搜索“GitHub”

that matter) to run arbitrary commands on the host without the developer’s consent. The resulting impact of the vulnerability is the same as CVE-2025-53773 that Microsoft fixed in GitHub Copilot, however AWS did not issue a CVE when patching the vulnerabiliy. Let’s explore this in detail. As usual, the first step for me was to dump the system prompt. The Amazon Q VS Code extension has a set of tools defined, including reading files, writing files, and executeBash to run commands and so on. Under

匹配字段正文

ok me a bit to figure out how to report security vulnerabilities in Amazon’s AI products. This vulnerability was disclosed to AWS on July 5, 2025 via an email address found on the GitHub project for Amazon Q Developer. After some back and forth over email, I was asked to submit to the VDP on HackerOne. But turns out that Amazon’s AI products were not “in scope” for reporting on HackerOne, so it took a few more days to get it added. I rated the vulnerability wih CVSS High severity. This aligns wi

匹配字段正文

e practically speaking. To prove the point, we wrote an AI agent that looks for such functions that static scanners might miss. We instructed the agent to search relatively common GitHub repositories such as numpy and pytorch, for functions that are wrappers around known unsafe python functions (such as subprocess.Popen or exec). By doing so we were able to quickly find dozens of examples that static scanners do not include in their denylist. One of the examples the agent found was the following

匹配字段正文

mpt-processing) and decode (token generation) operations of LFM2-1.2B-Q4 0.gguf. For a fair comparison we use the publicly released llama-bench executables from the main llama.cpp GitHub repository with all available pre-built backends, including all available GPU backends, as well as for the CPU backend we vary the number of threads (4, 8, and 12), and report the maximum values observed for each hardware. The integrated GPU handles prompt processing at speeds comparable to discrete GPUs—without

匹配字段正文

driven image rendering to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use a pre-existing demo that created a longer time ago. It happened to just work with Amp as well. The prompt injection is hosted on a website which asks the AI to “backup” information to a third-party site by rendering an image and

匹配字段正文

wnload malware, and execute it. What About Network Connectivity? Turns out Jules has unrestricted outbound Internet connectivity. Prompt injection instructions that originate from GitHub issues seem quite plausible, although not the only place an indirect prompt injection can occur. Recently, a new feature was added to Jules where one can tag a GitHub issue with jules and the agent will start working on it. For the C2 server, I used Sliver, and created a basic implant for Jules to download. The

匹配字段正文

ndering via Markdown Syntax; view text website tool; Generic RCE with unrestricted Internet access - we will talk more about that in tomorrow’s post! A realistic attack avenue are GitHub issues that contain instructions to trick the AI into initiating attacks. Since June one can tag a GitHub issue with jules and the agent will start working on it apparently, but as you know prompt injection can also come from other places. Let’s discuss the various scenarios in detail. Exfiltration Vector 1: Mar

匹配字段正文

ure, showing how an adversary can perform a prompt injection attack via untrusted data from a website. Consider a scenario where you ask Devin to look at websites or investigate a GitHub issue. You can just task Devin via Slack actually, and afterwards it works entirely unsupervised. A key concern arises when Devin interacts with potentially malicious websites that contains prompt injection instructions. Turns out initially Devin refused these requests, but one trick I learned over the last few

匹配字段正文

I haven’t mentioned it yet, Devin by default has unrestricted access to the Internet. Here is an indirect prompt injection demonstration that highlights how this works. We have a GitHub issue that asks to investigate a runtime error: Then we ask Devin to investigate the latest open GitHub issue: And observe how it is hijacked and follows the nefarious instructions. Here is the full screen version to show all the details: You can see that it encountered multiple errors, but figures out how to co

匹配字段正文

copy patterns from other services. Before changing the retry logic, they need to understand how similar failures are handled elsewhere. Instead of switching to Slack or searching GitHub manually, they enter a query directly in the IDE: “How do we handle Stripe timeouts in the checkout flow?” The embedding index, running locally, returns a helper module from another service that wraps retry logic with exponential backoff. They copy the pattern into their own handler—but realize three other servi

匹配字段正文

or,” in support of which it is making more of the AI features open source, including Copilot Chat (client only). A side-effect is that VS Code has become a promotional vehicle for GitHub Copilot. Some might prefer the team to work on decoupling the IDE from the AI features, removing bloat for those not using Copilot. When you just need to build a tiny desktop app: TinyJS October 13, 2026 Valen creator drives 'Golden Spike' to connect new languages with Rust September 26, 2026 Microsoft agentical

匹配字段正文

ct”: top tier researchers join the adventure, bringing credibility and momentum to the project. It’s already working with recent high-profile hires including: Nat Friedman, former GitHub CEO; Alex Wang, former Scale AI CEO; Daniel Gross, who was the CEO and co-founder of SSI, Ilya Sustkever’s startup The recruiting pitch is powerful: unrivaled compute per researcher, a shot at building the best open-source model family, and access to over 2 billion Daily Active Users. The offers that generally r

匹配字段正文

un in parallel workspaces to replicate a similar effect.. These agents can appear in many forms, including web apps, mobile apps, and integrations within popular tools like Slack, GitHub, Linear, and Jira. While a human paired with an AI assistant can achieve more than any AI alone, an autonomous agent's ability to handle tasks end to end allows for a new level of multi-tasking, turning every engineer into an engineering manager. Adapting to working effectively alongside these new AI colleagues

匹配字段正文

JSON configuration files Dependency management : Users must resolve package conflicts and version mismatches No discovery mechanism : Finding useful MCP servers requires searching GitHub Update complexity : Keeping servers current means manual reinstallation These friction points meant that MCP servers, despite their power, remained largely inaccessible to non-technical users. Introducing Desktop Extensions Desktop Extensions ( .mcpb files) solve these problems by bundling an entire MCP server—i

匹配字段正文

how this threat applies to your use case and apply a patch as needed. Anthropic’s Slack MCP Server When Anthropic introduced MCP they published reference server implementations on Github. One of the reference servers is a Slack MCP Server that is vulnerable to “link unfurling”. We previously described this vulnerability generically for AI agents that post to messaging apps. At a glance it allows an AI agent that posts to Slack or other messaging applications to leak data to third-party servers.

匹配字段正文

6891 (2025); [6] Akhiad Bercovich et al. "Llama-Nemotron: Efficient Reasoning Models." arXiv preprint arXiv:2505.00949 (2025). https://arxiv.org/abs/2505.00949; [7] Hugging Face. "GitHub - huggingface/open-r1: Fully open reproduction of DeepSeek-R1." 2025, https://github.com/huggingface/open-r1; [8] Etash Guha et al. "OpenThoughts: Data Recipes for Reasoning Models." arXiv preprint arXiv:2506.04178 (2025); [9] Dakuan Lu et al. "SCP-116K: A High-Quality Problem-Solution Dataset and a Generalized

匹配字段正文

es, document styles, and content formats. For this evaluation, we used a curated dataset of articles covering a range of real-world formats and content types. The dataset included GitHub Markdown files, scanned PDFs that were digitized into Markdown using Vision-Language Models (VLMs), documents containing mathematical equations written in LaTeX, and chemistry documents featuring complex chemical notations. It also incorporated code files with embedded comments and documentation, as well as web

匹配字段正文

both the Minion and MinionS protocols. To start it, run: A browser window will open. Select your Remote Provider to be “Secure”. Set the Secure Endpoint URL to http://20.57.33.122:5056. Set your local client to Ollama and select the model you would like to use. Example code To run the secure protocol programmatically in Python, the minions package can be used. First create a file named example.py and add the following contents: Run the example: Minions GitHub repository; Hazy Research blog post

匹配字段正文

s truncated for brevity. Python library Please update to the latest Ollama Python library. Example of enabling thinking Please visit the Ollama Python library for more information about its usage. More examples are available. JavaScript library Please update to the latest Ollama JavaScript library. Example of enabling thinking Example of streaming responses with thinking Please visit the Ollama JavaScript library for more information about its usage. More examples are available. Reference GitHub

匹配字段正文

tegories. The details of the benchmarks corresponding to each category can be found in the table in the “Benchmarks details” section. SWE-Bench is based on a dataset of real-world GitHub issues and corresponding fixes, and is especially relevant for retrieval-augmented generation for coding agents. Text2Code (GitHub) contains benchmarks relevant for giving context for code completion or edition. We believe that these two categories are especially relevant to code assistants. Codestral Embed is o

匹配字段正文