, and was the statement altered? Measurement integrity asks: What was actually observed, how much of the target was covered, and is the conclusion justified by that observation? An agent work protocol needs both. Otherwise, a signature can turn uncertainty into durable false confidence. Three failures with the same shape This article grew out of a thoughtful comment from Heinrich Neb on the first article in this series. He described three incidents from one week. First, a harvesting tool scanned 16 public repositories. Five returned

I spent six hours trying to upgrade a non-admin user to admin, convinced I was missing some clever bypass. The gap turned out to be one field in a request body I'd already looked at twice. This is a PortSwigger lab on multi-step process access control. The setup: an admin panel with a user upgrade flow. You pick a user, hit upgrade, then confirm on a second screen before the change actually goes through. Not counting the admin login and accessing the admin panel, that's two steps. The goal was to login as wiener (my non-admin account) and upgrade it to admin without ever having admin access to begin with. Fig 1. A quick look at the admin interface in action. What I tried that didn't work I followed and wrote out the steps the admin flow actually takes, so I could inspect each step individually. Checked the change-email route for anything reusable. Tried hitting the admin and admin-roles paths directly with different HTTP methods. Added the referrer header with the value I'd seen during the legitimate admin flow. Went through the HTML and JS on every relevant page. Tried looking for where the user list was being fetched from. Tried the user-ID-in-params trick that had worked on an earlier lab. None of this brought any results and just got me more frustrated. The thing is, I was going at this problem with the assumption that in this scenario, I was a hacker with no idea of how the admin system actually worked when upgrading users. And that the lab giving me access to the admin credentials was just to hint towards any probable vulns. Why I slipped into that line of thinking, I have no idea. As I watched the hours tick by on my laptop clock, I grew increasingly aware of the painful fact that some LLM somewhere could probably one-shot this problem. That I could end my suffering by taking a knee before the mighty oracle called Claude. And you as a reader are probably wondering why I didn't submit. Well I was determined to actually learn. I had told myself going into this,

AI-Powered Privacy Policy Generators LLM‑driven privacy policy generators have moved from experimental prototypes to production‑grade services in 2026, offering on‑demand, jurisdiction‑aware drafts that can be directly embedded into compliance pipelines. Tools such as PrivacyGPT and PolicyCraft combine retrieval‑augmented generation with rule‑extraction models, turning natural‑language privacy intents into enforceable policy clauses that can be exported as JSON‑LD or plain‑text templates. Deep Dive Architecture PrivacyGPT leverages a hybrid architecture: a domain‑specific transformer fine‑tuned on 10 million privacy statements, paired with a deterministic rule engine that maps extracted obligations to GDPR, CCPA, and emerging AI‑Act provisions. PolicyCraft adds a feedback loop where the generated draft is automatically validated against an internal compliance knowledge graph; mismatches trigger a self‑correcting prompt that iteratively refines the text until a confidence score above 92 % is achieved. Real-World Engineering Examples A fintech startup integrated PrivacyGPT via its CI/CD pipeline; each pull request that modifies data‑collection code triggers an API call that updates the “Data Retention” clause, keeping the public policy in sync with code changes. A multinational e‑commerce platform deployed PolicyCraft to generate locale‑specific consent banners; the system produced 27 variants in under five minutes, each certified against the EU’s Digital Services Act. Zero‑Trust Architecture for Rule Enforcement Zero‑trust architecture (ZTA) starts from the assumption that no network segment—whether on‑prem, cloud, or edge—can be implicitly trusted. Instead of a perimeter, every request is evaluated against a continuously refreshed identity profile that fuses user credentials, device posture, and behavioral risk scores. In practice, this means deploying a Policy Decision Point (PDP) that consumes attributes from an identity provider, a device‑trust service, and a tel

If you're wiring MCP servers into an agent and want to check them for prompt injection, tool poisoning, or supply-chain risk before you trust them, there are now a handful of open-source options. This is a factual, no-benchmarks comparison of the three I could actually find and read the docs for: our own sentinel-scan-cli , Cisco's mcp-scanner , and what used to be Invariant Labs' mcp-scan . One thing worth flagging up front: Invariant Labs' mcp-scan repo ( github.com/invariantlabs-ai/mcp-scan ) now redirects to github.com/snyk/agent-scan . The project has been absorbed into Snyk and rebranded as "Agent Scan" (package snyk-agent-scan ). If you're comparing tools based on older blog posts that reference "Invariant Labs mcp-scan" as a standalone, no-account CLI, that's out of date — running it now requires a free Snyk account and an SNYK_TOKEN API key ( export SNYK_TOKEN=... ) before the CLI will scan anything. I'm comparing against the current Snyk Agent Scan README since that's what the repo actually ships today. All claims below are pulled directly from each project's public README as of 2026-08-24. No invented features, no synthetic benchmarks — this is a "what does the doc actually say" comparison, not a lab test. Feature comparison sentinel-scan-cli Cisco mcp-scanner Snyk Agent Scan (fka Invariant Labs mcp-scan) License MIT Apache 2.0 source-available on GitHub; requires Snyk account/token to run Install zero dependencies, single Python file or pip install / npx github:... uv tool install , Python 3.11+ uvx snyk-agent-scan or standalone binary Signup / API key required to run at all No ( --demo needs nothing; scanning your own endpoint needs only your own endpoint's key) No (core YARA/static scanning works with zero keys; LLM/Cisco AI Defense/VirusTotal analyzers are opt-in extras) Yes — Snyk account + SNYK_TOKEN required before any scan runs What it scans Live LLM endpoint (prompt-injection/jailbreak suite) and static MCP tool manifests ( mcp.json ) Live MCP se

1. Basic Information Article Title : The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile Publisher : Zimperium zLabs Publication Date : 2026-08-19 Update Date : None Severity : high Original Source : Zimperium zLabs Related Sources : Zimperium IOC repository , ToxicPanda Android malware uses VPN permissions to block Google Play , Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight Related Entities : malware: ToxicPanda 2.0 groups: Not specified in public reports cves: None products: Android 11 and later, Android Accessibility Service, Wireless Debugging, Android Debug Bridge (ADB), Google Play, Google Play Services, Amazon Web Services (AWS-hosted buckets) 2. Executive Summary ToxicPanda 2.0 is an Android banking malware. It uses fake installation screens to gain VPN and Accessibility permissions. Then, it automatically operates Android settings to connect to the local ADB daemon. Without rooting the device, it uses shell privileges to change settings and add persistence. Finally, it steals financial information using Accessibility and fake screens or overlays. 3. Attack Flow 1. Distribution and Initial Setup The attacker uses Amazon Web Services storage to distribute ToxicPanda 2.0 samples. The specific method to trick users into downloading the file is not public. The dropper shows a fake installation screen and asks the user to allow an Android VPN connection. After permission is granted, the local VPN blocks network traffic to Google Play and Google Play Services. The dropper decrypts and installs an encrypted payload from its assets, then asks the user to enable the Accessibility Service. 2. Exploiting Wireless Debugging and ADB The Accessibility Service reads the Android settings screen. If Developer Options are disabled, it automatically taps "Build number" seven times to enable them. It goes to the Wireless Debugging screen, enables the feature, and opens "Pair device with pairing code." It uses Accessibility to rea

Cloudflare recently open-sourced Cloudflare OS. It allows enterprise teams to output work artifacts grounded in enterprise knowledge, know-how, and provisioned connectors, automate repetitive workflows with optimized token cost (with AI assistance only where needed), and build personal, shareable, customizable work software that caters to specific, complex use cases within a secure sandboxed model By Bruno Couriol

Quick one: if PyRIT (Microsoft's Python Risk Identification Tool) is on your shortlist for LLM red-teaming, check the repo first. Azure/PyRIT was archived on GitHub on March 27, 2026. It's read-only now: no commits, no releases, no issue triage, nothing. Whatever version you pip-installed is the last version you'll ever get. That matters more for PyRIT than it would for most tools, because PyRIT was never a turnkey scanner. It's a framework for scripting multi-turn attack orchestration, the kind of thing a red team builds custom attack sequences on top of. A framework that's stopped shipping fixes is a worse foundation to build on than a finished tool that's stopped shipping features, because you were relying on it staying flexible to your needs, and now it can't. So what do you use instead? Depends on what you were actually using PyRIT for: You wanted a broad, actively maintained app-layer scanner -> promptfoo . Zero-install via npx promptfoo , 50+ red-team plugins, OWASP/NIST/MITRE ATLAS report mappings, and it's still getting regular releases. You wanted model-layer testing (jailbreaks, encoding tricks, data leakage on the base model itself, not your app) -> garak . NVIDIA-maintained, pip installable, 8k+ stars, actively developed. You wanted OWASP-mapped detectors and don't mind a paid tier for continuous scanning -> Giskard . The open source scanner is real and current; the always-on Hub is commercial. You wanted a fast, zero-setup smoke test before reaching for any of the above -> that's the gap we built sentinel-scan-cli for. Dependency-free CLI (Python and npm ports, identical output), 15 attack patterns each tagged to its OWASP LLM Top 10 category, --demo runs with no config and no API keys in under a minute. None of these replace PyRIT's specific multi-turn orchestration model one-for-one, if that's genuinely what you need, Microsoft's PyRIT Community fork discussion or building your own harness on top of a maintained model API is probably the honest answe

Envelope encryption con clave por usuario, qué se cifra y qué no, cómo lo puso a prueba una auditoría externa, y el incidente de rendimiento que provocó nuestro propio hardening de seguridad. Montaste tu app con IA rápido: le pides unos datos al usuario, llamas al modelo, guardas el resultado en la base de datos y a producción. Cómodo, sin complicaciones. Hasta que un día miras bien qué estás guardando. En Cuentopia generamos cuentos personalizados para niños. Para personalizar, un padre nos cuenta cómo es su peque: su carácter, qué le da miedo, qué está pasando en casa. El modelo no improvisa sobre la marcha: se apoya en un marco de criterios clínicos y pedagógicos para decidir cómo abordar cada situación, y luego lo reescribe todo en prosa. Visto de golpe, lo que teníamos en la base de datos era el diario emocional de un montón de menores. El RGPD lo trata como categoría especialmente protegida. El sentido común, también. ¿Y si se filtra la base de datos? ¿Y un backup mal guardado? ¿Y un acceso indebido con privilegios de admin? Relájate —bueno, primero asústate un poco; luego relájate—. Te voy a contar cómo pensamos el cifrado en reposo en serio: una arquitectura de tipo envelope encryption , con una clave maestra que no sale nunca de Cloud KMS (Google Cloud) y una clave por usuario que cifra los campos sensibles antes de que toquen la base de datos. Un aviso antes de seguir: te cuento el criterio y las decisiones, no el plano. No vas a encontrar aquí nombres de recursos, rutas de repositorio, ni el detalle exacto que le serviría de receta a alguien con ganas de probar suerte con nuestros datos. Y porque la seguridad honesta se cuenta entera, también te cuento dónde decidimos no llegar y por qué. ✨ Promesa: al terminar vas a entender, con criterio real de producto, cómo una familia sin ser expertos en cripto se planteó cifrar datos de menores — y por qué ciertas decisiones muy concretas no se hacen públicas nunca, ni en el artículo más honesto. El mapa Lo constru

Overview The box ships a mostly-stock WordPress 7.0.0 install on PHP 8.2 / Apache, running on a Debian Trixie base image, packaged as a Docker/Kubernetes challenge deployment. Initial access comes through a deliberately vulnerable plugin ( wp2shell ) that hands over a www-data shell. Privilege escalation is the real puzzle: the box is hardened against the usual container-escape and SUID tricks, and the intended path is a real, recent CVE in sudo itself. Recon The challenge source was distributed as a zip ( boot2root_wordpressed-to-root.zip ) containing the Docker build context: . ├── docker │ ├── entrypoint.sh │ ├── install.php │ └── seed.php ├── docker-compose.yml ├── Dockerfile └── theme └── brunnerne-docs ├── footer.php ├── functions.php ├── header.php ├── index.php └── style.css Dockerfile pins the interesting versions: FROM wordpress:7.0.0-php8.2-apache@sha256:0b6e5bf0ed2518696a34ba3812370743b0ad3e2676882967ff5c712e51425c03 AS wordpress-source FROM debian:trixie-20240408-slim@sha256:70955dce615f114142818e95339f6ae9b461cf424d79d59ca2b04ec725d4dbc8 ... apache2 ca-certificates curl gcc libc6-dev libapache2-mod-php8.2 \ php8.2 php8.2-curl php8.2-gd php8.2-mbstring php8.2-mysql php8.2-xml php8.2-zip sudo Two details stand out immediately: gcc and libc6-dev are installed in the runtime image, not just a build stage. That is a strong hint that compiling a local privilege-escalation PoC on-box is part of the intended path. sudo is installed, which combined with the previous point points straight at a sudo local-root bug rather than a container escape. docker-compose.yml also leaks the DB credentials up front (default WordPress dev creds - not the actual privesc path, but useful context): MARIADB_DATABASE : wordpress MARIADB_USER : wordpress MARIADB_PASSWORD : wordpress MARIADB_ROOT_PASSWORD : rootpassword docker/entrypoint.sh is the key file for understanding the box's behavior at runtime. On first boot it generates a random WordPress admin account and exports the cred

If you’ve ever built an Express API, you’ve probably reached for standard rate-limiting middleware to protect your login or payment endpoints from DDoS and brute-force attacks. Under the hood, most simple limiters use a Fixed-Window Counter . It’s easy to write: count incoming requests, and once the minute rolls over, reset the counter to zero. However, from a security and algorithmic standpoint, Fixed-Window counters have a massive blind spot. The Boundary Vulnerability (The 2-Second Spike) Imagine your endpoint allows a maximum of 100 requests per minute , resetting every full minute on the clock ( :00 ). Here is how an attacker bypasses that limit without breaking your rules: At 12:00:59 , the attacker fires 100 requests. (Allowed: 100/100 used). At 12:01:00 , the clock resets your counter back to 0. At 12:01:01 , the attacker fires another 100 requests. (Allowed: 100/100 used). To your server code, everything looks fine. But in reality, 200 requests slammed your backend within a 2-second window. In FinTech or authentication systems, that burst is more than enough to overwhelm payment gateways or run a successful credential-stuffing attack. The Algorithmic Fix: Sliding Window Counter To stop boundary spikes, we need a continuously sliding window rather than a rigid clock reset. Attempt 1: The Sliding Window Log (High Memory) You store a timestamps array (a Deque) for every user request and drop timestamps older than 60 seconds. While accurate, storing every single request timestamp takes $O(N)$ space. If your API receives millions of requests, your server memory dies instantly. Attempt 2: Sliding Window Counter (Optimal O(1) Math) Instead of keeping thousands of timestamps, we track only two integers : the request count of the previous window and the count of the current window . When a request arrives, we calculate an estimated request count by weighting the previous window based on how much time has passed in the current window: Estimated Requests = Current Cou

Security researcher Christopher Domas developed skitter-creek-bath-salts, an open-source hardware security tool that disrupts CPU privilege boundaries by manipulating memory controller translation registers. This allows unprivileged software to access protected memory regions, revealing a vulnerability in modern processor architectures that could affect cloud and confidential computing security. By Olimpiu Pop

mcp-drift-monitor detecta cambios no autorizados en servidores MCP (Model Context Protocol). Implementa el control primario faltante descrito en arXiv:2608.00997 : un barrido completo periódico del catálogo que re-descarga todos los servidores y recomputa hashes. Problema arXiv:2608.00997 ( MCP Registry Drift: A 88.6-Day Measurement of 19,099 Servers ) reporta un punto ciego crítico: los enfoques tradicionales de detección de cambios fallan en identificar dos modos de fallo: Cambios silenciosos — un servidor cuyo hash de descripción cambia, pero el monitor ya lo conocía y lo rankinga por historial pasado. Nuevas adiciones — servidores que aparecen en el registro sin que el monitor tenga registro previo. El paper mide 15,845 eventos de cambio, 19,877 adiciones y 911 eliminaciones, pero los modelos que rankean por historial previo pierden una fracción significativa de estos eventos. Este monitor cierra esa brecha con el control primario que el paper propone pero no implementa: un full-catalog sweep periódico. Solución mcp-drift-monitor implementa un motor de diferencias único ( compute_events ) que sirve tanto para polling incremental como para barridos completos. No hay lógica duplicada. Cada vez que un hash de descripción cambia, el motor revalida el contenido ( len(drifts) > 0 es el único disparador). Si el registro responde 429, aplica backoff con Retry-After . Si el payload está malformado, lanza SchemaDriftError y registra el payload ofensor a nivel ERROR. Arquitectura core/ diff.py — CatalogEntry, DriftEvent, NewArrivalEvent, RemovalEvent, compute_events hasher.py — normalize_description (NFC), hash_description state.py — StateStore (sqlite), FetchStatus, removed flag, get_all_hashes poller.py — Poller.fetch_catalog, PollConfig, SchemaDriftError, backoff sweep.py — run_sweep (control primario), SweepReport calibrate.py — replay (FR-6), ReplayReport, external validity vs panel Resultados de calibración El monitor se calibró y verificó contra el panel real del pa

A new study finds leading AI labs have few publicly documented plans for containing rogue models, raising questions about preparedness as AI systems increasingly demonstrate unexpected and potentially dangerous behavior.

Your prompt can ask a model what it is. Your production system should not trust the answer. A model can say it is GPT, Claude, Gemini, Llama, Qwen, or anything else. That does not prove what is behind the endpoint. A gateway can route requests silently. A provider can change a default model. A fallback can trigger during an outage. A proxy can strip metadata. A fine-tune can imitate another model's tone. Even honest teams can ship the wrong route because an environment variable, tenant flag, or retry rule changed. For a casual chatbot, that might be annoying. For an AI product with user-facing answers, tool calls, cost controls, compliance promises, and eval gates, it is a production risk. That is where LLM model fingerprinting helps. The goal is not to magically identify every model on earth. The goal is simpler and more useful: build a small verification harness that checks whether the endpoint behaves like the model, runtime, and policy you expected before you trust it with customer workflows. Why model identity became a production problem AI builders used to call one model directly. Now a typical stack may include: an LLM gateway model routing by task type cheaper fallback models regional endpoints self-hosted open-weight models vendor proxies MCP tools RAG pipelines structured output validation tenant-specific policies That flexibility is useful, but it creates a new question: How do you know the model you evaluated is the model your users are getting? A label in a config file is not enough. A response that says, "I am Model X," is not enough. Prompt-based identification is weak because model behavior is flexible. System prompts, fine-tunes, wrappers, and style instructions can change how a model describes itself. Infrastructure artifacts are harder to fake. Token counts, chat-template overhead, validation errors, context limits, stream behavior, tool-call formatting, and latency profiles tend to reveal the serving path more reliably than conversational claims.

A webpage that just sits there, encrypted blob and all, waiting for an LLM agent to walk in and decrypt its own attack. That's the part of this one that should bother you more than the exfiltration itself. What happened Researchers at Adversa AI disclosed an attack technique called Cryptographic Context Injection, aimed at Grok, with a similar jailbreak variant shown against Gemini. The core idea: a malicious webpage embeds an encrypted payload. Grok's code execution runtime decrypts it as part of normal processing. Because the malicious instructions only exist in plaintext after decryption happens inside the execution environment, content classifiers scanning the page (or the request) never see anything to flag. There's no suspicious string sitting in the DOM. There's ciphertext. Once decrypted, the payload's instructions convince Grok to invoke its navigation tool and send the user's name, location, subscription tier, and chat history to an attacker-controlled URL. No malware. No exploit in the traditional sense. Just an agent doing exactly what it was told, by a source it had no business trusting. The write-up has zero HN points and zero comments as I write this, which is a little concerning given what it describes. This isn't a theoretical edge case, it's a working technique against a production model with tool-calling access to a browser. How the attack actually works Break it into three stages: Delivery. The victim's browser session includes an agent (Grok) with code execution and navigation tool access. The attacker doesn't need to compromise anything, they just need the agent to encounter their page. Decryption as obfuscation. The payload sits on the page encrypted. Grok's runtime, doing what it's built to do, decrypts it during execution. This is the clever part: encryption here isn't protecting the payload from the attacker, it's protecting it from the defender's classifiers. Static and even semantic content filters scanning page content pre-execution see

A router, an IP camera, an industrial controller: somewhere in that device's firmware there's a Linux kernel with modules, a handful of statically linked binaries, and a userspace built from a dozen open source components. You don't have the vendor's source tree. What you have is a .bin file, or after unpacking it, a pile of .ko , .o and stripped ELF binaries. The question you actually need answered is boring but important: is any of this running something with a known CVE? This comes up constantly in embedded and IoT work, and it's a different problem from auditing your own codebase. You're not hunting for a new bug, you're checking for old ones the vendor never patched. In practice that's the more common finding: not a novel zero-day, but a five-year-old OpenSSL or BusyBox build nobody was tracking. Unpack first, guess later binwalk is still the first move. Point it at the firmware image and let it scan for known magic bytes: SquashFS, CramFS, JFFS2, gzip streams, kernel headers. Most consumer and SOHO firmware is a bootloader plus a compressed filesystem, and binwalk's extraction mode gets you the actual filesystem tree instead of one opaque blob. Once you have that, you're auditing files, not guessing at a blob. Fingerprint by version string, not by hash Hash-matching binaries against known-vulnerable databases sounds appealing and mostly doesn't work here, because vendors relink, strip and sometimes patch without touching anything else. What works more often: grep the extracted binaries for version banners. strings on busybox , openssl , dropbear , lighttpd , zlib and similar userspace binaries usually still leaks a version string even when the binary is stripped of debug symbols, because those strings are compiled-in constants the program itself prints or logs, not debug metadata. strings <binary> | grep -iE "openssl|busybox|dropbear|zlib" is unglamorous and it's the single highest-signal step in this whole process. Cross-reference what you find Once you have