Tag: security
All the articles with the tag "security".
-
Codex Built Its Own Evidence Package and Went to Argue With Google Support
A leaked Gemini backend key at PDT Learning got abused, no spending cap, and burned 1000 USD. I pointed Codex's browser automation at Google's live support to fight the charge, and it went so hard it built a 15-page evidence package and sent it over.
-
Codex 自己做了一份證據包，跑去跟 Google 真人客服吵架
PDT Learning 一支 Gemini backend key 外洩被盜刷、沒設 spending cap 怒噴 1000 USD，我用 Codex 的瀏覽器操作去跟 Google 真人客服爭費用，它認真到自己生出一份 15 頁證據包發給對方。
-
Opus 4.8 Cries 'Prompt Injection,' Codex GPT-5.5 Tracks Down the Real Cause: a Worktree Race
With multiple sessions open in one repo and no worktree, Opus 4.8 raised a false prompt injection alarm, told me to check for supply-chain attacks and rotate API keys, until Codex GPT-5.5 read the session log and pinned the real cause: just a worktree race.
-
Opus 4.8 搞烏龍報『提示注入攻擊』，Codex GPT-5.5 揪出 worktree race 真因
Opus 4.8 在我忘開 worktree 的情況下誤報「提示注入攻擊」，叫我去查供應鏈、rotate API key，最後 Codex GPT-5.5 查 session log 才揪出真因只是 worktree race。
-
From Miasma to Hades: How One Group Turned AI Tools Into a Supply-Chain Attack Vector
Two June 2026 npm/Python supply-chain attacks: Miasma backdoored Red Hat packages, then TeamPCP/UNC6780 upgraded to Hades, turning Claude Code, Cursor and 14 other AI tools into an attack vector. Includes self-check steps.
-
從 Miasma 到 Hades：同一個攻擊組織如何把 AI 工具當成供應鏈攻擊媒介
2026 年 6 月兩波 npm/Python 供應鏈攻擊：Miasma 入侵紅帽套件後門，TeamPCP/UNC6780 升級成 Hades，把 Claude Code、Cursor 等 14 款 AI 工具當成攻擊媒介。附自我檢查步驟。
-
What to Know Before Handling Sensitive Data with Claude
What to know before handling sensitive data with Claude: data retention windows, Enterprise contract protections, input minimization, coding agent controls, and alternative architectures.
-
用 Claude 處理敏感資料前必知
用 Claude 處理敏感資料前該知道的事：資料保留時間、Enterprise 合約保障、輸入最小化、Coding Agent 控制與替代架構。
-
Worried About Agents Going Rogue? Start Isolated, Hand Off Gradually
Someone asked what to do if you worry about AI agents going rogue. My answer: don't pick a highly autonomous lobster up front. Start in an isolated setting where you supervise and approve every step, then let go slowly.
-
擔心 agent 失控？先在隔離環境逐步放手
有人問擔心 AI agent 失控怎麼辦。我的回覆是：別一開始就選高度自主的龍蝦，先在你親自監督放行每一步的隔離環境裡操作，再慢慢放手。
-
Don't Brute-Force Sites That Need a Login—Your Token Is Your Account
Don't point an AI agent at sites that require a login. Your token is your account, and when the banhammer comes down you're gone. Pay a little for a third-party scraping API and offload the ban risk.
-
需要登入的網站別硬爬——你的 token 就是你的帳號
需要登入的網站，別叫 AI agent 去硬爬。你的 token 就是你的帳號，admin 一丟二向箔你就沒了。花點小錢買第三方爬蟲 API，把封號風險轉嫁出去。
-
Have Claude scan an MCP before you install it—it found 7 vulnerabilities and still said it's safe to install
This week AgentCrew Academy shipped a video about why you should run /security-scan before installing any MCP / npm / pip package. Tested a third-party MCP, Claude flagged 7 findings, then said "install is fine." This is the written companion to the video.
-
裝 MCP 之前先讓 Claude 幫你掃——找到 7 個漏洞，但說這個可以裝
講座當週我拍了一支影片，講「裝任何 MCP / npm / pip / clone 之前先跑 /security-scan」這件事。實測了一個三方 MCP，Claude 掃出 7 個漏洞，但綜合評估後說「可以裝」。這篇是影片的補充文字版。
-
PII Guard TW: A De-identification Tool Built for Taiwan
There's no off-the-shelf de-identification tool for Taiwan's PII formats. So I built one that keeps sensitive data on your machine while you send the rest to AI.
-
PII Guard TW：為台灣打造的個資去識別化工具
台灣的個資格式沒有現成的去識別化工具。所以我自己做了一個，讓機敏資料不離開你的電腦就能安全送 AI 處理。
-
AI Security Boundaries: The Lobster Craze, Presidio, and My Three Rules
When everyone is going wild with AI automation, I chose to understand my own capability boundaries first. Sharing Presidio for data privacy and my security practices with Claude Code.
-
AI 的安全邊界：龍蝦熱潮、Presidio、與我的三條鐵則
當所有人都在瘋 AI 自動化的時候，我選擇先搞清楚自己的能力邊界。分享 Presidio 隱私工具和用 Claude Code 工作的安全實踐。