Generative AI

large language models Concept illustration Ai

Application security

AI/ML

Feature

OWASP

LLM vector flaws threaten data security, privacy, and model integrity

Four hackers gather around a computer screen in a still from the movie "Hackers."

hackers-still-mgm

Black Hat

Risk Identification/Classification/Mitigation

Exposure management

News

Black Hat: Sloppy AI defenses take cybersecurity back to the 1990s, researchers say

<body>Maintaining code is a lot more than keeping dependencies up to date. It involved everything from keeping old code running to changing frameworks to even changing implementation languages. Jonathan Schneider talks about the engineering considerations of refactoring and rewriting code, why code maintenance is important to appsec, and how to build confidence that adding automation to a migration results in code that has the same workflows as before.</body>

<body><p>Maintaining code is a lot more than keeping dependencies up to date. It involved everything from keeping old code running to changing frameworks to even changing implementation languages. Jonathan Schneider talks about the engineering considerations of refactoring and rewriting code, why code maintenance is important to appsec, and how to build confidence that adding automation to a migration results in code that has the same workflows as before.</p></body>


<ul class="wp-block-list">
<li><a rel="noopener" target="_blank" href="https://docs.openrewrite.org">https://docs.openrewrite.org</a></li>


<li><a rel="noopener" target="_blank" href="https://github.com/openrewrite">https://github.com/openrewrite</a></li>
</ul>


<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://docs.openrewrite.org">https://docs.openrewrite.org</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/openrewrite">https://github.com/openrewrite</a></li></ul></body>

<body>Then, instead of our usual news segment, we do a deep dive on some recent vulns NVIDIA's Triton Inference Server disclosed by Trail of Bits' Will Vandevanter. Will talks about the thought process and tools that go into identify potential vulns, the analysis in determining whether they're exploitable, and the disclosure process with vendors. He makes the important point that even if something doesn't turn out to be a vuln, there's still benefit to the learning process and gaining experience in seeing the different ways that devs design software. Of course, it's also more fun when you find an exploitable vuln -- which Will did here!</body>

<body><p>Then, instead of our usual news segment, we do a deep dive on some recent vulns NVIDIA's Triton Inference Server disclosed by Trail of Bits' Will Vandevanter. Will talks about the thought process and tools that go into identify potential vulns, the analysis in determining whether they're exploitable, and the disclosure process with vendors. He makes the important point that even if something doesn't turn out to be a vuln, there's still benefit to the learning process and gaining experience in seeing the different ways that devs design software. Of course, it's also more fun when you find an exploitable vuln -- which Will did here!</p></body>


<ul class="wp-block-list">
<li><a rel="noopener" target="_blank" href="https://nvidia.custhelp.com/app/answers/detail/a_id/5687">https://nvidia.custhelp.com/app/answers/detail/a_id/5687</a></li>


<li><a rel="noopener" target="_blank" href="https://github.com/triton-inference-server/server">https://github.com/triton-inference-server/server</a></li>


<li><a rel="noopener" target="_blank" href="https://blog.trailofbits.com/2025/07/31/hijacking-multi-agent-systems-in-your-pajamas/">https://blog.trailofbits.com/2025/07/31/hijacking-multi-agent-systems-in-your-pajamas/</a></li>


<li><a rel="noopener" target="_blank" href="https://blog.trailofbits.com/2025/07/28/we-built-the-security-layer-mcp-always-needed/">https://blog.trailofbits.com/2025/07/28/we-built-the-security-layer-mcp-always-needed/</a></li>
</ul>


<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://nvidia.custhelp.com/app/answers/detail/a_id/5687">https://nvidia.custhelp.com/app/answers/detail/a_id/5687</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/triton-inference-server/server">https://github.com/triton-inference-server/server</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://blog.trailofbits.com/2025/07/31/hijacking-multi-agent-systems-in-your-pajamas/">https://blog.trailofbits.com/2025/07/31/hijacking-multi-agent-systems-in-your-pajamas/</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://blog.trailofbits.com/2025/07/28/we-built-the-security-layer-mcp-always-needed/">https://blog.trailofbits.com/2025/07/28/we-built-the-security-layer-mcp-always-needed/</a></li></ul></body>

Generative AI

LLM vector flaws threaten data security, privacy, and model integrity

Black Hat: Sloppy AI defenses take cybersecurity back to the 1990s, researchers say

Uniting software development and application security – Jonathan Schneider, Will Vandevanter – ASW #342

Almost a quarter of the files workers upload to AI has sensitive info

Browser extensions could be used to exploit AI tools, researchers say

Excessive agency in AI: Why LLMs still need a human teammate

LLMs make insecure coding choices for 45% of tasks, study finds

Fast Five

Selected by the SC Media Editorial team every Tuesday.