MOST POPULAR
all tags
other
Agentic AI Security: Credentials and Permissions Define the Blast Radius
In July 2026, researchers at Noma Labs coaxed GitHub's new Agentic Workflows into leaking data from a private repository. It wasn’t from malware. They created a plausible-looking issue in a public repository containing instructions for the agent to retrieve information
Machine-Speed Credential Abuse: What the ChainDrop npm Worm Changes
ChainDrop hijacked 444 npm packages and 2B monthly downloads via a Claude Code hook. AI agents have collapsed the gap between credential theft and abuse
Why Secrets Slip Through Every Layer of Your Security Stack
Your security stack is a set of specialists, each guarding one territory. Exposed credentials don't respect the boundaries between them, and 64% of the ones found valid in 2022 were still valid four years later.
Inside the LiteLLM hack: 153GB, 433,909 Files, 2,488 Organizations
Attackers dumped everything they harvested from LiteLLM builds during a 40-minute window in March. Here is what is inside and what it says about where secrets live.
BSides Las Vegas 2026: Following the Trust Relationships Attackers Are Targeting
BSidesLV 2026 presenters showed how attackers are increasingly exploiting valid trust relationships instead of breaking through the front door, and what we need to do about it.
Your AI Agents Are Using Your Credentials
AI agent security is an identity problem, but it often starts as a secrets and credential problem. Do your AI agents operate using static API keys, tokens, and other reusable credentials? They might bypass traditional identity controls, creating a governance blind spot.
Vault Coverage Is the Missing Metric in NHI Programs
Most vault programs track a numerator without a denominator. See how vault coverage turns secrets management into a measurable, reportable control.
Mini Shai-Hulud's Latest Wave: 280 New Places It Hunts for Your Secrets
A new Mini Shai-Hulud wave hit keyv and 800+ npm packages. The malware now scans 469 secret locations, including AI agents, crypto wallets, and CI/CD tools.
40 Million Fake Push: When Spam Commits Took Over The Public GitHub
Millions of fake commits are flooding GitHub's public feed. We followed the trail to a rebranded gambling site hiding behind a defunct lottery brand.
Securing Agentic AI Workflows in n8n: From Leaked API Keys to Encryption Key Compromise
A leaked n8n API key is only the start. GitGuardian's research traces the full chain, from exposed tokens and weak keys to CVE-2026-25053 and the N8N_ENCRYPTION_KEY that protects every stored credential, then lays out a hardened configuration to break it.
Credential Harvesting Explained: How Attackers Collect Secrets From Developer Machines
Credential harvesting is how attackers collect valid secrets at scale. See how it works, why developer machines are a prime target, and how to find them first.
What Was on This Machine? Answering the Blast Radius Question After a Laptop Compromise
After a laptop compromise, the hard question is which credentials were on it. See why blast radius scoping is hard, and how to turn it into a revocable list.
