DEV Community

Cover image for AI Attack Surface, Git on S3, CSS Chaos
Adam
Adam

Posted on

AI Attack Surface, Git on S3, CSS Chaos

Agents are now writing exploits faster than most teams can write postmortems. Matthew Green's warning that software is about to "go dark" lands hard this week, and the signal keeps stacking: Wiz showed an autonomous red agent exploiting a fresh GitHub Actions flaw, Margin Research framed the new "half-day" exploit cycle, and Daniel Miessler's prompt-injection-worm scenario reads less like sci-fi and more like sprint planning. If that wasn't enough, PortSwigger demonstrates CSS abuse inside email clients, which is not the kind of "responsive design" anyone asked for.

Under the hood, infrastructure engineers are rebuilding old ideas for new pressure. Cursor's Git at Any Scale and Chroma's WAL-on-object-storage teardown both point to the same pattern: object storage is becoming the new systems substrate. On the model side, Gustafson's PagedAttention explainer shows how borrowing virtual-memory ideas can stop KV cache waste from eating your GPU budget, while Annie Sexton's Compression Is Prediction is a great reminder that LLM intuition still benefits from old-school information theory.

There is also a deceptively practical frontend gotcha on why the img element can overflow in surprising ways. Plus, Lorin Hochstein's GitHub autoscaling postmortem is a sharp reminder that outages are often system-interaction failures, not villain-of-the-week components. For tooling, Saggar is a small but real quality-of-life win if your terminal tabs currently feel like a crowded airport gate.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #151:


Everything Is About to Go Dark

by Matthew Green

On AI-written software, its security fallout, and what happens to lawful access to communications

📰 Good to know, security


Something Nobody Told You About the Image Element

by master.dev

The img element is container and content at once, so object-fit and border-radius can make it overflow in surprising ways

📰 Good to know, css,frontend


Compression Is Prediction

by Annie Sexton

Compressors and language models turn out to be solving the same problem, walked through from the basics

📰 Good to know, ai,deepdive


Red Agent Exploits Snowflake Vuln Missed by Copilot

by Wiz

An autonomous agent found and exploited a GitHub Actions flaw five days after it was introduced

📰 Good to know, security,ai


Git at Any Scale

by Cursor

Why Git packfiles break down on a server, and the stateless S3 write-ahead-log architecture Cursor built to get linearizable pushes

📰 Good to know, engineering,git


I Am Worried About a Prompt Injection Worm

by Daniel Miessler

Semi-autonomous agents roaming the internet with too much authority are the AI security problem to watch

📰 Good to know, security,ai


CSS, the Bomb Inside Your Inbox

by Gareth Heyes

How CSS in email clients is ripe for exploitation, with a pile of working attack techniques

📰 Good to know, security,css


PagedAttention, Virtual Memory for the KV Cache

by Gustafson

Borrowing OS paging for the KV cache so a shared pool of fixed-size blocks cuts waste and lifts throughput

📰 Good to know, ai,performance


GitHub, Autoscaling, and the Component Substitution Fallacy

by Lorin Hochstein

The outage came from an autoscaling policy that ignored the Istio sidecar limits, not from one broken component

📰 Good to know, devops,engineering


How We Built Our Write-Ahead Log

by Chroma

Long writeup on building a WAL on object storage, and why 60-year-old System R ideas suddenly matter again

📰 Good to know, databases,engineering


Introducing the Half-Day

by Margin Research

AI-found exploits arrive faster than any human researcher can produce them, and what that does to the vulnerability market

📰 Good to know, security,ai


Saggar

by Marginal Utility

Native macOS terminal manager that surfaces which shells, tests and coding agents are waiting on a decision

🧰 Tools, macos,cli


Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Top comments (0)