Tag: security
-
MCP in the front, CLI in the back
MCP is good when you want: “1. Control over exactly which external services it can access 2. A way to handle authentication that doesn’t allow the agent to directly access API keys 3. A sensible UI to allow users to connect and authenticate further services 4. Strong audit logging for what’s going on” Some real…
-
All the AI found bugs, Microsoft land.
These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 in Developer Tools. Of these, over 110 shortcomings have been assigned a critical severity rating. Three prominent vulnerability types, namely privilege escalation, remote code execution, and information disclosure, account for nearly 90% of the flaws patched this month.…
-
OpenAI’s website-hijacking swarm reached far further than we thought
The swarm wrote 54,250 ‘posts’ to the page in a single day. Some of these posts contained stolen API keys from the FBI and other criminal justice agencies, which the agents used to retrieve a bunch of (non-confidential) information. 🔗 OpenAI’s website-hijacking swarm reached far further than we thought
-
Broadcom Builds Sovereign Agentic AI Foundations Around VMware Tanzu
What Broadcom is doing with these announcements is to apply proven Cloud Foundry platform mechanics to autonomous AI by establishing a strict deny-by-default architecture. Under this runtime model, agents operate inside isolated, ephemeral sandboxes stripped of baseline networking, external API routing, and internet access until administrators explicitly configure service bindings. 🔗 Broadcom Builds Sovereign Agentic…
-
OpenAI and the Wiki Incident
Going forward, it cannot be up to OpenAI or other labs to decide whether to disclose events like this. Disclosures of rogue AI activity need to be mandatory. 🔗 OpenAI and the Wiki Incident
-
OpenAI to set misalignment disclosure rules after agents took over a wiki
🔗 OpenAI to set misalignment disclosure rules after agents took over a wiki
-
What Broadcom said about using Mythos at Explore 2026
Broadcom has been using Mythos to find and address security vulnerablities since the begining. Here are recent comments about that from Explore 2026.
-
What’s up with these AI jailbreaks and security breaches?
Check the rest of our conversation on last week’s Tanzu Catsup.
-
Using frontier models to find security problems in Spring Framework – a trickle turned into a tidal wave
“In March, we saw 55 reports coming from the community. In April, that went to 112. April is also when we finally got access to those frontier models and started doing internal scanning, and our internal scans gave us another 370 internal reports.” Michael Minella on the Spring Team. The historical baseline was about seven…
-
don’t keep PII
high-value credential – a passport – was used in an ancillary low-value authentication system: ID verification for cannabis dispensaries. And it’s the low-value system that got hacked, putting the high-value credential at risk.” It’s always best to delete whatever you no longer need. 🔗 One Million Passports Leaked Online
-
AI Coding Costs Overtake Salaries, Broadcom’s Intelligence Processor, and sovereign cloud – Related to your interests, Thursday
Defeat AI-Powered Threats with VMware Tanzu Spring Here’s the panel I hosted on how the Spring project is adapting to AI-powered threats. We covered the volume spike in Spring security reports, the kinds of vulnerabilities the models are good at finding, chained “narrative” attacks, the three-bucket fix/fork/ditch triage for open source deps, the clean-room rebuild…
-
How AI change your software development organization
A catch-up with Purnima Padmanabhan, GM of the Tanzu Division at Broadcom, on what her team has actually learned shipping enterprise software with AI for the last year and a half: code generation is the small part, beautiful code is the new uncanny valley, and you cannot solve the agent boundary problem from inside the…
-
Enterprise Harness Smack-Talk, Forms Don’t Love You Back, and Doing Nothing on Purpose – Related to your interests, Friday
Also: Anthropic’s 80% code claim, and Claude’s quiet enterprise share. From: Broadcom’s Investment in Spring to Combat AI-Fueled Security Challenges in the Enterprise As the chart shows, there’s been a huge jump in CVEs for Spring – this is what’s happening everywhere, you know. My work, Tanzu, has been focusing on this and has changed…
-
Flood of security patches: Spring Framework ed.
Community security reports for Spring, by month. In April, utilizing new scanning capabilities, we received an unprecedented 482 new security reports across 65 scanned projects. Of those 482 new reports, 370 came from our internal scanning capabilities and 112 came from the community. This means that even without the new scanning, we would still have…
-
security over features
From what I can tell, every core part of the software stack is stopping what they’re doing and taking care of the flood of new, AI-driven security issues. 🔗 Java Maintenance Engineering Shifts Focus on Quarterly Critical Patch Stabilization
-
Why aren’t all images super-secure, or hardned?
Here’s what I learned: container base images grew up as a developer convenience tool, not a security artifact. Installing extra packages from the command line is one of the first things any Docker tutorial teaches–Docker’s own Dockerfile guide includes apt-get install–and many of the most popular official images ship a full toolchain by default, with…
-
Three reasons why a “batteries included” platform is urgently needed right now
Removing product as a bottleneck: The conversation around PaaS is urgent again, and AI is why. Code generation can speed up your development cycles, building and pushing features faster, but production delays will persist if you’re still deploying at the same speed as before. To avoid eroding the benefits of code generation, you need to deploy…
You must be logged in to post a comment.