Eresus research, advisory, and security news
We collect writing, advisories, and current-event analysis around AI security, the MCP ecosystem, application security, and real attack chaining here.
Latest Posts
BOLA and IDOR in APIs: How to Test Object-Level Authorization
A safe, evidence-led method for testing API object access across users, tenants, roles, and actions—without relying on hidden IDs or response codes alone.
AI Supply Chain Attacks: The Hidden Trojans Inside Open-Source LLMs
AI supply-chain security guide covering untrusted model files, Pickle and deserialization risk, model provenance, Safetensors, GGUF, sandboxing, and MLOps controls.
AI Safety vs. AI Security
Discover the critical distinctions between AI Safety (protecting humans from AI) and AI Security (protecting AI from malicious threat actors and hackers).
AI-Orchestrated Cyber Espionage: The Dawn of Autonomous APT Campaigns
Discover how Advanced Persistent Threats (APTs) weaponize Generative AI and autonomous agents to conduct hyper-scalable, undetectable cyber espionage...
GitOps Security in ArgoCD Architecture: How to Protect Your K8s Clusters
ArgoCD and GitOps architectures rely on a Single Source of Truth. Learn how attackers exploit supply chain vulnerabilities and the detailed guidelines...
Apple Warns: Older iPhones Vulnerable to Coruna & DarkSword Exploit Kits
Apple has issued a critical warning regarding unpatched, older iOS devices being actively targeted by Coruna and DarkSword exploit kits through drive-by...
Authentication in AI Applications: LLM Sessions and Data Privacy
AI application authentication guide covering JWT validation, session binding, thread ID access, tenant isolation, RAG authorization, and agent tool permissions.
AI Agent Traps: Web Attacks Against Agents
How hidden web content, poisoned context, and tool access can manipulate autonomous AI agents in real enterprise workflows.
What is Agentic Cybersecurity? Are AI Agents Replacing Pentesters?
Discover the differences between Agentic Security architecture and manual penetration testing, and explore the future of AI in offensive cybersecurity.