Researchers who found the bug warn that its Moderate rating understates a threat reaching across LLM gateways, MCP servers ...

安全研究人员警告称，全球数百万个AI Agent和工具正受到一个严重漏洞的威胁，该漏洞可能允许黑客入侵运行它们的服务器，并窃取敏感数据和第三方账户凭证。该漏洞存在于Starlette中，这是一个开源框架，其开发者称每周的下载量为3.25亿次。数千个其他开源项目也存在漏洞，因为它们需要Starlette才能工作。该框架是异步服务器网关接口（Asynchronous Server Gateway In ...

A serious security vulnerability in a widely used open-source Python component could put a large number of AI agents ...

如果你正在用WebSocket给LLM应用做token流式传输，上面这些坑你大概率踩过。WebSocket确实能干活，但它带来的麻烦也不少：连接 ...

The ChromaToast vulnerability can be exploited by forcing the ChromaDB API server to fetch and load maliciously crafted AI ...

我本来以为高速模型就是“回复快一点”，直到我用它做了两个完整的产品开发。是从 PRD 出发，做视觉原型、搭前后端、设计数据结构、写接口、修 bug，最后交付一个能打开、能点击、能截图的产品。整个过程不到 20 ...

A token leaks. A bad package slips in. A login trick works. An old tool shows up again. At first, it feels like the usual mess. Then you see the pattern: attackers are not always breaking in. They are ...