AI security tools

Meta and Microsoft are reported to have taken steps to limit their employees' use of Anthropic's Claude AI assistant. The move suggests the two tech giants want staff relying on internal or approved AI tools rather than a direct competitor's product. Further details about how the restrictions are enforced have not been made clear.

Greg Kroah-Hartman, the longtime Linux kernel maintainer who leads the stable kernel branch, is featured in a talk on what large language models mean for software security. The discussion covers how LLM tools change the threat landscape for kernel and open-source development, and how maintainers should respond. The talk is drawing attention among developers debating AI's impact on critical infrastructure code.

Replit has given a first look at a secure desktop application for Windows that runs AI workloads in isolated sandboxes. The preview highlights stronger safety and local performance for coding with AI assistance directly on the desktop. Developers are discussing what the sandboxing approach means for security and whether the app will reduce reliance on the browser-based Replit workspace.

Security discussions are highlighting a prompt injection risk in GitHub Copilot CLI: carefully crafted web pages containing hidden 'zombie' instructions could manipulate the coding assistant into revealing secrets or performing unintended actions when it processes content from those pages. Commenters warn that developers using AI tools in terminals may be exposed if the tool cannot distinguish trusted instructions from malicious text embedded in the material it reads.

A question on Hacker News is asking which frontier AI models are capable of performing code security reviews. The discussion seeks recommendations on which large language models can reliably audit code for vulnerabilities. With few replies so far, the thread reflects a broader interest among developers in using AI tools for security analysis.

A new open-source tool called AI Agent Gateway has been released, designed to keep credentials out of AI agent configurations. The gateway handles authentication separately so agents never store sensitive keys directly in their configs. Coverage highlights it as a practical security improvement for teams deploying AI agents, where hard-coded credentials have become a common risk.

Security discussions are warning that prompt injection attacks are moving beyond chatbots to AI coding agents. The concern is that malicious instructions can be hidden in everyday development files, with a README alone potentially enough to manipulate an agent into harmful actions. Developers are being urged to treat repository content as untrusted input as AI tools increasingly read and execute instructions from codebases.

Amazon Web Services has introduced Strands Box, a tool for running AI agents in isolated sandboxes, built on its Dogwood technology. The sandboxes give agents a controlled environment to execute code and tasks safely. The announcement adds to AWS's growing Strands agent toolkit as companies look for secure ways to deploy autonomous AI systems in production.

The Pentagon has started a pilot program that will use artificial intelligence to handle and manage sensitive information within the US Department of Defense. The initiative, reported by DefenseScoop, signals the Pentagon's growing interest in applying AI tools to core administrative and data-management functions. The news is drawing attention because of the obvious security implications of letting AI systems handle classified or sensitive government material.

Amazon Web Services has published the first part of a technical guide on building an AI vulnerability harness, a framework for testing AI systems for security weaknesses. The article walks readers through setting up tooling to probe machine learning models and AI applications for exploitable flaws. It is aimed at security engineers and developers who are adapting traditional penetration testing practices to AI systems, and further parts of the series are expected.

Meta and Microsoft are reportedly restricting employees from using Anthropic's Claude AI tools for their work. The move, reported by tech news outlets, underscores growing caution among major AI developers about relying on rival companies' chatbots and coding assistants, likely over concerns about data security, confidentiality and competitive sensitivity. The story is drawing attention in tech circles as competition between AI providers intensifies.

Temporal Technologies, the fast-growing Seattle-area workflow orchestration company, has hired the team from New York security startup Oso to develop security controls for AI agents. The acqui-hire reflects growing industry concern over how autonomous AI systems are authenticated and governed. Oso, known for open-source authorization tooling, will wind down as its engineers join Temporal's security efforts.