An AI code review agent invented a CVE and recommended dangerous fixes. Docker's post highlights containing agents with Docker Sandboxes and verifying their output.
Related articles
See all- Security
Scoped Capability Tokens for STVA
Scoped Capability Tokens are short-lived, revocable authorization tokens that grant specific actions, enhancing transaction security by eliminating broad approvals. They are designed to integrate with independent simulations and account authority lifecycles, supporting offline verification and revocation.
- Cryptography
Post-quantum signatureless authorization with recursive verification
A new technique for signatureless authorization using proof-of-knowledge and recursive verification has been introduced, which is resistant to quantum threats. This approach involves publishing a commitment to a reusable secret and authorizing actions with randomized zero-knowledge proofs, addressing security challenges like safe reuse.
- Security
Secure Transaction Verification and Authorization (STVA)
The Secure Transaction Verification and Authorization (STVA) standard aims to provide a secure framework for transaction verification and authorization, addressing issues like Blind Signing and multisig UI attacks. It introduces structured metadata, independent simulation, and scoped capability tokens to enhance security.
- Java
Java Secure Coding Guidelines
The Java Secure Coding Guidelines provide best practices to avoid security vulnerabilities. Recent updates include expanded coverage on input validation and serialization.
- Security
Lean verification of EIP-7002: system-call success and FIFO requests
EIP-7002 ensures system calls always succeed and requests are processed in FIFO order. These properties are proven using Lean 4.
- OpenAI on OpenAI
How Ultrafast cut incident investigation from hours to minutes at OpenAI
OpenAI engineers have reduced incident investigation time from hours to minutes using Codex Ultrafast, enhancing security analysis, code refactoring, and daily workflows.