Incident Analysis ·
Polymarket, Binance and the Limits of a Security Agent
The October incidents raise practical questions about third-party scripts, signing authority and where a security agent can help.
Security Blog
Implementation notes, threat analysis, and release history. For current supported controls and their prerequisites, use the security guides.
Threat Intelligence ·
v0.4.29: Safer Automatic Response, Clearer Limits
1-SEC now keeps capacity warnings separate from attack evidence, protects victim files from automatic quarantine, and prevents aggregate traffic alerts from targeting an incidental process. The update also bounds detector state and protects large byte counts.
Incident Analysis ·
France’s Supermarket Attack: How 1-SEC Can Stop Unauthorized Access Earlier
The refrigeration attacks in France show how exposed management interfaces can become a route to physical disruption. 1-SEC v0.4.24 adds a general access decision that trusted gateways can enforce before forwarding management requests.
Threat Intelligence ·
v0.4.25 Security Update: TLS Trust and Detection Reliability
v0.4.25 includes patched TLS trust, Go-to-Rust event compatibility, safer media screening, and more reliable ransomware and crypto assessment. Updated binaries are available for six platform targets.
Release Notes ·
v0.4.21: Blocking Security Gates, Windows ARM64, and Verified Release Artifacts
1-SEC v0.4.21 hardens profile and parser boundaries, turns vulnerability scans into blocking release gates, fixes Rust engine version reporting, adds a native Windows ARM64 engine, and verifies every published artifact with checksums, Sigstore bundles, and GitHub provenance.
Threat Intelligence ·
Weekly Threat Intelligence: Go ECH Privacy, Agent URI Abuse, Safetensors, and CRLF Metrics
A 21-day catch-up cycle reviewed 234 threat records, patched a reachable Go TLS privacy flaw, and hardened agent URI handling, safetensors validation, and metric injection defenses without adding modules or runtime dependencies.
Threat Intelligence ·
Weekly Threat Intelligence: vLLM Embedding Abuse, Agentic Worms, Dynamic RBAC, and BYOVD Drift
The June 27 intelligence cycle reviewed 216 high-signal items and shipped sparse tensor and multimodal embedding validation in the Data Poisoning Guard while re-verifying existing defenses for PDF FlateDecode, MCP injection, and deep binary inspection.
Announcement ·
Maintenance Update: Safer Defaults, Cleaner Installs, and Quieter Operations
A maintenance release focused on safer first-run defaults, verified installs, cleaner Kubernetes health checks, and stronger handling of sensitive settings.
Threat Intelligence ·
Weekly Threat Intelligence: AI Support ATO, Dynamic MCP Injection, TOCTOU, and SSH Exhaustion
The June 6 intelligence cycle reviewed 237 high-signal items and pushed 1-SEC deeper into agentic account takeover defense, dynamic MCP server injection prevention, execution-time integrity checks, SSH channel exhaustion handling, and deep binary inspection without adding runtime dependencies or new modules.
Threat Intelligence ·
Weekly Threat Intelligence: SSH Crypto Flaws, ChatGPhish Markdown Poisoning, and Deep-Buffer Binary Inspection
The May 29, 2026 threat cycle surfaced critical Go SSH cryptography vulnerabilities, agentic markdown exfiltration via third-party poisoning, and deep-file memory corruption RCEs buried inside large buffers. Here is what the audit found and what 1-SEC hardened immediately.
Engineering ·
Platform Reliability Update: Local Dashboard and Secure Cloud Operations
1-SEC v0.4.26 adds an optional local GUI and coordinates secure cloud enrollment, billing access, key rotation, instance-bound commands, and paginated history while preserving independent CLI operation.
Engineering ·
Runtime and Deep-Buffer Hardening: Closing Short-Lived LPE and Buried Payload Gaps
1-SEC now watches short-lived Linux runtime artifacts in real time and streams large payload fields through the Rust sidecar in bounded chunks, improving coverage without changing the operating model customers rely on.