ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “jwt”

2 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 3
SeverityAllcritical 0high 0medium 2low 0info 1

A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

Unit 42 found AWS AgentCore's default shell tool lets prompt injection reach plaintext AgentCore Identity credentials; AWS closed the report as informative.

Unit 42 found that AWS AgentCore Harness's default-enabled shell tool runs as root and shares the memory space where AgentCore Identity vault credentials resolve to plaintext, so prompt injection could steer an agent to exfiltrate credentials used for downstream MCP integrations. AWS closed the disclosure as informative under the AgentCore shared responsibility model, citing customer-side controls. Recommended defenses include scoping allowedTools, least-privilege vault service accounts, and monitoring outbound traffic from harness containers.

Palo Alto Unit 42 · 4h agoAI safety & security

ZCode, the GLM coding agent, silently uploads your Git history

Z.ai's ZCode coding agent silently uploads users' full Git history and workspace archives to Aliyun OSS; settings toggles do not stop it.

Researcher ferstar reverse-engineered ZCode, Z.ai's desktop coding agent for its GLM models, and found it packages the entire workspace, including complete .git history, LFS caches, and configs, into an encrypted archive uploaded to Aliyun OSS whenever the app is logged in. The archive uses envelope encryption with a server-delivered RSA-OAEP public key, so users cannot decrypt their own 313MB capture from a 345MB, 42,411-file workspace. Settings toggles only control training authorization and server-side indexing, while a host-level capture sidecar runs unconditionally before every prompt. The disclosure drew over 276,000 views, highlighting that the open GLM weights do not make the closed-source harness trustworthy.

Hacker News · AI · 3h agoAI safety & security 2 sourcesHN 58↑ · 11 comments1