Full Archive · Page 25

Research archive, page 25

Browse entries 577–600 of 1704. Return to the first page to search and filter the complete collection.

Give agents separate tokens with a permission ceiling and independent revocation video thumbnail Play video
AI Engineer October 23, 2026 video

Give agents separate tokens with a permission ceiling and independent revocation

Isabelle Williams’ travel-app demo distinguishes a user’s authority from an agent’s scoped token. Agent permissions are the intersection of user permissions and an agent blueprint. A funding agent can rebalance within an existing budget but cannot raise that budget. Separate identity supports attribution and revocation. The demo is not an independent security assessment.

The Hacker News AI Security August 18, 2026 news

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

CVE-2026-64849 is an unauthenticated SSRF flaw in MLflow model-registry webhooks that lets anyone reaching a vulnerable Tracking Server proxy requests to internal services and cloud metadata endpoints. The redirect handling bypasses earlier fixes, and honeypot telemetry showed indiscriminate scanning within hours of disclosure aimed at stealing cloud credentials and secrets. MLflow fixed the issue in 3.15.0.

METR February 18, 2026 analysis

Protecting confidential model evaluations: visible labels and technical access boundaries

METR’s February account describes confidentiality levels, project-specific access, codenames and practice handling sensitive questions. Technical measures include centrally managed membership, restrictions on external sharing, device controls and authorization for model transcripts. The useful distinction is between norms that reduce conversational slips and controls that restrict access.