Implementation notes, threat analysis, and release history. For current supported controls and their prerequisites, use the security guides.
Threat Intelligence ·
In this roundup the 1-SEC threat intelligence team walks through the May 3 intelligence cycle—253 reviewed items spanning CISA KEV, NVD, the Go Vulnerability Database, and ten editorial feeds—along with NATS dependency hardening and new AI Containment checks for hostile tool payloads, all without expanding the runtime dependency footprint.
Threat Intelligence ·
The April 23 threat cycle pushed hard on revoked-token reuse, trusted webhook abuse, dangerous AI-generated defaults, poisoned model artifacts, and parser-level file exploits. Here is what shifted in the threat landscape and what 1-SEC now covers by default.
Announcement ·
Weekly threat intelligence reports and release notes are temporarily paused while 1-SEC is under active evaluation across multiple hackathons. Development continues — public updates resume after judging wraps.
AI Agent Security ·
We took the detection knowledge from 1-SEC's 16 modules and built it into a GitLab Duo agent. SQL injection, prompt injection, secret scanning, OWASP compliance — all from Duo Chat. No install, no config, no context switching.
Threat Intelligence ·
Our March 24 vulnerability audit uncovered 217 threats across 12 sources. Here's what we found, what we shipped to stop it, and how 1-SEC's single-binary architecture keeps you protected without bolting on extra dependencies.
AI Agent Security ·
AI agents need third-party API access to be useful, but handing them raw OAuth tokens is a security nightmare. Here's how Auth0 Token Vault and 1-SEC's AI Containment module work together to enable secure, monitored, revocable token delegation for autonomous agents.
Release Notes ·
Implements 7 action items from the weekly vulnerability intelligence pipeline. Adds Unicode NFKC normalization bypass detection (CVE-2026-25673), management interface RCE signatures, agentic PII exfiltration heuristics, agent goal-action alignment monitoring, delegation chain verification, a 9-phase Unicode folding normalizer, and C2 beacon jitter analysis in the Rust sidecar.
Release Notes ·
9 new detections across 5 Go modules and the Rust sidecar covering CVE-2026-26331 (yt-dlp RCE), CVE-2026-25545 (Astro SSRF), CVE-2026-20127 (auth bypass), indirect prompt injection via zero-width characters, agent lateral movement tracking, PQ curve inventory auditing, and polyglot file magic byte validation.
AI Agent Security ·
AI agents are under siege — 341 malicious skills on ClawHub, CVE-2026-25253, the Moltbook breach, $1.78M lost at Moonwell, and credential leaks across every major framework. Today we ship a SKILL.md that lets any AI agent install full-stack security on its own host in one command.
AI Security ·
We audited the entire 2025-2026 prompt injection landscape, found 9 gaps in our detection, added 16 new regex patterns, and built a 750-line multimodal scanner that catches hidden injections in images, PDFs, and HTML — all in pure Go with zero ML dependencies.
Agentic AI Security ·
The OWASP Top 10 for Agentic Applications 2026 identifies critical vulnerabilities in autonomous AI systems. Here's how each risk maps to real attacks and how to defend against them with open source security tooling.
Agentic AI Security ·
AI agents are browsing the web, ingesting llms.txt endpoints, and making autonomous payments via x402. This creates an entirely new attack surface. Here's how 1-SEC detects and stops agentic web threats with zero external dependencies.