Uddeshya Kumar @CybrokX

@TheNewspinch @samrat4bjp @BJP4India @PrashantKishor @jansuraajonline @samrat4bjp This is no longer an isolated incident. It’s becoming a pattern. Take exemplary action so that anyone planning something like this thinks a thousand times before acting. @myogiadityanath @narendramodi @BJP4India @Republic_Bharat

@TheNewspinch @samrat4bjp what’s your course of action on this incident ? Or, do you want to end up like education minister ? cc: @BJP4India @PrashantKishor @jansuraajonline

Small Cloud misconfiguration leads to exploitation infosecurity-magazine.com/news/attackers…

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI @googlecloud cloud.google.com/blog/topics/th…

He has asked very concerning questions and it has already started impacting lot of lives….

Pritam Chauhan @Im_pritam18

4 weeks ago

Dr. Pratosh at IISc Bengaluru tells his students that rapid advances in AI are commoditizing intellectual labour. He raises an unsettling question: if companies stop recruiting on campus in the next 5–10 years—even at India’s top universities—what will the purpose of a

408 3K 14K 3.4M 17K

A standard chatbot isn't enough for today's threats. Defenders need specialized agents working autonomously around the clock. How do you teach them your methodology? By turning your analysts' expertise into code! 💻 Build a custom multi-agent SOC 👉 goo.gle/3UyOHnq

@narendramodi 💯💯

@narendramodi @narendramodi @modi_jee please watch this is genuine concern from jaipur, Rajasthan youtube.com/shorts/uYhoDA4… @AdvisorLaborLaw has posted this on youtube. Thanks

RBAC is dead for AI Agents. Static permissions were built for predictable human behavior. They fail when agents can plan and execute across dozens of tools in dynamic contexts. Tweet 2/8 The fundamental problem: • Too broad access = massive attack surface • Too restrictive = agent becomes useless • No context = easily manipulated via prompt injection We need to shift from “What can this identity do?” to “What should this agent be allowed to do right now?”

🚨 Supply Chain Alert: Malicious [email protected] npm release On July 11, 2026, version 8.14.0 of the official jscrambler package (~15.8k weekly downloads) was published under a legitimate maintainer account, bypassing the project’s normal release process. The malicious release added an undocumented preinstall hook that drops and silently executes a cross-platform Rust infostealer. The malware targets developer and CI machines with the following capabilities: • Steals cloud credentials (AWS, Azure, GCP — including metadata service endpoints) • Exfiltrates crypto wallets/seed phrases, browser passwords/cookies, and sessions (Discord, Slack, Telegram, etc.) • Specifically harvests AI tooling credentials — API keys and Model Context Protocol (MCP) creds from Claude Desktop, Cursor, Windsurf, VS Code, and Zed • On Linux: Loads an eBPF program from memory for potential kernel foothold • Implements anti-debugging and persistence (Windows scheduled task, macOS LaunchAgent) The package was flagged by Socket Security within 6 minutes. StepSecurity and SafeDep confirmed the behavior through static + runtime analysis. Jscrambler published clean follow-up versions (starting with 8.15.0), but 8.14.0 was never yanked and additional malicious variants were also pushed. Immediate Actions: 1. Audit all lockfiles and CI logs for [email protected] (or any post-July 11 versions). 2. Do not install or retain 8.14.0. Pin to a verified clean release (e.g. 8.13.0) or upgrade to the latest confirmed clean version and regenerate lockfiles. 3. If any install occurred: Assume full credential exposure. Rotate cloud keys, npm/GitHub tokens, AI/MCP keys, and revoke browser/sessions immediately. 4. Prefer npm 12+ (install scripts disabled by default) and integrate real-time dependency scanning. This incident highlights the continued risk of install hooks and the high value attackers place on developer machines — especially those with access to AI tooling and cloud infrastructure. Full analysis: thehackernews.com/2026/07/compro… #AppSec #SupplyChainSecurity #npm #DevSecOps #AISecurity #CyberSecurity

Prompt injection just leveled up to Promptware. New 7-stage kill chain: 1. Initial Access 2. Privilege Escalation (Jailbreak) 3. Reconnaissance 4. Persistence (Memory/RAG) 5. Command & Control 6. Lateral Movement 7. Actions on Objective 21+ real attacks already follow it. Paper: arXiv:2601.09625 Defense-in-depth for AI agents is mandatory now. #AISecurity #Promptware #LLMSecurity

👉 squeez: github.com/claudioemmanue… 👉 token-saver: github.com/ppgranger/toke… 👉 snip: github.com/edouard-claude… 👉 headroom: github.com/chopratejas/he…

Stop installing random CLI tools that hook into Claude Code and Cursor. Some of the most popular "token saver" tools are silently breaking your permission rules the moment you install them. Your custom deny rules? They stop working. All so you can save a few tokens. Security teams are sleeping on this.

If you’re tired of AI projects getting stuck in security review hell or worried you’re shipping something that’s going to blow up later — reply “AUDIT” or DM me. I’ll send you the scope and we can talk. Limited slots for July & August. Only taking 8 this quarter.

What you get is simple: • Clear mapping of your AI attack surface and data flows • Honest threat modeling focused on the risks that actually matter • A prioritized playbook (not a 50-page report nobody reads) • Quick wins you can implement in weeks, not quarters • A proper debrief so your whole team is aligned No theater. No checkbox exercises. Just clarity.

Most of the AI security advice floating around in 2026 is actively making systems worse. Teams are adding guardrails that break functionality, running pointless red teams, and still getting breached because they’re solving the wrong problems. I’ve seen this pattern too many times. The uncomfortable truth 👇 #AISecurity #LLMSecurity #SecureAI #CyberSecurity #RAGSecurity

I just filed my income tax return using @AnthropicAI Claude Desktop App. No CA. No accountant fee. No 3 hours on the portal. Here's exactly what happened 👇 I gave it my Form 16s and told it to file ITR-1. It opened the income tax portal, cross-checked my salary against AIS, caught a discrepancy I didn't even know existed, handled a mid-year employer switch automatically, recovered from session timeouts on its own, fixed a validation error the portal threw mid-filing — and submitted. The whole thing ran like a CA sitting next to me. We are genuinely at a point where AI can navigate government portals, read tax documents, spot errors, and file on your behalf. The prompt I used is in the comments. Free. If you're a salaried employee filing ITR-1 this season — try it before you pay someone else to do it. #ITRFiling #AITools #IndiaFinance #TaxSeason #ProductivityHack #AI #HumanInLoop