// Contributing to
Independent Security Researcher · Co-Founder @ CoDe RTD · Lecturer, Cybersecurity, AI & Cloud Security @ ITS ICT Piemonte
Research reports, reproducible labs and technical field notes on cloud security, agentic AI/MCP, APIs and authorized offensive validation.
We replayed the events of parts 2 and 3 in five AI coding agents and checked which default logs and host telemetry record them, against hours of normal use. We also counted which tools of official MCP servers pass through their own defences.
We changed what an approved MCP tool says in eight AI coding agents, including Claude Code, Codex CLI, Gemini CLI, Cursor and VS Code. None asked for permission again: approvals follow the tool's name, not its description.
We opened the same repository, declaring the same harmless MCP server, in eight AI coding agents on a clean VM. In an interactive session, none started it before we answered, but in five of the six clients that ask, the pre-selected answer is the one that trusts, and for three of them trusting the folder is the same act as starting its servers. Claude Code is the most careful of the clients that ask and starts the project's server with no question in non-interactive mode. Exact prompts, 75 repeated cells, a re-check on the releases of 9 October, a reproducible lab with 18 tests, and the commands to check your own setup.
Ten AI agent vulnerabilities disclosed between late June and late September 2026 (coding assistants, MCP servers, IDE integrations, CI workflows), classified by where the flaw triggers: before the model is involved, in the interface around it, in the plumbing that connects it to tools, or in the authority it was given. In six of ten, the model's judgment was never the deciding factor. Opens a four-part series ending in a preprint in early November.
Step-by-step solutions to the Byte Lotus Hotel event rooms: OSINT, web, cloud, forensics, boot2root. Each writeup with reproducible methodology, defensive notes and redacted flags — the point is how you get there, not the value.
The revision removes protocol sessions and, in the same document, forbids treating possession of a state handle as authentication. An executable conformance test for that MUST NOT: three key strategies compared, 13/13 tests, in-process lab. The composite key the spec recommends can be bypassed when the principal id contains the delimiter.
Tear-down of a sensor ring (infrared PPG sampled at 250 Hz, skin temperature at 0.1°C), analysis of the v2 API and sync endpoints, documentary reconstruction of the corporate and investment chain, review of the available clinical literature (73% specificity, underestimated REM stage) and of the US class actions. With a self-critique section and explicit limitations.
Analysis of an affiliate-model drainer infrastructure: from the initial phishing message to the TRC-20 approval chain, mapping of collection wallets and command infrastructure, $13,960 in transfers traced on-chain. Public sources, open channels and blockchain data.
// ACCESS DENIED
// Clearance level: INSUFFICIENT
// Next post loading...
// ETA: soon™
Starting from a published CNN investigation, a threat intelligence analysis of how an abuse-material distribution network stayed operational across content moderation, crypto payment rails and regulatory oversight. Based on public journalistic and documentary sources. Sensitive content.
Reproducible lab on an owned environment: from an application-level SSRF against 169.254.169.254 to the instance role's temporary credentials. Documented context (Capital One, 106 million records, $80M fine) and verifiable mitigations: HttpTokens=required, hop limit, least-privilege role policies.
Classroom lab on an isolated lab network: Cardputer-Adv with Bruce firmware, evil portal, beacon spam and 802.11 deauthentication. Hardware setup, commands, observed results and client- and infrastructure-side countermeasures (802.11w/PMF, captive portal verification, DNS and certificates).
OSINT investigation into an Android + Windows campaign attributed to an Iranian actor. A Windows payload not documented in public reporting, a secondary C2 at 0/94 VirusTotal detections at time of analysis, infrastructure registered roughly 8 months before the operation. Point-by-point comparison with the Unit 42 and CloudSEK reports, full indicators of compromise and detection rules published alongside the report.
Diagnosing an ICMP black hole on an access network that broke Path MTU Discovery, causing packet loss on GeForce Now and capping throughput at 26 Mbps on a 1 Gbps line. Measurement method, isolation of the offending hop and MTU/MSS-side workaround.
Wildcards in policies, root user without MFA, exposed static access keys, over-permissive roles and disabled logging. For each: how to detect it, why it matters and the applicable fix, mapped to Well-Architected Framework controls.
An LLM wired into internal data and application tooling introduces an attack surface traditional threat models do not cover. Walk-through of the input → context → tool call chain, and applicable mitigations: privilege separation, tool-level authorization, output validation and invocation logging.