Developer Advocate @Snyksec | Prev @Microsoft @Disney | Web dev and app sec things. Here for community, fun and learning. Not for numbers or influencing you.
More here 👉
Joined January 2014
- Tweets6.5K
- Following1.1K
- Followers6K
- Likes12.5K
Anyone else getting a sense for what generation someone is in by how often they use the word “literally”?
Whenever bun has a new release I enjoy the videos that go with them😁
youtu.be/i38DgEuaJwM
It was amazing being able to knock out 4 PRs while on a plane. Kick off a cloud agent task, go watch a show, get alerted things are done, review, merge, move on to the next one.
I’m really enjoying this workflow especially when I’m on the go but I’m disappointed to see that @OpenAI no longer supports it. Why did they change this?!
Phone → choose code project → delegate task → cloud agent works independently → review results/PR from phone
Brian Clark retweeted
If your Instagram is public, Meta just enrolled you in something you didn't agree to.
Their new AI tool, Muse Image, lets anyone @-mention your Instagram handle in Meta AI and generate images using your face and photos. launched Tuesday. opt-in by default. no notification when it happens.
→ you won't be told when someone creates an AI image of you
→ opting out only stops future generation; anything already made stays live
→ there's no mechanism to remove images created before you opted out
how to turn it off:
Instagram → Profile → Menu (☰) → Sharing and Reuse → turn off Posts and Reels under "Allow people to reuse your content on Instagram and with AI features at Meta"
note: the setting is still rolling out. if you don't see it yet, keep checking.
if you want the strongest protection right now: go private.
A fun test to see how well you do at checking agentic AI permissions: llmgame.scalex.dev/
Brian Clark retweeted
Versions of
- laravel-lang/lang
- laravel-lang/http-statuses
- laravel-lang/attributes
- laravel-lang/actions
have been published with malicious versions
Packagist has unlisted the packages, but if you installed any of them between May 22–23, treat the environment as compromised
Your first instinct after getting hit by the TanStack npm attack is to revoke your GitHub token.
Don't.
The malware polls GitHub every 60 seconds. Gets a 401? It runs rm -rf ~/
Here's the right remediation order before you touch a single credential. youtu.be/YrwM2EFYrUY
Brian Clark retweeted
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
Brian Clark retweeted
A government contractor just leaked a ton of sensitive info including admin passwords for CISA's AWS GovCloud accounts - all to a public GitHub repo.
CISA says they "hold our team members to the highest standards of integrity and operational awareness"
Followed by evidence of them turning off basic GitHub defaults that would protect from publishing secrets. And dictionary passwords that were the name of the service + the year.
Brian Clark retweeted
💥 Game changer for Web Development announced at GoogleIO- Modern Web Guidance! It’s expert-vetted skills for web development based on best practices of latest specs and APIs.
It ensures your agent/coding harness doesn’t default to older and out of date patterns to build sites.
Brian Clark retweeted
We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.
The timing of this is perfect. I just had a scenario where having learned something on my own helped me catch a bad suggestion by AI...
More and more companies are deploying AI-generated code into production. Much of that code contains vulnerabilities. Making traditional AppSec struggle to keep up.
@snyksec + @AnthropicAI's Claude = security at AI speed
👇
snyk.io/news/snyk-embeds-ant…
Brian Clark retweeted
Looking forward to chatting with @_clarkio today! Happening in 5 hours. Come hang with us!
youtube.com/live/nt8KvxQiGmM…
Any guesses on when the same happens at Anthropic, OpenAI, Cursor?
I think it's gonna be in the next 2-3 months.
github.blog/news-insights/co…
