The Security Field for Enterprise AI. Governing access, protecting agent actions and validating the systems behind enterprise AI.
Joined September 2026
- Tweets46
- Following10
- Followers9
- Likes12
If a SaaS tool you connect to got breached tonight, could you list every key you gave it, and which agents use them, in 10 minutes?
@GitBookIO customers are working through that list today 🧵👇
We’re addressing a security incident affecting GitBook. Some services are temporarily offline while our team restores them safely.
More information: gitbook.com/status/security-…
Live updates: status.gitbook.com
3/ GitBook says the attacker may have accessed integration tokens, Git Sync secrets, API tokens, and questions site visitors asked GitBook Assistant. It found no evidence content was modified.
Those credentials connect to other tools, so the risk could reach past GitBook.
4/ @GitBookIO asks customers to:
1. Rotate GitBook API tokens
2. Rotate third-party tokens and secrets that connect tools to GitBook, including published integrations
3. Re-authenticate the GitBook MCP server
🔍 Do any workflows in your public repos run code from fork PRs while holding your repo's secrets?
Starting Dec 2, @github Actions will block pull_request_target by default in public repos.
The first test window is Nov 9 🧵👇
github.blog/changelog/2026-1…
3/ The dates (in UTC):
• Nov 9 and Nov 16, 16:00–18:00: brownouts, when the block is enforced early. Blocked runs fail with an error annotation
• Dec 2: blocked by default in public repos, unless an Actions event policy allows it
(Private and internal repos aren't affected.)
🔍 Where do your team's AI keys live right now? If one leaked today, could you shut off just that one?
At least nine AI developer platforms disclosed incidents in October, per @wiz_io. Attackers kept looking for the same thing 🧵👇
wiz.io/blog/black-october-fo…
3/ @northflank told customers to assume all environment variables were decrypted.
Checklist for today:
1. List every platform that stores your AI keys
2. Revoke and reissue them at the issuing provider, not just the platform (per Northflank)
3. Check AI usage and billing logs
An AI coding extension runs with your developer's access.
Per @cursor_ai, a tampered @claudeai Code extension (not built by @AnthropicAI) sat in its marketplace ~11 hours on Oct 29 and tried to plant an SSH backdoor.
Uninstalling may not be enough.
Before trust, review the component.
On October 29, 2026, Cursor reported that a tampered copy of Claude Code extension (anthropic.claude-code, version 2.1.313 and 2.1.312) was available and served on the Cursor extension marketplace for a few hours. msft.it/6019aF20x
Microsoft has confirmed that the malicious packages found on Cursor marketplace were never published nor distributed from the Microsoft Visual Studio Marketplace extension and the npm anthropic-ai/claude-code, which were not affected by this incident.
Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace. At this time, all evidence suggests that the incident is limited to the Cursor marketplace.
Microsoft Threat Intelligence analyzed the JavaScript embedded into the malicious extension package. The injected loader runs when the extension module loads and attempts to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details.
Successful remote access depends on host privileges, SSH configuration, and the attacker’s server configuration; however, the loader may still write keys and persistence artifacts even when tunnel access fails.
Read the blog for technical analysis and guidance on identifying affected systems, investigating endpoint and network activity, and removing confirmed malicious SSH keys and persistence artifacts.
🔍 If your teams' model API keys sit behind one shared AI gateway, ask this: does the gateway pick a key based on who is asking, or on what the request claims?
🧵👇
access.redhat.com/security/c…
2/ Red Hat disclosed a flaw in an OpenShift AI gateway component.
A signed-in user could name another tenant's model (another team or project on the same platform) in a request, and the gateway would inject that tenant's API key and spend its quota.
Red Hat rates it Important because it requires valid user credentials. Per Red Hat's Oct 27 update, the original lookup was changed but the flaw is not yet fixed.
3/ Four questions for any AI gateway you evaluate:
1. Does it choose the upstream key from the caller's identity, or from a model name the client sent?
2. Is there an authorization check before a key is used?
3. Are quotas tracked per team or channel, or in one shared pool?
4. Can you trace each call: who sent it, through which channel, to which model, on whose quota?
If you deploy a shared gateway for several teams, test it: a request from team A that names team B's model should be refused.
🛠️ Self-hosting AI agents or inference servers? The riskiest settings often aren't in the model. They're in the server: who can reach it, and whether it asks for a login.
@nvidia disclosed a missing-authentication flaw in NeMo Agent Toolkit rated 10.0 (CVSS 3.1).
Versions 1.0 through 1.8.0 are affected.
github.com/NVIDIA/product-se…
The default setting is not affected, per the advisory.
The same advisory notes that some endpoints, such as /tokenize, aren't covered by vLLM's API key setting.
Neither advisory reports in-the-wild exploitation.