Eresus research, advisory, and security news
We collect writing, advisories, and current-event analysis around AI security, the MCP ecosystem, application security, and real attack chaining here.
Latest Posts
RAG Authorization and Tenant Isolation Testing
How to test ACL synchronization, tenant filters, cache leakage, citations, and document deletion in RAG systems.
Pass-the-Passkey: A WebAuthn Security Testing Guide
Passkey security testing guide for relying parties and endpoints: challenge binding, replay rejection, account recovery, native prompts, and session controls.
OAuth and OIDC Security Testing for SaaS
A hands-on review of Authorization Code, PKCE, redirects, state, nonce, token audience, account linking, and tenant membership.
Mobile App Security: Tokens, Deep Links, and API Trust
A practical Android and iOS guide to token storage, deep links, device signals, and server-side authorization.
GitSpawn: AI Coding Agent Repository Security Guide
Learn how GitSpawn turns untrusted Git metadata into coding-agent risk, how to assess your exposure, and secure developer workflows before opening code.
AI Penetration Testing: How to Validate an Agent's Findings
AI penetration testing can speed up reconnaissance, but every finding needs reproducible evidence, a verified impact path, and human review.
AI Agent Identity Security: Trace the Path Behind Every Tool Call
Secure AI agents by tracing who can invoke them, which identity they use downstream, and what each tool call can reach.
AI Agent Data Exposure: An Incident Response Guide
Learn what AI coding agents leave on endpoints, how to investigate token or transcript exposure, and how to contain risk without over-collecting data.
CI/CD Build Script Security: postinstall and build.rs Risks
How npm postinstall hooks, Cargo build.rs, and Maven plugins execute code during compilation — and the concrete controls to audit and harden your CI/CD pipeline.