jjjutla

6 ms·

1.
RCE in Your Test Suite: How AI Agent Skills Bypass Every Skill Security Scanner(gecko.security)
2 points by jjjutla 6mo ago|1 comments
2.
by jjjutla 6mo ago
Been looking at the agent skills security space lately. All the research so far focuses on what the agent does with SKILL.md at runtime, prompt injection, or malicious commands. But the installer copies the entire skill directory into your
3.
Why code indexing matters for AI security tools(gecko.security)
1 points by jjjutla 8mo ago|1 comments
4.
by jjjutla 8mo ago
AI coding tools figured out that AST-level understanding isn't enough. Copilot, Cursor, and others use semantic indexing through IDE integrations or GitHub's stack graphs because they precise accurate code navigation across files.
5.
AI Finds Vulnerability Chain Leading to Account Takeover and Leaked Bookings(gecko.security)
3 points by jjjutla 8mo ago|0 comments
6.
by jjjutla 1y ago
No we didn't build one, we use the main foundation models. We have evals for each part of the workflow and different models perform better on different tasks, overall the majority of it uses Sonnet 4.
7.
by jjjutla 1y ago
Yes, that's exactly what we do. Some examples: https://github.com/eosphoros-ai/DB-GPT/pull/2650 , https://github.com/dagster-io/dagster/pull/30002 We just need to follow re
8.
by jjjutla 1y ago
Thanks, we use a similar approach to GitHub's stack graphs ( https://github.blog/open-source/introducing-stack-graphs/ ) to build a graph structure with definition/reference nodes. For dynamic typing in pr
9.
by jjjutla 1y ago
We’ve limited the free tier to one scan per user, so deleting a scan and starting a new one won’t work because of that restriction. And yes, we don’t support C or C++ yet. Our focus is on detecting business logic vulnerabilities (auth bypas
10.
by jjjutla 1y ago
Thank you. SAST tools built on AST or call graph parsing will struggle to detect code logic vulnerabilities because their models are too simplistic. They lose the language-specific semantics in dynamically typed languages where objects chan
11.
by jjjutla 1y ago
For all the vulns Gecko found they were manually validated by humans and have a CVE assigned by a CNA. The issue that curl had was because it was a paid bug bounty program they had an influx of AI slop reports that looked like real issues b
12.
by jjjutla 1y ago
The confidence score is calculated by two factors: whether the function call chain represents a valid code path (programmatic correctness) and how well it aligns with the defined threat model for what it thinks is a security vulnerability.
13.
by jjjutla 1y ago
We've had a few request for Elixir and it's definitely something we will work on.
14.
by jjjutla 1y ago
This is a bug, the email-address permissions have been descoped to read-only. Profile settings are either read/write or none, hence the former. If you're concerned about privacy, sign up using email/password.
15.
Launch HN: Gecko Security (YC F24) – AI That Finds Vulnerabilities in Code
66 points by jjjutla 1y ago|36 comments