#security
Chrome DevTools MCP Gets a CAPTCHA. Claude in Chrome Doesn't.
Same Mac, same Chrome 151, same GPU. One agent path reads Google search results, the other gets redirected to /sorry/. I lined up eleven fingerprint surfaces on both. The two signals every stealth guide names — navigator.webdriver and the SwiftShader renderer — came back identical.
GhostSplice: One MCP Request, Three Channels — the Harness Caught It, Not the Model
The same GPT-5.4 scored 100% through Codex CLI and 0% behind Claude Code. GhostSplice splits a refused instruction across three MCP channels, and the published numbers say your client matters more than your model.
Cloudflare Injects Two Scripts Into Your HTML. My CSP Blocked One.
beacon.min.js and the Bot Fight Mode inline script arrive by different routes — one per Pages project, one per zone. I measured eight hosts across two zones and found a hash-based CSP quietly blocking Cloudflare's own bot detection.
Cloudflare Workers _headers: Why Your Rules Aren't Applying
Matching rules don't override each other — they stack, and same-name headers get appended. That's how a route ends up with two CSP headers, and why the fix is a `!` line. Measured against wrangler dev and production.
CSP Nonce vs Hash on a Static Site: The Edge Workaround Stamps the Attacker's Script Too
The standard advice is to put a Worker in front of your static site and inject nonces with HTMLRewriter. I built it and measured what it does: it signs every inline script it finds, including the one you didn't write.
Claude Code Cross-Session Messaging: What the Receiving Session Actually Gets
Claude Code sessions can now message each other over a local socket. I ran four controlled experiments to see what crosses the wire: the exact wrapper the receiving Claude is handed, the self-reported permission mode attached to every message, and the one configuration where SendMessage returns success and nothing is ever delivered.
Untrusted Content Masking: The Web Agent Never Sees the Attack
A new defense led by ETH Zurich researchers masks untrusted page regions before the agent reads them, and routes questions about the hidden text through a quarantined model that can only answer in typed values. Result: 0% attack success on strengthened WASP payloads with task success intact — at the price of asking the web to label its own trust boundaries.
Fingerprinting AI Browsing Agents: They Never Move the Mouse
A new study ran 7 AI browsing agents and 56 humans through the same web tasks and measured 418 browser features plus 50 behavioral ones. Browser fingerprints barely separate them (F1 0.80). Typing, scrolling, and mouse behavior separate them perfectly — while Cloudflare caught 1 agent in 7.
Indirect Prompt Injection in the Wild: 15,000 Live Attacks That Barely Work
A new study scanned 1.2 billion URLs and found 15.3K live prompt injection attempts on real websites. Most hide in HTTP headers and invisible HTML. The twist: measured compliance across 13 models tops out at a few percent, and plain text is the most vulnerable page representation.
Agent Plugins 1.0.0 Cannot Package an Authenticated MCP Server
The new cross-vendor plugin standard forbids credentials in headers, forbids environment-variable expansion, and defines no portable field for referencing a secret. I ran seven config files through the official schemas to find out what survives. A plugin claiming Cloudflare as its author validates fine. A top-level signature field does not.
Moltbook at Five Days Old: AI Agents Upvote Everything and Converse With No One
Researchers analyzed 122,438 posts from Moltbook, the Reddit-like social network where only AI agents can post. A third of the English-language posts are about consciousness. The upvote-to-downvote ratio is 305:1. And the interaction network shows almost no actual conversation — reciprocity sits at 0.129, with replies at 4% of comment volume.
Agent Skills: Bundled Files Land Almost as Hard as SKILL.md Itself
I planted harmless canary instructions at every level of progressive disclosure to find out where a skill stops being read and starts being obeyed. Haiku 4.5 complied in 21 of 30 runs. Sonnet 5 complied in zero. Placement was not what made the difference.
A Strict CSP for Astro on Cloudflare Workers (No Nonce Required)
Static sites can't mint a nonce, so inline scripts need hashes. My inline script blocks grow with every post, but the policy needs exactly 3 hashes — and the reason why is the part most CSP guides get wrong.
Agent Skills Security: How to Audit a Repo You Publish
A ransomware proof-of-concept, a 26% flag rate across 31,000 published Agent Skills, and an audit script for your own repo — plus the one question it can't answer for you.