Загрузка видео...

Не удалось загрузить видео

На главную

Offense at scale starts with an API. Today, we’re launching the XBOW Public API in Public Preview. Autonomous pentesting gave teams expert-level assessments in hours. But turning that capability into infrastructure required one more piece: programmatic access. Teams can now trigger and manage pentests across their entire portfolio; start,...

12,257 просмотров • 7 месяцев назад •via X (Twitter)

Комментарии: 0

Нет доступных комментариев

Здесь появятся комментарии из оригинального поста

Похожие видео

Anthropic won't like this open-source repo. It is going to cost LLM providers a lot of money. Every CI run of an AI app today sends real requests to providers like OpenAI or Anthropic. Like any other LLM call, this too gets billed at actual API rates. So for teams with high commit volumes, this accumulates into a meaningful chunk of API spend. One common hack devs use is that instead of invoking the LLM API, the test calls a fake local server that speaks the same API and returns a dummy response. The catch is that the dummy response is a copy of what the provider returned on the day it was saved, and providers keep adding fields and changing types. So the tests keep passing against a schema that's no longer valid, while the real integration breaks in production. A smart approach is now actually implemented in CopilotKit🪁's recently open-sourced aimock project. Every day, the repo's own CI sends a handful of requests to the real API and the same requests to the fake server, then compares both against the official client library's type definitions. Those are the only real API calls in the whole setup, and they run on the repo's own keys, not in anyone else's CI. A single team can push hundreds of commits a day, and thousands of teams are already doing that with coding agents. All of those runs stay offline, because one repo checks against the real API on everyone's behalf. When a check fails, a coding agent updates aimock's built-in response schema, the full test suite has to pass, and a patch version ships to npm. By simply upgrading the package, the corrected schema gets reflected in every project using it. The capability is not just limited to a single provider. The same server works for Claude, OpenAI, Gemini, Bedrock, Azure, Ollama, plus MCP tools, A2A agents, AG-UI event streams, vector DBs like Pinecone and Qdrant, and search, speech, image, and video endpoints. Here's the repo: (don't forget to star it ⭐) That said, mocking your API calls is one thing. AI engineers should also know how to test agents properly in the first place, which several teams still skip. I wrote a full walkthrough on that, covering build, testing, evals, tracing, and deployment. Read it below.

Akshay 🚀

62,821 просмотров • 1 месяц назад

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

217,957 просмотров • 9 месяцев назад

Possibly the biggest change in Microsoft Teams history? Teams without the Teams? Public preview in November to desktop, mobile, iOS, and Android. Here is what you need to know: 🟣 Microsoft is introducing a new combined chat and channels experience. Meaning chat and teams/channels will show up under the "Chat" sidebar icon. No more dedicated Teams sidebar button. 🟣 Teams and Channels will have their own section in chat. 🟣 Group your chats and/or channels however best works for you with favourites and custom sections (up to 50 sections and 50 items per section) 🟣 “Unread,” “Chat,” “Channels,” “Meetings,” and “Muted” Filters 🟣 New message can initiate a new chat or new channel post 🟣 New Mention view gathers all your mentions into a single interactive list. 🟣 At launch, a self-service, guided onboarding will help users discover the new experience and configure it to their preferences (on or off) 🟣 Users who prefer to keep chat and channels separate can easily do so during the onboarding process or at any time later. So far, it looks like there are no IT/tenant-level override controls. This experience change is targeted at getting more users using teams/channels. Most Teams users live in "chats", not teams/channels. There will undoubtedly be some pushback from users who use teams/channels well and like having the mental separation of teams/channels vs chats. I've been fortunate to be using it for a while, and I'm personally a big fan; my use of the correct channels has gone way up, and now I can find them all in one place in the app, particularly on mobile. I'm now much more likely to see channel conversations I need to see. What do you think? #MicrosoftTeams #Microsoft365

Tom Arbuthnot

64,556 просмотров • 1 год назад

Mansa AI is an enterprise-grade AI + Web3 platform designed to move artificial intelligence from experimentation into real-world execution. Built for creators, developers, and businesses, it focuses on deploying AI that actually works across modern digital systems, not just in isolated demos. 🚀 Production-ready AI infrastructure Mansa AI enables teams to deploy AI systems designed for live environments, handling real workflows, real data, and real operational demands without constant manual oversight. 🧠 Autonomous AI agents At its core, Mansa AI allows users to build autonomous agents that automate decision-making, coordinate tasks, monitor live signals, and execute complex workflows across dynamic environments. ⚙️ Fully customizable logic Agents can be configured with custom behaviors, triggers, and responses. From content generation and analytics to operational automation and intelligent orchestration, logic adapts to specific business strategies. 🔗 Web3 and off-chain integration Mansa AI bridges blockchain ecosystems with traditional systems, enabling cross-chain coordination, smart contract interactions, and seamless integration with existing enterprise infrastructure. 📊 Real-world use cases The platform supports automation for operations, customer engagement, analytics, data pipelines, content workflows, and AI-driven optimization across products and teams. 📈 Built for scale Whether launching as a startup or deploying across enterprise systems, Mansa AI is designed to scale AI operations without adding complexity or fragmentation. Mansa AI transforms artificial intelligence into deployable infrastructure. By combining autonomy, customization, interoperability, and scalability, it enables teams to own, operate, and grow intelligent systems that deliver real value in production environments.

King

155,637 просмотров • 9 месяцев назад

I just vibe-coded a Meta Ads Bulk Uploader in Claude Code that uploads dozens of Facebook and Instagram ads in minutes 🤯 Drag and drop your creatives, connect your live Meta account, publish directly through the Marketing API. Built 100% in Claude Code. Perfect for media buyers and DTC brands who are still uploading ads one at a time in Ads Manager. If you're a media buyer spending 10+ hours a week uploading ads one at a time in Ads Manager — attaching videos, picking thumbnails, naming ads, toggling enhancements, repeating 50 times ... This eliminates the entire workflow: → Drag and drop dozens of images/videos at once → Add multiple primary texts, headlines, and descriptions per batch → Pick your campaign and ad set directly from your live Meta account → Clone existing ad sets with one click → Upload custom thumbnails, pick your CTA, launch paused or active No uploading ads one by one. No 2-3 hours of clicking. No $99/month SaaS subscription. What this tool does: → A bulk uploader that publishes directly through Meta's Marketing API → Full creative control — thumbnails, CTAs, ad names, enhancements — all in one shot → Ad set cloning so you can scale winning setups instantly → A free alternative to the $99/month tools that do the exact same thing I'm giving away every prompt I used to build it so you can vibe-code the whole thing yourself. Want all the prompts? > Like this post > Comment "BULK" And I'll send it over (must be following so I can DM)

Mike Futia

42,915 просмотров • 6 месяцев назад