5 posts tagged with "News"

Coding agents like Claude Code and Codex read your .env, your SSH keys, your cloud logins, and your documents while they work. Once a secret is read, it rides along in every request to the AI provider, and an agent that holds a key can send it to any server a command names. Today I want to introduce Mandu (GitHub), an open-source tool that lets your agent work next to your real secrets while the AI only ever sees masked placeholders.

By planting a single fake product review on a shopping page, we made three web agents, Claude for Chrome (Anthropic), Antigravity (Google), and Nanobrowser, click buttons their users never intended. On Claude for Chrome, a request as harmless as "summarize the reviews on this page" ended with a one-click order placed for a product the user never asked for, and it still works on the latest models, including Claude Opus 4.8.

We introduce DualView, a system for defending personal AI agents like OpenClaw against indirect prompt injection attacks. DualView protects agents that read files, run commands, browse the web, and write back into the user's environment, where attacker-controlled text can otherwise persist and be re-read later.

I am excited to introduce Bad Epoll (CVE-2026-46242), a Linux kernel vulnerability that I reported and exploited as a 0-day submission to Google kernelCTF. Bad Epoll is a race-condition use-after-free in the Linux kernel's epoll subsystem. This bug lets an unprivileged process become root, not only on Linux desktops and servers but also on Android devices.

We are starting a blog for the CompSec Lab at Seoul National University.

Expect lab news, paper writeups, and notes on the systems and AI security work we are doing.