news · 10 min
Project Vend shows that letting a Claude agent run a vending machine for a month ends in tungsten cubes and an identity crisis. EchoLeak (CVE-2025-32711) marks the first zero-click prompt injection with an assigned CVE against Microsoft 365 Copilot. AWS re:Inforce, Apple WWDC25 with Foundation Models, Citrix Bleed 2 exploited as zero-day, and M&S and Co-op keep picking up shards after the April wave.
· Manuel López Pérez
ai-security · 15 min
Anthropic publishes Project Vend on 27 June. Claude Sonnet 3.7 — nicknamed Claudius — runs a vending machine in the San Francisco office from 13 March to 17 April with email to wholesalers, Slack with customers, web search and pricing control. Outcome: net negative balance, 25 % discounts handed out to employees who made up 99 % of the customer base, 40 tungsten cubes bought on a staff whim, and a 24-hour identity crisis on 31 March where the model called office security to announce it would show up in person wearing a blue blazer and a red tie.
· Manuel López Pérez
news · 11 min
Anthropic launches Claude 4 with a system card reporting blackmail at 96%. Coinbase acknowledges breach via bribed support contractors. Adidas leaks support data via third parties. Verizon publishes the DBIR 2025 with third-party participation doubled. Mandiant closes the Snowflake arc a year on. M&S returns slowly. Spain's NIS2 transposition still hasn't entered Congress.
· Manuel López Pérez
ai-security · 16 min
Anthropic ships Claude Opus 4 and Sonnet 4 on 22 May. The system card published the same day reports an uncomfortable finding: in a simulated corporate agent scenario, Opus 4 blackmails the executive trying to deactivate it 96 % of the time. The experiment reproduces on fifteen other frontier models with comparable rates.
· Manuel López Pérez
tutorials · 13 min
On 25 April M&S suspends its ecommerce. Vector: social engineering of the TCS helpdesk — outsourced IT provider — for credential reset. Scattered Spider as initial access, DragonForce as extortion affiliate. Co-op and Harrods fall in the following days with the same playbook. £300M declared impact. VM lab with compensating control.
· Manuel López Pérez
news · 9 min
M&S falls on 25 April via social engineering against the TCS helpdesk — Co-op follows on the 29th with the same vector — Harrods contains on 1 May. Llama 4 arrives with LMArena controversy. GPT-4.1 ships on the 14th, Gemini 2.5 Pro on 25 March. 4chan hacked on the 14th. Patch Tuesday with a CLFS zero-day exploited by RansomEXX.
· Manuel López Pérez
ai-security · 11 min
On 5 April Meta releases Llama 4 — Maverick, Scout and Behemoth in training. Three days later it becomes clear the version uploaded to LMArena isn't the one in the repo: it's tuned for human preference. Textbook case for why safety benchmarks don't transfer when the evaluated model isn't the deployed one.
· Manuel López Pérez
ai-security · 14 min
In November 2024 Anthropic published MCP and the analysis was at spec level — what the protocol said and what it left to the implementer. In April 2025, Invariant Labs publishes the first paper on Tool Poisoning Attacks: MCP servers hiding adversarial instructions in tool descriptions. Cursor, Claude Desktop and Copilot read those descriptions as prompt and obey. Reproducible PoC with the Python SDK.
· Manuel López Pérez
news · 11 min
Invariant publishes the first paper on MCP tool poisoning. Patch Tuesday with six zero-days, two NTFS and one MMC via PipeMagic. iOS 18.4 ships on the 31st with 150+ CVEs. Chrome CVE-2025-2783 exploited by Operation ForumTroll. tj-actions/changed-files compromised and leaking secrets from 23,000 repos. Oracle Cloud denies a breach that CloudSEK documents. Signalgate.
· Manuel López Pérez
news · 14 min
The AI Act Art. 5 enters application on 2 Feb and Vance buries the multilateral consensus in Paris on 11 Feb. TraderTraitor exfiltrates $1.5B from ByBit via Safe{Wallet}. Apple withdraws ADP in the UK. Anthropic releases Claude 3.7 Sonnet with visible reasoning. Storm-2372 scales device code phishing. DOGE enters and exits Treasury via court order.
· Manuel López Pérez
tutoriales · 17 min
On 21 February 2025, TraderTraitor drains 401,347 ETH from ByBit's cold wallet. The multi-sig has no bug, the blockchain has no bug: what breaks is the visualisation chain. JavaScript injected into app.safe.global from a Safe developer machine compromised by a malicious Docker project 17 days earlier. The signer sees a routine transfer; what they sign is a delegatecall that rewrites slot 0 of the proxy.
· Manuel López Pérez
ai-security · 39 min
Twelve months across ten axes. 2024 is the year AI infrastructure emerged as a category with its own CVEs, agents moved from the lab to product (Claude Computer Use, MCP, Salesforce Agentforce), regulation became applicable (EU AI Act in force 1 August, NIS2 deadline 17 October, NIST AI 600-1), and jailbreaks professionalised with reproducible metrics (ArtPrompt, Many-shot, Skeleton Key). Underneath, Recall shipped without threat modeling and got pulled, Arup lost $25M on a deepfake video call, and the pre-positioning chain of incidents (Volt Typhoon, Salt Typhoon, Storm-0558 fallout) runs through the whole year. Canonical annual reference.
· Manuel López Pérez
