The METR attacker spent three weeks inside a researcher's cloud instance and touched nothing sensitive. They burned roughly $600,000 in inference credits instead, and that should change how you handle your own keys more than any data breach this year. Short version: a researcher ran agents on a...
1 points, 0 comments on Hacker News
1 points, 0 comments on Hacker News
1 points, 0 comments on Hacker News
I work on Callejear, an independent project for exploring municipal data in Spain. We recently exposed a read-only MCP service for Madrid. The useful engineering lesson was that making data callable is only part of the job: the response contract must also prevent an assistant from drawing concl...
In the first post I shared a . NET 10 starter template and listed what it doesn't do yet. The biggest item on that list was this: any authenticated user could update or delete any product.