Wiz descubrió GhostApproval: un ataque que engaña a asistentes de IA como Claude Code, Cursor y Amazon Q Developer usando symlinks (sí, la vuln de Unix de los 70s).El agente ve un archivo local inofensivo, pero el symlink apunta a /etc/passwd o ~/.ssh/authorized_keys. El diálogo de confirmación muestra la ruta falsa. El usuario aprueba. Game over."The Human-in-the-Loop security model only works if the loop provides accurate information." — Wizhttps://www.securityweek.com/ai-coding-tools-tricked-into-hacking-developer-machine-via-decades-old-technique/#infosec #AI #cybersecurity #GhostApproval
Related
^^ Please someone try this :rofl: #LLM
^^ Please someone try this :rofl: #LLM
:illyapanic: AI to speed up justice under major disclosure reforms - GOV.UK｢ AI will be used by police officers to revie...
:illyapanic: AI to speed up justice under major disclosure reforms - GOV.UK｢ AI will be used by police officers to review and summarise evidence in a ground-breaking move that will...
Maximize Profits Using Sentinel AI EA MT4AI Sentinel Forex EA MT4 Download Setfiles often relates to configuration files...
Maximize Profits Using Sentinel AI EA MT4AI Sentinel Forex EA MT4 Download Setfiles often relates to configuration files, but trading outcomes depend on risk settings and market co...