How to Give an Agent a Query Language Instead of a Code Interpreter
A four-step pattern for letting a document agent write validated aggregation pipelines instead of arbitrary code, so results come back shaped and tenancy stays enforced.
Loading…
Topic
Security
181 posts about Security. Every summary links to the original.
- 181 posts
- 30 companies
- 8 explainers
See the idea
Security explainers
Anatomy of a Branded Call: The Trust Chain from Dial to Display
The Branded Calling trust chain, layer by layer: how identity, STIR/SHAKEN attestation, Rich Call Data, and carrier delivery combine so a verified brand name reaches the recipient's screen.
Backdoor Defense Is a Trade-off, Not a Scanner
A model that passes benchmarks can still defect only on a trigger. This explainer maps the trade-off between deeper backdoor verification and the friction, latency, and cost it adds.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
JetBrains Joins the Open Source Security Foundation
JetBrains has joined the Open Source Security Foundation (OpenSSF) as a general member. OpenSSF is a cross-industry Linux Foundation initiative that works to secure the software supply chain, hosting projects like Sigstore for signing and SLSA for supply chain integrity, and its AI/ML Security Working Group publishes guidance on signing ML models and safe instructions for AI code assistants. The foundation announced the membership at OpenSSF Community Day Europe in Prague. JetBrains cites the rise of coding agents and AI as creating new security challenges, making it more important for developers to understand and verify code and dependencies, and notes that its own product JetBrains Air addresses these questions. The company aims to collaborate with the industry through OpenSSF to help shape the future of secure software development, as stated by Katherine Druckman, Head of Community and Partnership Engagement.
My Voice AI Demo Was Hit by a $982 Traffic-Pumping Attack! Here’s What I Learned
A voice AI demo using Twilio Conversation Relay and FastAPI was exploited when automated clients repeatedly called its unauthenticated /api/call endpoint, generating 1,008 requests and 921 outbound calls to Israeli +972229 numbers. The incident cost $971.50 in Twilio voice usage and $10.58 in Google Gemini fees, matching International Revenue Sharing Fraud that keeps calls connected for per-minute revenue. The author used the Twilio CLI to group call records showing 920 of 921 calls targeted the same narrow Israeli range and correlated Azure Log Analytics to confirm the exploited endpoint. Calls were kept alive by automated scripts replaying conversation-extension prompts from only 541 distinct lines across 8,363 transcriptions, with some recordings mentioning happy trafficking. The post recommends authentication, duration limits, geographic permissions, signature validation, usage triggers, and demo isolation as essential controls for public voice AI apps.
Why your non-root container dropped its capabilities (and how to fix it)
A platform engineer traces why a non-root OpenShift container configured with CAP_NET_RAW still fails ping with Operation not permitted. The root cause is that SCC is only an admission-time gate that does not enforce runtime privileges. CRI-O translates the PodSpec into an OCI spec with the capability in the Bounding, Effective, and Permitted sets but deliberately omits ambient capabilities. During the runtime’s UID transition from root to the target non-root user, the kernel clears both Permitted and Effective sets, leaving an empty CapEff. The only mechanism that survives a UID transition for non-root processes is ambient capabilities, which CRI-O intentionally avoids to preserve the Kubernetes assumption that switching to a non-root user drops capabilities. To resolve this, file capabilities can be applied directly to the binary via setcap, avoiding the need for ambient capabilities.
TeamCity 2026.2.1 and 2026.1.5 Are Out
JetBrains has released TeamCity 2026.2.1 and 2026.1.5, two bug-fix updates for the On-Premises versions of TeamCity that address more than 40 security vulnerabilities combined. These updates also resolve specific regressions including TFS projects failing to display diffs, YAML configuration import issues from a main repository branch, and MSBuild tools not being detected after the Visual Studio Build Tools 2026 September update. In addition to the numerous security fixes, these releases deliver performance improvements, better compatibility with integrations, and faster, more stable builds for users. A key compatibility feature allows upgrades or downgrades within the same major version without requiring backup restoration because bug-fix releases share a common data format. Users can upgrade via automatic update within TeamCity, direct download from the JetBrains website, or by pulling the updated Docker image from Docker Hub.
MongoDB Queryable Encryption: Prefix, Suffix, and Substring Queries Are Now GA
MongoDB announced general availability of prefix, suffix, and substring query support in Queryable Encryption, extending beyond equality and range queries to production workloads at no additional cost in Atlas, Enterprise Advanced, and Community Edition. These capabilities enable expressive text searches on encrypted data without decryption, with the database server never seeing plaintext during query processing. The open-source encryption scheme is independently verifiable, works without specialized hardware, and protects data at rest, in transit, and in use. The new query types enable partial-name lookups, autocomplete, and partial-word filtering on encrypted fields via the native query engine, requiring no external indexes or middleware. This helps meet HIPAA, PCI-DSS, and GDPR compliance by protecting data in use — a stage other encryption methods cannot cover — reducing audit gaps and eliminating workarounds.
Auth0 Metadata Explained: user_metadata vs app_metadata
Auth0’s user_metadata and app_metadata define a security boundary: user_metadata is writable by users through the update:current_user_metadata scope, while app_metadata requires privileged scopes available only to confidential clients via the client credentials grant. Post-login Actions reading authorization data like subscription plans or feature flags from user_metadata allow users to escalate privileges by modifying their own metadata, for example setting plan to enterprise and beta_access to true. Writing to app_metadata demands a server-side M2M application with update:users_app_metadata scope, which no public client or user token can obtain. The correct practice is to store access-control data such as roles, tenant membership, and IP allowlists in app_metadata, and non-sensitive preferences like theme or language in user_metadata. A third field, client_metadata, holds application-level properties readable via event.client.metadata in Actions.
MongoDB 9.0: This Is What a Database Should Be
MongoDB 9.0 is the most advanced release in MongoDB’s history, designed to eliminate the tradeoffs that force organizations to add infrastructure, compromise security, or rethink architecture as applications grow. Transactional workloads achieve up to 20% higher throughput compared to 8.0, with find-one queries up to 35% faster and update-one queries up to 30% faster, and large deployments see nearly 2x higher throughput. Queryable Encryption now supports prefix, suffix, and substring queries, enabling partial-match searches on encrypted data throughout its lifecycle. Intelligent Workload Management queues transient traffic spikes during overload to keep clusters responsive, buying time for auto-scaling or operator intervention. The release also includes redesigned Atlas Metrics UI, enhanced OpenTelemetry integration for streaming metrics to platforms like Datadog and Prometheus, and a MongoDB extension for Hibernate ORM to ease modernization.
Follow the thread: a new dashboard to investigate account abuse
Cloudflare’s new Account Abuse Protection dashboard helps fraud teams investigate account abuse by moving beyond stateless identity checks to a stateful trust model. The dashboard uses cryptographically hashed identifiers, called Hashed User IDs, created from customer-provided identifiers like email or username, to anchor account activity across login and signup events. It provides an account population overview with metrics like total events, unique IPs, and devices to spot anomalies such as leaked credential matches or unusual login failure rates, then allows analysts to filter and drill into individual accounts. Each account view shows historical behavioral, network, and device signals, enabling teams to reconstruct events and decide on responses like WAF rules. The dashboard also introduces two new roles—Account Abuse Protection and Account Abuse Protection PII—to enforce least privilege for dashboard access and PII exposure.
Protected Quick Tunnels: simple accountless authentication for your next dev project
Cloudflare’s Quick Tunnels now support email-based access control via the –allowed-mail flag, requiring no account on either side. The feature addresses the risk of exposing sensitive work, especially as AI coding agents increasingly use tunnels to share previews. Cloudflare Access verifies the visitor’s email with a one-time PIN, while cloudflared on the developer’s machine authorizes the request against a local rule list. The guest list never leaves the developer’s machine, and the tunnel remains accountless and free. The feature was built and shipped by two interns, Hugo Vicente and Alessandro Frigerio.
One year later: Sovereign AI and the fight for choice
A year after arguing that AI sovereignty means choice, Cloudflare adds two European open models—EuroLLM and Apertus—to Workers AI, reflecting a year where access to frontier models became constrained and attacks using AI increased. EuroLLM supports 35 languages including all 24 EU official languages, many underserved by existing open models, and was trained on the MareNostrum 5 supercomputer. Apertus, Switzerland’s first fully open multilingual model, was trained on 15 trillion tokens across 1,500+ languages on the Alps supercomputer (10,000+ GH200 GPUs) and outperforms leading models on rare and regional languages. Cloudflare also launches hands-on workshops for government cyber agencies and critical infrastructure operators to build model-agnostic AI security defenses, starting in Singapore in October. The company open-sourced its own security harness that coordinates multiple AI models for vulnerability hunting, ensuring defenses remain operational even if access to one model is lost.
Sidecars: A low-latency trust boundary for Sandboxes
Modal introduces Sidecars, isolated containers that run alongside a main Sandbox on the same host, establishing a trust boundary between trusted and untrusted code. Sidecars enable communication across trust boundaries at least 3x faster than using separate Sandboxes, reducing latency for operation-heavy agent workloads. The feature addresses the security risk of running an agent’s harness and tool calls together, which creates the “lethal trifecta” of private data, untrusted content, and external communication. Existing solutions either move the harness to a remote service (adding network latency) or rely on egress controls that lack flexibility. Sidecars allow trusted services such as credential injection, proxy traffic, and harness logic to run locally alongside the Sandbox, with independent network policies and dynamic creation via the Modal SDK.
The Internet has a second audience
More than half of Internet traffic is now automated, and AI agents are the fastest-growing part of it, with daily requests on Cloudflare’s network growing by more than 1,700% over the past year. This second audience consumes bandwidth without generating ad impressions or subscriptions, causing revenue per request to fall while costs rise. Cloudflare is giving site owners tools to see who is visiting, set terms per bot type, and charge for access. These include AI Crawl Control, Web Bot Auth for cryptographically verified agents, Disallow AI Training to block training without losing search indexing, and Pay Per Use to pay publishers when content is actually used. The goal is to build open standards so any site can set its terms and get paid, rather than a few companies controlling discovery and payment.
Building a post-quantum certificate authority with Merkle Tree Certificates
The Web PKI faces a scaling problem because post-quantum (PQ) signatures are roughly 40 times larger than classical ones, making direct adoption at Internet scale expensive. Merkle Tree Certificates (MTCs) address this by batching certificates into an append-only Merkle tree, allowing a CA to sign the tree root and clients to verify with a compact inclusion proof. Cloudflare is building a certificate authority that will support MTC issuance, targeting early 2027 for inclusion in Chrome’s new Quantum-resistant Root Store, and will offer standard MTC issuance at no cost. The MTC architecture couples issuance with logging (“issue by logging”), making transparency a first-party property rather than an add-on, which reduces redundancy and scaling overhead. Cloudflare successfully completed an experimental deployment with Chrome and is now moving to full production, but notes that broader ecosystem participation from browsers, CAs, and monitors is needed for the transition.
We tested our own WAF with frontier AI models. Here’s what we found
Cloudflare built a WAF tester that uses frontier AI models to iteratively mutate attack payloads based on real-time response feedback. The tester, implemented in Python, orchestrates an LLM proposal and review loop against an authorized customer staging environment protected by Cloudflare’s WAF. It ran 45 scenarios across six attack categories—XSS, SQLi, CMDi, SSRF, path traversal/LFI, and Log4j—starting from known blocked exploits and varying encoding, request placement, or destination representation. The vast majority of 1,107 recorded attempts were blocked; the few non-blocked requests were triaged by humans and used to create new detections that harden security for all Cloudflare customers. The post stresses that a WAF bypass still needs an exploitable application to succeed, so patching software remains essential, and suggests combining Managed Rules, Attack Signature Detection, and positive security controls for defense in depth.
Preventing quantum downgrade attacks against IPsec
Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.
Integrating Claude Code with Auth0 APIs
This tutorial explains how to integrate Claude Code with Auth0’s Management API using the Auth0 MCP Server, enabling AI-driven authentication configuration management from the terminal. The setup uses the OAuth 2.0 Device Authorization Flow to obtain scoped access tokens stored in the OS keychain, avoiding static secrets that risk exposure in source control. Developers initialize the MCP server with explicit scopes like read:clients or update:actions, then register it with Claude Code via the claude mcp add command, with credentials never stored in plain text. A CLAUDE.md file provides project context and constraints, guiding the agent to respect environment-specific configurations and security policies such as never modifying production callback URLs without confirmation. The tutorial demonstrates refactoring JWT validation code in a single terminal session, with human-in-the-loop confirmation ensuring safe agentic changes and all auth-critical paths undergoing manual PR review.
NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring
The post compares early internet security—where browser sandboxing isolated pages—to the current need for trust layers in AI agents, citing incidents where agents escaped evaluation environments and misreported actions. NVIDIA introduces OpenShell, an open-source secure runtime that sandboxes each agent with kernel-level isolation and enforces verifiable policies defined by operators before and during execution. The platform follows five core principles, including out-of-band enforcement, controlling the path to the model as a kill switch, and scaling agent authority with reasoning visibility, to prevent agent drift. For hardware-level protection, NVIDIA Sentry extends monitoring into BlueField DPUs, which sit on the node’s only path to the model, providing continuous out-of-band observability and real-time policy enforcement at line speed. The architecture is optimized for NVIDIA Vera CPU and BlueField DPU systems, enabling fleet-wide agent security with full lineage tracking, and for existing Vera systems, enabling protections is just a software update.
Add Runtime Controls to AI Agents with NVIDIA OpenShell
AI agents with broad access to systems and data can cause failures like modifying production data or exposing secrets. NVIDIA OpenShell 0.1.0 is an open-source runtime that enforces permissions outside the agent workload using sandboxed execution, controlled service access, credential management, and formal policy analysis. It combines a Gateway for lifecycle management, a Supervisor that checks outbound requests against policy, and a Sandbox with kernel-level filesystem and process controls and no network path except through the supervisor. The supervisor inspects HTTP, GraphQL, and MCP traffic to allow reads while blocking writes on the same API, and real credentials are kept outside the agent workload and bound to authorized endpoints. OpenShell supports multi-tenant platforms, formal policy verification that can prove permissions remain within boundaries, and policy advisor for dynamic network changes, and is adopted by Cadence, Slack, and Gecko Robotics for chip design, enterprise automation, and physical AI.
Managing edge solutions with Red Hat: A layered approach
Managing edge infrastructure at scale across hundreds of locations demands consistent management rather than disparate tools. Red Hat’s layered approach organizes tools into three compartments: a universal foundation, OS-level fleet management for RHEL, and Kubernetes lifecycle management for OpenShift. The universal layer includes Ansible for agentless automation, Quay for container image registry with geo-replication, Lightspeed for proactive drift detection and compliance, and Trusted Software Supply Chain for end-to-end security. For RHEL-based edges, Edge Manager provides SaaS fleet management with OTA updates while Satellite offers on-premise content management for air-gapped environments. For OpenShift-based edges, Advanced Cluster Management handles cluster lifecycle and zero-touch provisioning while Advanced Cluster Security enforces container security across the fleet.
Agents can now set up your website’s security with Turnstile Spin
Cloudflare launched Turnstile Spin, an agent-mediated implementation of its Turnstile CAPTCHA alternative that AI coding agents use to set up security on any website. The two-step Turnstile flow requires a frontend widget and a backend Siteverify call, but many sites skip the backend validation, leaving them exposed to bots. Spin uses the user’s AI coding agent to find frontend and backend code, propose a plan, and after approval automatically embed the widget and wire up the Siteverify call without sending code to Cloudflare. It also fixes improperly installed widgets detected by monitoring Siteverify calls and handles migrations from other CAPTCHA providers. Since its July release over 65,000 widgets have been created via Spin and the generated prompt has been copied more than 30,000 times, and the service remains free.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.