topic · 2 notes
Supply Chain Security, as it ships.
Engineering notes on Supply Chain Security by Samir Sengupta - each one read from primary sources on the day it happened, with what it changes for people building on it.
August 17, 2026 · CI/CD Security · GitHub Actions · AI Code Review
Copilot Autofix Introduced the Vulnerability That Compromised Snowflake's Jira
On June 18, 2026, a Copilot Autofix commit in snowflakedb/snowflake-connector-net introduced a GitHub Actions script injection. Five days later, Wiz's Red Agent exploited it to exfiltrate Jira credent
August 7, 2026 · Agent Security · Permissions · Supply Chain Security
Humans miss a third of malicious agent commands, so stop putting them in the loop
40,000 runs and 409,000 approve/deny decisions: players missed a third of threats, and 64.7% approved an npm run script whose exfiltration payload was printed on screen.
Hiring for AI or ML?
I am open to AI/ML Engineering, Data Science, and Python roles, plus research collaborations and consulting. New York based, shipping worldwide.