---
title: "Security"
description: "181 posts about Security, summarised, each linking to the original."
---

# Security
> 181 posts about Security, summarised, each linking to the original.

## Articles

### [Stop Building MFA from Scratch (And What to Do Instead)](https://yomu.fyi/post/stop-building-mfa-from-scratch-and-what-to-do-instead.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Alisha Tingle
- Published: Sep 25, 2026
- Type: Explainer

Building multi-factor authentication (MFA) in-house is a much larger project than teams expect, requiring authenticator app integration, QR code generation, secure backup recovery codes, and edge cases like lost phones. Auth0 positions its MFA offerings as a way to offload that work so developers can focus on core product features. The company’s paid plans include MFA directly, with Pro MFA covering standard authenticator apps in B2C and B2B Essentials plans. Enterprise MFA adds WebAuthn, push notifications, SMS, and voice, available as an add-on to B2B Essentials or included in Professional tiers. Auth0 argues that using its MFA helps teams pass compliance, unblock enterprise deals, and avoid weeks of building login infrastructure.


### [From Dockerfile to Kit: the Docker Sandboxes Kit Specification](https://yomu.fyi/post/from-dockerfile-to-kit-the-docker-sandboxes-kit-specification.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jin Kim
- Published: Sep 24, 2026
- Type: Announcement

The Docker Sandbox Kit Specification v3 defines how an agent declares the networks, credentials, and volumes it needs, so these grants travel with the artifact rather than living in shell history or dashboards. A Kit is an ordinary OCI image whose manifest carries a descriptor annotation vnd.docker.sandbox.kit.descriptor, so it builds with docker buildx, pulls with docker pull, and gets scanned and signed by existing tooling. Capability types like network-policy@2 and credential@1 are versioned independently, and each normative statement in the specification is covered by a conformance check or a written waiver. Two Kit types exist: a workload supplies the root filesystem, while a mixin adds overlays such as a CLI with its network rule; the runtime rejects required capabilities it cannot satisfy. Composition uses strict provides/requires resolution, so authority changes appear as diffs, and a conforming runtime can gate upgrades that widen the grant set.


### [How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers](https://yomu.fyi/post/how-cloudflare-addressed-a-cross-tenant-data-exposure-vulnerability-in.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Hrushikesh Deshpande
- Published: Sep 24, 2026
- Type: Incident / postmortem

Security researcher Oren Yomtov reported a vulnerability in Cloudflare Containers and Sandboxes through the bug bounty program, demonstrating that a Workers Paid account could recover residual disk blocks from previous containers on the same host. The issue arose from Linux device mapper thin provisioning with skip\_block\_zeroing enabled, which left unzeroed 64 KiB blocks when a 4 KiB write triggered allocation, allowing the remaining 60 KiB to retain prior data. Researchers recovered directory structures, database pages, and structurally complete SQLite databases from 18 of 24 placements across four continents, using ext4 checksums to distinguish foreign blocks. Cloudflare removed skip\_block\_zeroing, retired all running container disks, and cleared cached image snapshots created before the mitigation, completing cleanup by September 19. Retained disk-I/O telemetry showed no evidence of malicious exploitation, and the researchers confirmed secure deletion of recovered data.


### [Self-encrypting VM images for confidential environments hands on](https://yomu.fyi/post/self-encrypting-vm-images-for-confidential-environments-hands-on.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Vitaly Kuznetsov
- Published: Sep 24, 2026
- Type: Tutorial

Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect runtime data but leave persistent storage protection to the guest OS. This article demonstrates a method using Fedora Rawhide that combines dm-verity integrity for the immutable base image with a dm-crypt encrypted overlay for mutable parts. The base /usr partition remains verity-protected, while on first boot systemd-repart creates an encrypted root partition with a key sealed to the virtual TPM, ensuring each VM gets a unique key. An overlay filesystem mounts the immutable base under the writable overlay, avoiding a full copy of the base image and reducing boot time significantly in cloud environments. The article also outlines current limitations, including the lack of proof of origin for the overlay partition and the absence of integrity or replay attack protection.


### [How I built agent-based security reviews on Databricks](https://yomu.fyi/post/how-i-built-agent-based-security-reviews-on-databricks.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Angel De Leon
- Published: Sep 24, 2026
- Type: Problem & solution

Security reviews at Databricks relied on automation but still consumed expert time on predictable work, leaving less room for genuinely novel, high-risk architectures. The author built an agent-based layer on Databricks using Unity Catalog for governed tables containing standards, request data, and decisions; Databricks-hosted foundation models (Claude Haiku, Sonnet, Opus) for classification and reasoning; and Lakeflow Jobs for orchestrating notebook-based workflows on serverless compute. A conversational intake app built with Databricks Apps turns plain-language descriptions into structured requests and provides preliminary risk indications before a formal request is created. Seven focused agents each have a bounded responsibility—intake, risk assessment, requirements, specialized reviews, validation, workflow, and learning—ensuring behavior remains inspectable and testable. Routine requests that once waited days in the queue can now be completed in minutes, and security engineers spend more time on designs requiring genuine expertise.


### [ClickHouse release 26.9](https://yomu.fyi/post/clickhouse-release-26-9.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Sep 23, 2026
- Type: Announcement

ClickHouse 26.9 ships with 56 new features, 135 performance optimizations, and 464 bug fixes. Among the highlights are conditional LIMIT boundaries that control output based on ordered stream values, incremental refreshes for append-only materialized views, and disk spilling for high-cardinality DISTINCT queries that automatically spills when memory usage reaches half the limit. The CREATE TOKEN feature issues time-limited credentials with a default lifetime of 30 minutes and restricted privileges, reducing the impact of leaked keys. Arithmetic operations between DateTime and Time types now support configurable overflow behaviors—throw, saturate, or ignore. PromQL support expands in a private preview on ClickHouse Cloud, bracket syntax simplifies JSON subcolumn access, and queries for min, max, and count receive performance improvements.


### [Rollouts and Security Review](https://yomu.fyi/post/rollouts-and-security-review.md)
- Company: [Cursor](https://yomu.fyi/company/cursor.md)
- Published: Sep 23, 2026
- Type: Announcement

Cursor launched two bots for the last mile of shipping code: Rollouts and Security Review. Rollouts watches every change as it deploys and reports health per environment, with verdicts of verified healthy, regression detected, or inconclusive. It reads the diff and systems a pull request touches, writes a monitoring plan as a PR comment, and tracks deploy events per environment. Security Review reads every pull request in the context of the codebase and posts one review comment reporting exploitable bugs, including injection, authentication bypasses, and secrets. Both bots are available today on Teams and Enterprise plans, with usage credits for the next 10 days.


### [Confused Deputy: The Old Bug That AI Agents Keep Reintroducing](https://yomu.fyi/post/confused-deputy-the-old-bug-that-ai-agents-keep-reintroducing.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Andrea Chiarelli
- Published: Sep 22, 2026
- Type: Explainer

The Confused Deputy problem, first documented in 1988, describes a program with legitimate authority being tricked into misusing that authority on behalf of a less-privileged actor. AI agents are particularly vulnerable because they process instructions and untrusted content through the same natural-language channel, making prompt injection straightforward. The post traces this pattern through CSRF, SSRF, and recent attacks like Clinejection, where an issue-triage bot executed an attacker-supplied command from a crafted issue title. That attack led to a poisoned GitHub Actions cache and a compromised npm package downloaded 4,000 times. The fix involves task-scoped short-lived credentials, capability-scoped permissions, credential isolation from the model, and human-in-the-loop approval for high-risk actions.


### [Data Sovereignty by Design: Five Practical Evaluation Lenses for IT Leaders](https://yomu.fyi/post/data-sovereignty-by-design-five-practical-evaluation-lenses-for-it-lea.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Sep 22, 2026
- Type: Explainer

Data sovereignty is a market expression, not a universal legal standard, and IT leaders should evaluate it through architecture and governance questions rather than a single label. The assessment covers where data resides, who can access it, how it moves, and whether control is retained, with considerations varying by jurisdiction, industry, and risk posture. Physical location is only one part of a broader control boundary that includes operations, key custody, and access paths. The article proposes five technical lenses for evaluation: jurisdiction-native data placement, in-use encryption, customer-held keys, network isolation and identity-based access, and forensic-grade audit evidence. These lenses are practical reference points for architecture decisions, not a legal test or certification checklist, and organizations should assess their own requirements with qualified counsel.


### [Building Secure AI Agents with Microsoft Agent Framework and Auth0: Human-in-the-Loop Approval](https://yomu.fyi/post/building-secure-ai-agents-with-microsoft-agent-framework-and-auth0-hum.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Andrea Chiarelli
- Published: Sep 21, 2026
- Type: Tutorial

The post details how to add secure human-in-the-loop approval to an AI expense agent built with Microsoft Agent Framework and Auth0, completing the four-part series that handles identity, authorization, and action. Because approval is a security-sensitive action requiring the same cryptographic rigor as any authentication event, the agent uses Client-Initiated Backchannel Authentication (CIBA) to push a notification to the manager’s phone instead of accepting chat input. The notification includes a binding message describing the expense by ID, amount, vendor, and context, giving the manager enough information to decide from a lock screen. The agent polls Auth0’s token endpoint until the manager approves or denies, then uses the CIBA-issued access token scoped with approve:expenses to record the decision on a separate Expense API. This design ensures approval decisions are cryptographically bound to the manager’s identity and verifiable by downstream services, completing the secure loop.


### [ReadyOn’s Four Walls of tenant isolation on Amazon EKS](https://yomu.fyi/post/readyon-s-four-walls-of-tenant-isolation-on-amazon-eks.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Roshan Daneshvaran
- Published: Sep 18, 2026
- Type: Explainer

ReadyOn describes a four-layer tenant-isolation architecture for Harmony, its multi-tenant workforce-intelligence platform on Amazon EKS, which handles payroll data, organizational hierarchies, and operational analytics. The design combines dedicated Kubernetes namespaces, Karpenter-managed tenant node pools, per-tenant Amazon VPC security groups, and dedicated Amazon Aurora databases, with RBAC, admission control, default-deny network policies, IAM Roles for Service Accounts, and tenant-scoped secrets. GitOps through Argo CD ApplicationSets provisions identical controls and continuously reverts drift, while dual taints and admission validation prevent cross-tenant scheduling. ReadyOn says adversarial exercises have blocked all six tested cross-tenant paths to date, and reports defenses across 10 threat-model stages, though shared control-plane dependencies make the layers defense in depth rather than fully independent probabilities.


### [Enabling secure, productive work on personal devices](https://yomu.fyi/post/enabling-secure-productive-work-on-personal-devices.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Steven Angle, Brian Schaffner
- Published: Sep 18, 2026
- Type: Explainer

Personal devices let employees use Slack, approve requests, and access internal apps, but they combine corporate data with private content that Databricks cannot inspect or control. The proposed mobile security model layers Mobile Device Management (MDM), identity and context-aware authentication, Zero Trust Network Access (ZTNA), and application management. On iOS, Account-Driven User Enrollment creates an encrypted workspace without full device management, while Android Work Profile provides comparable separation; per-app VPN keeps work traffic apart from personal traffic. Access requires strong authentication, a managed device, and a trusted tunnel, with continuous posture checks able to block unhealthy devices. Managed apps, configurations, tenant controls, and sensitivity tiers contain data where supported, while transparency about privacy encourages enrollment and supports mobile apps such as Genie.


### [Building the future of security with NAB with Lakewatch](https://yomu.fyi/post/building-the-future-of-security-with-nab-with-lakewatch.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Taylor Kain
- Published: Sep 18, 2026
- Type: Announcement

National Australia Bank (NAB) is working with Databricks as one of five design partners for Lakewatch, an Open Security Lakehouse intended for modern security operations. NAB, part of Australia’s critical infrastructure, ingests more than 30TB of security data daily while confronting AI-enabled threats, expanding digital services, and growing third-party integrations. The partnership brings NAB’s threat-informed cyber-defense experience to a platform designed to unify signals across environments, apply advanced analytics and AI-driven workflows, generate higher-confidence insights, and automate response actions. Lakewatch is presented as an open, composable, AI-native foundation built natively on the Lakehouse for organizations facing constantly evolving threats, supporting enterprise-wide correlation, proactive threat hunting, detection, monitoring, and response at scale.


### [Databricks Announces Lakewatch: New, Agentic SIEM](https://yomu.fyi/post/databricks-announces-lakewatch-new-agentic-siem.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Reynold Xin, Andrew Krioukov, Molly Limaye, Taylor Kain, Keegan Dubbs
- Published: Sep 18, 2026
- Type: Announcement

Databricks announces Lakewatch, an agentic SIEM intended to help organizations defend against increasingly sophisticated, AI-driven attackers. Launching in Private Preview, it unifies security, IT, and business data in a governed lakehouse built on Unity Catalog, while supporting open OCSF formats and storage in customer-controlled cloud object stores. Lakeflow Connect ingests and normalizes major security sources, and Detection-as-Code lets teams define YAML rules with SQL queries or Python notebooks, backtest them against historical data, and deploy through CI/CD. Genie Code and Genie Spaces provide AI-assisted ingestion, detection authoring, rule refinement, investigation, and natural-language threat hunting, while custom models can support anomaly detection, behavioral analytics, and entity risk scoring. The announcement also introduces an Open Security Lakehouse Ecosystem and acquisitions of Antimatter and SiftD.ai; Lakewatch is available in Private Preview, with Adobe and Dropbox among the named customers.


### [Introducing the Life Sciences Verification Program](https://yomu.fyi/post/introducing-the-life-sciences-verification-program.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Published: Sep 17, 2026
- Type: Announcement

The Life Sciences Verification Program (LSVP) opens beta access to Mythos, Opus, and Sonnet models for verified life science teams whose work may be blocked by generally available Fable models. Applicants undergo review of research credentials, security standards, and ethical oversight, then may receive annual Standard Use grants or six-month, project-specific High-risk Use grants. Standard Use employs more permissive biology classifiers across research, clinical, manufacturing, and other workflows, while High-risk Use removes life-science safeguards for specifically vetted projects; cyber safeguards remain. The program shifts enforcement from request-level blocking to offline monitoring of behavioral patterns, requiring 30-day retention of flagged-activity data, compartmentalized from training and life sciences research teams. Access is available through API, Claude Science, Claude.ai, Claude Code, and Enterprise or Team plans, but not individual plans, third-party platforms, or BAA-enabled organizations during beta.


### [Preventing Destructive Actions with Step-up Authentication](https://yomu.fyi/post/preventing-destructive-actions-with-step-up-authentication.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Jessica Temporal
- Published: Sep 17, 2026
- Type: Tutorial

The Agentic Arcade’s admin panel adds an admin-only “reset all scores” action to prevent a long-lived or stolen admin session from wiping every player’s history. It combines the arcade-admin role with step-up MFA, requiring a recognized MFA signal and auth\_time or iat within five minutes. A shared helper checks amr, acr, or a tenant claim; buildMfaStepUpUrl uses acr\_values and can add max\_age=0, while mfa.challengeWithPopup() opens MFA before the reset request. A beforeSessionSaved hook preserves claims filtered by the Auth0 Next.js SDK, and the API enforces session, role, and freshness gates before clearing scores; cancelled or blocked popups stop the request.


### [When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts](https://yomu.fyi/post/when-scanners-miss-the-attack-how-cloudflare-client-side-security-prot.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Juan Miguel Cejuela
- Published: Sep 16, 2026
- Type: Explainer

Modern storefronts can appear healthy while malicious JavaScript diverts affiliate credit, hijacks searches or clicks, tampers with analytics, or loads further code. Cloudflare describes four operations spanning eight payloads that Page Shield ML detected in live traffic; humans verified the findings afterward, while seven payloads were absent from VirusTotal and none received a malicious verdict from URLScan. The detection system represents JavaScript as a graph with a graph neural network (GNN), sends fewer than 0.3% of analyzed scripts to a lightweight LLM on Workers AI, and uses a teacher cohort of frontier models for difficult investigations. This combination handles minification, renaming, some obfuscation, and behavior gated by device, time, geography, referrer, browser state, or cooldowns. The post concludes that continuous browser visibility and runtime context are needed because static, one-time scans can miss selectively executed attacks.


### [Constraining AI agents with Red Hat AI: Containment, identity, and governance](https://yomu.fyi/post/constraining-ai-agents-with-red-hat-ai-containment-identity-and-govern.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Grace Ableidinger
- Published: Sep 16, 2026
- Type: Tutorial

AI agents running on laptops or clusters may inherit broad filesystem, network, and credential access, making faulty permissions or prompt injection potential security risks. The guide uses Red Hat OpenShift to build layered controls around an OpenClaw agent: namespace isolation, default-deny network policy, ResourceQuota, and optional Kata Containers contain workloads and limit escape or resource abuse. SPIFFE and SPIRE issue rotating SVIDs based on workload attributes such as namespace and ServiceAccount, allowing services to verify an agent without shared secrets. Governance adds OPA Gatekeeper admission policies, an MCP Gateway with risk-tiered tool authorization, NeMo Guardrails for prompt and completion filtering, and MLflow traces for auditability. The recommended rollout starts with namespace isolation and quotas, then adds sandboxing, identity, and the more involved governance controls.


### [Agent Anomaly Detection, now in Private Preview on the Gemini Enterprise Agent Platform](https://yomu.fyi/post/agent-anomaly-detection-now-in-private-preview-on-the-gemini-enterpris.md)
- Company: [Google](https://yomu.fyi/company/google.md)
- Author: Achuth Narayan Rajagopal
- Published: Sep 16, 2026
- Type: Announcement

Agent Anomaly Detection is a reasoning-based oversight and audit layer for autonomous agents on the Gemini Enterprise Agent Platform, now in Private Preview. It analyzes existing reasoning traces, tool calls, execution flow, logs, and OpenTelemetry traces asynchronously, using a lightweight statistical pass followed by deeper LLM-based examination of flagged sessions. Its initial detectors cover tool misuse, identity and privilege abuse, cascading failures, rogue agents, resource exhaustion, and token usage escalation, with findings assigned severity, probability, explanations, and recommended fixes and surfaced in Security Command Center. In the Inventory Agent example, repeated large-batch, offset-jumping list\_inventory calls are classified as systematic scraping and produce a Critical resource-exhaustion finding at 95% probability; an API can let ADK callbacks or plugins block later actions. Custom business logic detectors are described as coming soon.


### [Give every teammate and agent the right level of access to your Workers](https://yomu.fyi/post/give-every-teammate-and-agent-the-right-level-of-access-to-your-worker.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Dina Kozlov
- Published: Sep 15, 2026
- Type: Announcement

Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV.


[Newer posts](https://yomu.fyi/topic/security/page/2.md) · [Older posts](https://yomu.fyi/topic/security/page/4.md)