When prompts become shells: the tool registry is the attack surface

<h2> TL;DR </h2> <p>While building a public advisory database for the Model Context Protocol (MCP)<br /> ecosystem, we unpacked and read the shipped code of 30+ npm packages

<h2> When Agentic AI Breaks Your Pricing Model </h2> <p><a href="https://github.blog/news-insights/company-news/changes-to-github-copilot-individual-plans/" rel="noopener

<p>Every prompt injection defense I’ve seen makes the same mistake. It asks the wrong question.<br /> The wrong question: “Does this prompt contain dangerous words?”<br /> The

<p>On March 24, 2026, attackers published backdoored versions of LiteLLM to PyPI. The malware harvested cloud credentials, SSH keys, Kubernetes tokens, and pretty much everything

<p>A local LLM that can read your files is genuinely useful. A local LLM that can read your files <em>without guardrails</em> is a path-traversal bug with a chat interface.</p>

<p>Three incidents landed in five days this week. Different attack surfaces, different techniques, different threat actors. What they have in common is that none of them required

<p>I've been writing software professionally since 2011.</p> <p>Java, C#, Kotlin, Node.js. Enterprise backends, microservices, APIs, data pipelines. I've shipped production code

<!-- SC_OFF --><div class="md"><p>Been working with agents that can execute tools (shell, APIs, etc.) and noticed a gap:</p> <p>Unsafe behavior doesn’t show up in the prompt or