Brian Clark

Developer Advocate @Snyksec | Prev @Microsoft @Disney | Web dev and app sec things. Here for community, fun and learning. Not for numbers or influencing you.

[Brian Clark @_clarkio]

FYI:🟦☁️ 👉 @clarkio.com

[Brian Clark @_clarkio]

A fun test to see how well you do at checking agentic AI permissions: https://t.co/mrIuBybPPB

[Pomerium @pomerium_io]

Big banks aren't known for moving fast on new tech. With AI it's a different story. Some are even buying supercomputers to train their own internal models.

[Brian Clark @_clarkio]

@LawrenceDCodes @tdesseyn I’m with you. If we’re talking strictly offline I might tinker but still wouldn’t give it full autonomy

[Snyk @snyksec]

Versions of
- laravel-lang/lang
- laravel-lang/http-statuses
- laravel-lang/attributes
- laravel-lang/actions
have been published with malicious versions

Packagist has unlisted the packages, but if you installed any of them between May 22–23, treat the environment as compromised

[Brian Clark @_clarkio]

Your first instinct after getting hit by the TanStack npm attack is to revoke your GitHub token.

Don't.

The malware polls GitHub every 60 seconds. Gets a 401? It runs rm -rf ~/

Here's the right remediation order before you touch a single credential. https://t.co/TNXDfhORa4

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[Matt Johansen @mattjay]

A government contractor just leaked a ton of sensitive info including admin passwords for CISA's AWS GovCloud accounts - all to a public GitHub repo.

CISA says they "hold our team members to the highest standards of integrity and operational awareness"

Followed by evidence of them turning off basic GitHub defaults that would protect from publishing secrets. And dictionary passwords that were the name of the service + the year.

[Sarah Drasner @sarah_edo]

💥 Game changer for Web Development announced at GoogleIO- Modern Web Guidance! It’s expert-vetted skills for web development based on best practices of latest specs and APIs.

It ensures your agent/coding harness doesn’t default to older and out of date patterns to build sites.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Brian Clark @_clarkio]

@onlylarp @mattjay @tuckner @SocketSecurity Beat me to it! Good call

[Brian Clark @_clarkio]

@mattjay @tuckner @SocketSecurity Hooks are deterministic and make sure what you want to happen, happens

[Brian Clark @_clarkio]

AI wanted to copy node_modules between two stages in a Dockerfile. One where devDeps are needed and one they're not (production).

I called this out and it of course replied with "You're right — I should walk that back."

[Brian Clark @_clarkio]

The timing of this is perfect. I just had a scenario where having learned something on my own helped me catch a bad suggestion by AI...

[Addy Osmani @addyosmani]

https://t.co/jKCIAEzai7

[Brian Clark @_clarkio]

@wesbos I was thinking maybe if it got to a solution faster it might be less expensive

[Brian Clark @_clarkio]

More and more companies are deploying AI-generated code into production. Much of that code contains vulnerabilities. Making traditional AppSec struggle to keep up.

@snyksec + @AnthropicAI's Claude = security at AI speed

👇
https://t.co/LnPn8kM9Nq

[Brian Clark @_clarkio]

@nickytonline Same here!

[Nick Taylor @nickytonline]

Looking forward to chatting with @_clarkio today! Happening in 5 hours. Come hang with us!

https://t.co/iWfSRLR9i8

[Brian Clark @_clarkio]

@liran_tal I'm thinking about the monthly/annual subscriptions changing for them all. Do you think they'll move everything to usage based billing vs. subs?

[Brian Clark @_clarkio]

Any guesses on when the same happens at Anthropic, OpenAI, Cursor?

I think it's gonna be in the next 2-3 months.

https://t.co/cu9HOdvNDu