PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Leaking Secrets in the Age of AI

wiz.io | blog | #ai-security | #supply-chain | #secrets | #vibe-coding | #code-security | #wiz-research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A month-long Wiz scan found AI-related credentials dominating valid secrets leaked to public repos — .ipynb notebooks, mcp.json, .env and agent configs — with valid keys tied to 30+ companies.
Published
Collected

Related coverage

blog · wiz.io
Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces
Wiz Research uncovered 550+ valid secrets across 500+ VSCode and Open VSX extensions — over a hundred enabled malicious updates — and worked with Microsoft on marketplace guardrails.
blog · wiz.io
Wiz Research Discovers One in Five Organizations Exposed to Systemic Risks in Vibe-Coded Applications - Here's How to Secure Them
Wiz Research finds one in five vibe-coding platform users exposed to systemic risks — client-side-only authentication, hardcoded passwords, exposed keys — and shares fixes curated with Lovable.
blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
blog · wiz.io
Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding platform Base44 Allowing Unauthorized Access to Private Applications
Wiz Research finds a critical flaw in vibe-coding platform Base44: a non-secret app_id let attackers register verified accounts and access private apps, bypassing SSO; it was fixed within 24 hours.
blog · wiz.io
Lean and Mean: How We Fine-Tuned a Small Language Model for Secret Detection in Code
Wiz engineers fine-tuned a 1B-parameter Llama model to spot secrets in code, hitting 86% precision and 82% recall on standard CPUs — beating regex without the cost and privacy issues of large LLMs.
blog · wiz.io
Rules Files for Safer Vibe Coding
Wiz explains rules files — plain-text guidance steering AI coding tools like Copilot, Claude Code and Cursor toward safer code — and open-sources its own set as most AI-generated code ships flaws.
Back