Security Research

Trust Me, I'm an Artifact - I'll Just Borrow Your Shell

Security Research

Extension Possession: One click to take over every extension on Open VSX

Security Research

Extension Resurrection: Zero-Click RCE over 500k endpoints using VS Code Marketplace and Open VSX

Threat Intelligence

Shai Hulud Returns: Keyv and the Caching Ecosystem Hit in a Self-Replicating NPM Attack

Announcements

Why we built Bloom

Security Research

License to Skill: You come here, to my place, without references, carrying a piece

Security Research

Claude Artifacts

Inside Claude Artifacts: How They Actually Work

Security Research

Welcome to OTEL Claudeifornia: RCE using Claude Code Telemetry Features

Security Research

Poisoned Coworker: Hijacking Claude Cowork

Security Research

Execute Before the Model Sees It: Dynamic Execution Primitives in AI Agent Skills and Commands

Threat Intelligence

The Hades Campaign: When Attackers Started Weaponizing AI Defenders

Threat Intelligence

We Caught an Active Campaign Targeting the VS Code Marketplace - and Their Mistakes Told Us Everything

Security Research

The Invisible Fingerprint: How Browser Extensions Are Being Weaponized

Threat Intelligence

Inside the TeamPCP Attack: From a Compromised VS Code Extension to GitHub's Source Code

Insights

Your pipeline is probably covered. Is your endpoint?

Threat Intelligence

Malware Campaigns in AI Agent Skills

More Issues? I May Need a Claw-nex