HomeAI · summaries
Storia in 4 fonti
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It
AI Now’s Friendly Fire PoC shows Claude Code and Codex running README-planted payloads on hosts when autonomous command approval is enabled.
Confronto fonti
4 prospettive sulla stessa storiaTimeline cronologica
- ·
thehackernews.com
SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing
Learn how malicious AI agent skills easily bypass static scanners. Discover how runtime checking secures tools like Claude Code and OpenClaw.
- ·
theregister.com
Bug in top AI coding agents shows that Unix-era security headaches never really die
'GhostApproval' problem highlights human-in-the-loop fails
- ·
thenextweb.com
GhostApproval bug breaks 6 top AI coding agents
Wiz's 'GhostApproval' uses an old symlink trick to make six AI coding agents, from Amazon Q to Cursor, write outside the sandbox and hand over the box.
- ·
AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
Sophos says Claude Code, Cursor, and Codex triggered Windows endpoint rules for credential access, LOLBin downloads, and persistence.
- ·
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents
Wiz says GhostApproval abuses symlinks so AI coding agents write to SSH keys or shell startup files while showing benign paths.
- ·
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It
AI Now’s Friendly Fire PoC shows Claude Code and Codex running README-planted payloads on hosts when autonomous command approval is enabled.
- ·
securityweek.com
AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique
Several AI coding assistants were tricked into facilitating developer machine hacking via an attack technique that has been known for decades.