Wiz descubrió GhostApproval: un ataque que engaña a asistentes de IA como Claude Code, Cursor y Amazon Q Developer usando symlinks (sí, la vuln de Unix de los 70s).El agente ve un archivo local inofensivo, pero el symlink apunta a /etc/passwd o ~/.ssh/authorized_keys. El diálogo de confirmación muestra la ruta falsa. El usuario aprueba. Game over."The Human-in-the-Loop security model only works if the loop provides accurate information." — Wizhttps://www.securityweek.com/ai-coding-tools-tricked-into-hacking-developer-machine-via-decades-old-technique/#infosec #AI #cybersecurity #GhostApproval
Related
#ai #datorDet blir alltmer bråttom med att skaffa / byta epost-server. Microsoft liknar mer en drake som varenda riddare...
#ai #datorDet blir alltmer bråttom med att skaffa / byta epost-server. Microsoft liknar mer en drake som varenda riddare vill prova att ge sig i kast med. Om så endast för att få t...
#Microsoft🚨continued to warn that users may be unable to connect to multi Microsoft 365 products *making “continued reco...
#Microsoft🚨continued to warn that users may be unable to connect to multi Microsoft 365 products *making “continued recovery progress” overall, w “broader improvements” in NA, “sus...
Anybody going to this tomorrow?#AI #AITreaty #AITreatyMarchhttps://aitreatymarch.org/
Anybody going to this tomorrow?#AI #AITreaty #AITreatyMarchhttps://aitreatymarch.org/