Claude Opus 4.6 exploited a gym API flaw in 9 of 10 controlled tests, highlighting security risks when AI agents gain backend access.
The post Claude Opus 4.6 Found a Gym API Flaw — Then Exploited It in 9 of 10 Tests appeared first on TechRepublic.
Security researchers found 150 lookalike Open VSX extensions published under trusted names, highlighting how extension marketplaces can expose developer credentials, source code, and CI/CD systems to supply-chain risk.
The post 77 Counterfeit Open VSX Extensions Collected Developer and CI/CD Data appeared first on TechRepublic.
There’s something very attractive about saying “we embed very closely with our customers and just figure it out with them”, especially since the company that started “forward deploying engineers” is growing 84% with $5B+ revenue. But “forward deployed engineer” is a vague term and means different things depending on the business you’re running.
I spent almost 5 years at Palantir as a forward-deployed software engineer, and Palantir’s version of an “FDE” does not make sense for most companies I now meet as an early-stage VC. Depending on the type of business you’re building, this role could broadly mean one of two things: “the product builder” or “the platform operator.” Clearly defining which bucket you fall into will make it easier to hire for this role and run your FDE org.
Kabir Sial
The north star is: do whatever it takes to actually solve the user’s problem. FDEs are not just responsible for making the platform work, but also discovering what to build and building it (actually creating software) in service of the customer.
The north star is: make the product work for the customer – deploy and operationalize it. This is what most startups today really mean when they want FDEs. FDEs here configure the core platform, manage account relationships and drive adoption. This is not new – companies have always had solutions engineers, sales engineers, customer success etc., although the work looks different as FDEs are increasingly building prototypes, configuring evals and building MCPs.
Kabir Sial
For most situations, hiring product builder FDEs is a mistake.
At scale, the FDEs should be the platform operator. It’s hard to have FDEs build and maintain highly custom product features, especially as the company scales. Over time, the custom product surface area distracts from building the core product, even though AI coding tools make it easy to ship new features quickly and maintain them.
Many fast-growing AI startups recognize these constraints and structure the FDE role more like the platform operator. This also allows them to have 5-10 accounts per FDE, which is a much higher ratio than Palantir had (at least in 2023). Even the Palantir FDE role has evolved to look more like the platform operator.
There are, however, situations when your FDEs should be the product builder archetype.
Technical complexity: Large customers have complex environments with legacy infrastructure that often requires “out-of-platform” engineering work. I often encountered bespoke data infrastructure, privacy requirements, etc. at various Palantir customers that required me to build “out-of-platform” connectors, UIs and backends.
Organizational inertia and trust: Serving large enterprises is about building trust. In short time periods, overfitting product to a specific user/workflow is often what delivers the most value, builds trust and helps organizations get over the inertia of moving away from Excel and legacy software tools that are part of their day-to-day workflow. For AI-native startups, it’s arguably even more important to invest in doing “unscalable” development with engineering boots on the ground, as it helps solidify your right to exist and eventually expand the customer relationship.
If you have a broad range of ICPs and workflows that you serve, your product probably is not walk-up usable on day 1 of deployment. The short-term hacky things that product builder FDEs build to make the product work for these heterogeneous users/workflows will help you shape the product long-term.
Kabir Sial
Note: see Palantir Foundry’s architecture here.
This was a big reason why Palantir FDEs were more like product builders (and are still able to – see the Forward Deployed Software Engineer job profiles as an example). The vision for Foundry was to be the operating system for an enterprise’s critical decisions – inherently multiple industries, users and workflows. A lot of FDE-led development showed that solving many of these use cases required complex data integrations, which led to the early versions of Foundry being best-suited for complex data integrations and building a customer’s “Ontology”. Similarly, FDEs like myself built custom frontend applications for fraud analysis, pricing, etc. As certain patterns of what these applications required became more clear, they were centralized into an application-layer product.
Kabir Sial
Kabir Sial
Platform operator: There is a much broader set of people you could hire, testing for technical fluency (e.g., being good at data analysis, complex Excel work, even SQL), product intuition and an inclination to build customer relationships. Backgrounds like technical customer success, solutions engineering, software engineering, product management and consulting are all strong fits.
Product builder: You want candidates that are high ownership and missionary software engineers, or technical PMs who want to ship products themselves.
Hiring for these profiles, especially product builders, is hard. It’s worth calling out two things that helped Palantir hire software engineers into what might be considered a less sexy role.
As founders building AI startups think about hiring FDEs, it’s worth being specific about your culture and asking: Am I just hiring people to support development teams, or am I hiring people to shape and build product? It’s hard to get software engineers (even today) to be excited about an FDE role that might just be technical customer success.
You’ve hired the right people. How do you best leverage your team of FDEs?
FDEs were Palantir’s way of delivering outcomes rather than tools. AI-native startups can take this much further and FDEs can help in a few unique ways by leveraging their proximity to customers.
GitHub’s new Actions safeguard pauses potentially malicious workflow runs before execution, leaving repository owners to decide who can approve them and what checks must come first.
The post GitHub Automatically Holds Suspicious Actions Runs, but Repository Owners Must Approve Them appeared first on TechRepublic.
Cursor has patched a high-severity Windows vulnerability that allowed malicious Git repositories to execute code, highlighting security risks in AI coding environments.
The post Cursor Quietly Patches High-Severity Git Vulnerability After Seven-Month Delay appeared first on TechRepublic.
Hugging Face says an autonomous AI agent carried out a cyberattack against its production systems, highlighting the growing role of AI in offensive and defensive cybersecurity.
The post Hugging Face Says Autonomous AI System Executed Multi-Stage Cyberattack appeared first on TechRepublic.
SpaceXAI open-sourced Grok Build under Apache 2.0 after privacy backlash over broad directory uploads from its terminal AI coding agent.
The post SpaceXAI Open-Sources Grok Build After Privacy Backlash appeared first on TechRepublic.
An exposed WP-SHELLSTORM server revealed tools, logs, cloud credentials, and thousands of webshells used in a large website hacking campaign.
The post Exposed Server Reveals 25,000 Compromised WordPress Websites appeared first on TechRepublic.
China warned organizations to remove certain Claude Code versions over alleged backdoor risks, while Anthropic called the feature anti-abuse protection.
The post China Warns of Claude Code ‘Backdoor’ Security Risk appeared first on TechRepublic.
OpenAI is set to launch GPT-5.6 after a US security review, raising new questions for enterprise AI access, safeguards, and governance.
The post OpenAI’s New GPT-5.6 Is Coming Sooner Than You Think appeared first on TechRepublic.
Accenture confirmed a breach after a hacker claimed 35GB of source code and cloud keys were stolen, raising questions for cloud and security teams.
The post Hacker Claims Accenture Breach Exposed Source Code, SSH Keys, and Azure Tokens appeared first on TechRepublic.
Five independent security disclosures in a single week point to the same gap: AI agent permissions, not AI agent capabilities, are the problem enterprises haven't solved.
The post AI Agents Are Creating a New Enterprise Security Gap appeared first on TechRepublic.
Researchers say Apple’s Hide My Email flaw may expose real addresses, despite two fixes. Here’s what users should know about the privacy risk.
The post Apple’s ‘Hide My Email’ Privacy Flaw Exposes Real Email Addresses appeared first on TechRepublic.
LayerX found that BioShocking could trick AI browsers into leaking credentials by disguising malicious prompts as game rules.
The post New BioShocking Attack Tricks AI Browsers Into Leaking Credentials appeared first on TechRepublic.
Android 17 is rolling out to supported Pixel devices first, while non-Pixel users and IT teams face separate OEM timelines, beta programs, and app-testing considerations.
The post Android 17 Is Live on Pixel, but Samsung and Other Android Users Still Have to Wait appeared first on TechRepublic.
At the end of 2024, we’ve reached a moment in artificial intelligence (AI) development where government involvement can help shape the trajectory of this extremely pervasive technology.
In the most recent example, the Department of Homeland Security (DHS) has released what it calls a “first-of-its-kind” framework designed to ensure the safe and secure deployment of AI across critical infrastructure sectors. The framework could be the catalyst for what could become a comprehensive set of regulatory measures, as it brings into focus the significant role AI will play in securing key infrastructure systems.
As Secretary Alejandro N. Mayorkas put it, “AI offers a once-in-a-generation opportunity to improve the strength and resilience of U.S. critical infrastructure, and we must seize it while minimizing its potential harms. The framework, if widely adopted, will go a long way to better ensure the safety and security of critical services that deliver clean water, consistent power, internet access and more.”
Mayorkas’ statement underscores the urgency of getting it right, as today’s decisions will profoundly shape how AI impacts vital systems in the future.
The framework lays out clear roles and responsibilities for the parties involved in AI development and deployment for critical infrastructure.
Risk management guidance: DHS suggests an approach that incorporates ongoing risk management, advising stakeholders to continually identify, assess and mitigate potential AI risks. The recommendation includes adopting transparent mechanisms to track AI decisions that could impact essential services.
Ethical standards for developers: The guidelines stress the importance of incorporating ethical considerations into AI design, and make a push for responsible practices that minimize harm and ensure equitable treatment.
Collaboration across sectors: Recognizing the interconnected nature of infrastructure, DHS is promoting collaboration between public and private sectors to share best practices and vulnerabilities effectively. Information sharing is always a great way to minimize the risks brought about by both deliberate attacks and unintended failures.
Incident response preparedness: The framework also outlines how AI developers and operators should prepare for potential incidents; clear protocols must be in place to quickly address issues before they escalate.
Explore AI cybersecurity solutionsOne of the most notable aspects of the DHS report is the explicit focus on the responsibilities of AI developers.
The guidelines set a new precedent by outlining clear expectations, especially for those creating AI tools meant to operate in or interact with critical infrastructure.
This focus on developers is particularly important because they are at the forefront of creating technology that directly influences critical systems. The decisions made during the design, development and deployment phases can have significant consequences and impact everything from public safety to national security. By giving developers a structured set of responsibilities, DHS is hoping to create a culture of accountability and foresight in the AI community.
As such, AI developers are encouraged to take the following actions to align with the new guidelines.
Design with risk in mind: Developers are urged to build AI systems that prioritize safety and resilience from the ground up, especially when the technology is intended to interact with critical services like power grids or communication networks. This means integrating fail-safes, conducting stress tests and simulating potential failure scenarios during the design phase.
Adopt explainable AI practices: Transparency is crucial for AI developers. The framework urges the adoption of explainable AI techniques that allow human operators to understand why certain decisions were made. This practice boosts trust while also providing an audit trail that can be useful in identifying the root causes of any issues that arise.
Collaborate for broader impact: Developers should not just work alone but actively engage with a broader community of stakeholders, including policymakers, users and other tech creators. After all, collaboration helps ensure that AI tools are safe, reliable and ready to operate under real-world conditions.
By following these guidelines, developers can help build AI systems that meet technical standards and also align with societal values and safety requirements. The focus on explainable AI, risk-based design and collaboration creates a balanced approach that can maximize the benefits of AI and minimize its potential downsides.
The release of the AI framework is a good reminder that AI technology is not evolving in a vacuum. Today, AI is more pervasive than ever before, but its use in critical infrastructure demands the highest level of care and responsibility. With the focus on developers as important players in minimizing risks, the DHS is creating an environment where AI can thrive without compromising essential public services.
It’s important to note that the responsibility for secure AI extends beyond the developer stage. Tech organizations will play a key role as well. Arvind Krishna, Chairman and CEO of IBM, says, “The DHS Roles and Responsibilities Framework for Artificial Intelligence in Critical Infrastructure is a powerful tool to help guide the responsible deployment of AI across America’s critical infrastructure, and IBM is proud to support its development. We look forward to continuing to work with the Department to promote shared and individual responsibilities in the advancement of trusted AI systems.”
Secretary Mayorkas echoes those sentiments, adding, “The choices organizations and individuals involved in creating AI make today will determine the impact this technology will have in our critical infrastructure tomorrow.”
The secretary’s words capture the essence of why this framework matters: We need to shape the future of AI in a way that protects and enhances the services that are foundational to our society.
The post DHS: Guidance for AI in critical infrastructure appeared first on Security Intelligence.
Entrar