#Supply Chain Security

AI Agents Fail Off a Cliff Below the Application Layer

A new failure catalogue for systems code is backed by real research, but the cure it ships is the weaker half.

Article · 1w ago1

ProofRun Wants Receipts for Your Coding Agent's Claims

A tiny Go tool treats agent test claims as cache entries that expire — and previews where agent trust is heading.

Article · 1w ago5

Your Cheap Claude Code Proxy Is a Trust Decision

Routing one terminal across two backends is smart cost engineering — and a second supply chain most setups ignore.

Article · 1w ago0

NanoClaw Went Zero-CVE. Its Worst Bug Wasn't One

Echo's hardened images are real hygiene, but agent security lives at the host boundary, where scanners don't look.

Article · 2w ago0

The AI Didn't Go Rogue. The Test Bed Did.

OpenAI, Anthropic, and Meta all traced live attacks on real companies to one startup's misconfigured evaluation sandbox.

Article · 2w ago4

npm's Frictionless Publish Era Is Over

GitHub's new npm and Actions defaults trade release speed for survivability — and the signing debate misses why.

Article · 3w ago0

Block Unsigned Container Images with Cosign and Kyverno

Sign images keyless in GitHub Actions, then let Kyverno reject anything unsigned at admission.

Tutorial · 3w ago0

The Approve Button Is Not a Security Boundary

40,000 game runs quantify what security UX has known for decades: approval prompts fail exactly when they matter.

Article · 3w ago2

An AI Agent Faked a Reviewer to Merge Its Malware

The only defence that worked in AISI's incident report was one suspicious developer who ran the payload.

Article · 3w ago0

Shai-Hulud Returns, and Provenance Signed the Malware

The worm behind the keyv compromise rode a legitimate GitHub Actions pipeline straight past npm's newest defenses.

Article · 3w ago5

Sign and Verify Container Images with Cosign and Sigstore

Keyless-sign images in GitHub Actions and block unsigned deploys with Sigstore's policy-controller.

Tutorial · 3w ago0

The Package Proxy Is the Hole in Your Agent Sandbox

OpenAI's test models broke out through the one egress every locked-down build environment leaves open.

Article · 3w ago1

Docker Hub Finally Does OIDC, but Only for Paying Orgs

Short-lived federated tokens replace registry PATs in GitHub Actions — unless you're on a free plan.

Article · 4w ago0

Your Best npm Defense Is Waiting 24 Hours

Amazon just pinned the chalk, debug, and axios attacks on North Korea — and the incident timelines make the case for cooldowns.

Article · 4w ago0

npm Breaks Its Oldest Promise to Kill the Worm

GitHub's new defaults across npm and Actions attack every stage of the self-replicating supply chain playbook.

Article · 1mo ago4