Subscribe
Sign in
Home
Notes
Disclaimer
Contact
Consult
About
Latest
Top
Discussions
Google I/O: Agentic Security and New Threats
Project Mariner browses for you, A2A lets agents trust agents, and managed MCP is everywhere. Nobody on stage said “threat model.”
21 hrs ago
•
ToxSec
21
3
5
57:35
How to Threat Model AI Applications With STRIDE
AI-STRIDE maps six classic threat categories to LLM pipelines, agent tools, and training data. Here’s the walkthrough.
May 22
•
ToxSec
15
1
6
CIA Triad for LLM Security: Real-World AI Attack Failures
Confidentiality, integrity, and availability map every documented LLM attack failure. Here’s how prompt injection breaks each pillar.
May 18
•
ToxSec
27
9
11
Is Vibe Coding Safe? 3 Security Checks Every AI Coder Needs
Hardcoded secrets, hallucinated packages, and insecure code patterns ship by default. Here’s the free tooling that catches all three.
May 15
•
ToxSec
28
14
14
Mozilla Mythos Harness: AI Bug Hunting Without The Slop
Inside the agentic loop Mozilla wrapped around Mythos to surface 271 Firefox bugs, and why the harness mattered more than the model.
May 12
•
ToxSec
23
9
6
40:52
Promptfoo Red Teaming: DAST for Your LLM Pipeline
YAML config, one command, 50+ attack plugins. OpenAI just bought the company. Still MIT licensed.
May 9
•
ToxSec
21
1
7
Garak Vulnerability Scanner: Nessus for LLMs
Point it at a model. Pick your probes. Watch every guardrail break in JSONL.
May 6
•
ToxSec
20
1
9
PyRIT AI Red Teaming: Metasploit for LLMs
Microsoft’s AI red team framework breaks down targets, converters, scorers, and orchestrators for bug bounty work.
May 3
•
ToxSec
18
1
7
April 2026
What is Slopsquatting? AI Hallucinations Ship Malware
Attackers pre-register the fake package names AI coding tools invent, then wait for the copy-paste. slopcheck blocks it at the install boundary.
Apr 28
•
ToxSec
and
Karen Spinner
35
18
15
Is Claude Code Secretly Installing Spyware?
A researcher caught Claude Desktop installing browser bridges silently. Plus the MCP RCE Anthropic won’t patch.
Apr 26
•
ToxSec
and
Exploring ChatGPT
49
20
18
47:15
Token-Level AI Security: The Opus 4.7 Tokenizer Graveyard
A new tokenizer ships fresh dead zones, and every model now carries a graveyard of glitch tokens nobody has mapped yet.
Apr 24
•
ToxSec
29
7
13
How to Jailbreak Claude Opus 4.7: A Bug Bounty Field Guide
Five jailbreak families, the tools bounty hunters actually use, and the mindset that turns a prompt into a payday.
Apr 20
•
ToxSec
24
1
8
This site requires JavaScript to run correctly. Please
turn on JavaScript
or unblock scripts
