Researchers map 45 AI hacking frameworks and exposed consoles
Shodan matches on November 7 included 1,428 ARTEX-family services; 11 of 41 fingerprinted tools expose a web UI by default.
Stories per day · 30 days
2 RSS
Relatedcredential-leak2github2agent-consoles1alibaba-cloud1anthropic1artex1classifier1claude-code1docker1exposed-services1gitee1modernbert1offensive-ai1openai1pentagi1push-protection1secret-detection1
13 stories, newest first · one card per story
Stories tagged #secret-scanning
Claude Code permission file leaks secrets on public GitHub
GitGuardian counted 31,088 distinct secrets across 23,276 repositories, including 5,343 still valid when found.
1
26,400 working cloud and AI keys found in public Gitee repos
A scan of 7.25 million repositories kept only keys that still authenticated, led by 9,473 Alibaba Cloud AccessKey pairs.
4
GitHub’s model for secret detection: Finding more secrets with less noise
GitHub's ModernBERT secret classifier raised alert acceptance 11.5% and cut median scan time by 86%.
4
GitHub AI Can Spot Passwords Hidden in Code Before Developers Push Them
GitHub is previewing a ModernBERT classifier that blocks hidden passwords during pushes, beyond pattern-based scanning.
GitHub adds AI to catch passwords before a code push
GitHub is adding a ModernBERT classifier to push protection to block unstructured passwords before they enter repositories.
2
Over 543,000 valid credentials exposed in public GitHub repositories
Truffle Security found 543,699 still-valid credentials exposed in public GitHub repositories.
Over 543,000 GitHub Credentials Remain Active After Being Publicly Exposed
Truffle Security found 543,699 still-valid credentials exposed in public GitHub code.
1
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
Google Threat Intelligence published a defense-in-depth blueprint for hardening CI/CD pipelines against actively exploited supply chain attack vectors.
AWS Automatically Quarantines Exposed IAM Keys Within 10 Seconds of GitHub Leak
AWS quarantined a leaked IAM key 10 seconds after Unit 42 published it to public GitHub.
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies
Unit 42 analyzes how AWS's AWSCompromisedKeyQuarantine managed policy automatically neutralizes exposed IAM access keys, plus monitoring strategies for quarantine events.
4
This Key Will Self-Destruct: An Open Standard for Revocable API Keys
SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.
Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira
Stratus Security open-sourced Sift, a CLI secrets scanner covering Active Directory, SharePoint, Teams, Slack, Jira, and Confluence, outperforming Snaffler in benchmarks.
2