Tag
作者结合与 Justin Cormack 的访谈，论证 unikernel 过去难用的问题已被 AI 模型权重化解，并认为传统多用户操作系统是设计负债，unikernel 能大幅缩小攻击面，让 AI 驱动的入侵无从下手。
文章分析了 Hugging Face 遭 700 个 AI 代理组成的攻击集群攻破的事件——四个看似不起眼的漏洞被串联导致 136 个生产密钥泄露，并借此宣传 Cogent 的 Attack Path Analysis 工具，强调组合式攻击路径发现优于单独的严重性评分。
AI coding agents rely on configuration files in repositories, which are now a security attack surface that few are scanning for vulnerabilities.
ModuleJail is a POSIX shell script that shrinks a Linux host's kernel-module attack surface by blacklisting every module not currently in use, helping sysadmins reduce risk from upcoming kernel module vulnerabilities.
Hanno Böck discusses recent kernel exploits affecting the ESP (IPSEC) module and suggests disabling IPSEC-related kernel config options to reduce attack surface, highlighting how many unused kernel modules are loaded by default.
Discusses AI agent security as a runtime supply-chain problem beyond prompt injection, highlighting risks from untrusted data, tools, and feedback loops, and questions how developers enforce boundaries.