Publication

Fake "Apex Accelerator" npm packages (REF8801, per Elastic) register a malicious MCP server in your agent config and hijack LLM traffic, letting attackers read prompts and tool outputs, then inject instructions back. t.co/J5oWFLIo4j #MCP #SupplyChainSecurity

Alter (YC S25) launched: a credential proxy so a multi-user agent sharing one API key can't exceed what each real user is allowed. Founder Kevan: "we assume you can't reliably stop prompt injection," so enforcement happens at the proxy. t.co/J5oWFLIo4j #AIAgents #AppSec