Publicly disclosed non-human-identity, AI-agent, MCP, and cloud-identity security incidents and advisories. Sourced from authoritative publishers (CISA KEV, NVD/CVE, vendor PSIRTs, named researchers). Every item links to its original source; our analysis is shown separately. The feed is intentionally sparse when there is nothing real to report.
The no-fabrication law as code: an unsourced or undated item cannot ship — the build fails. We never wholesale-republish link-only sources; we summarise and link to the original.
A TrustFix explainer on CISA's KEV catalog — the authoritative, public-domain list of vulnerabilities known to be exploited in the wild — and how exploitation so often pivots through non-human identities and the credentials they hold.
A TrustFix explainer on the security risks introduced when AI agents call tools over the Model Context Protocol — tool poisoning, tool-description injection, indirect prompt injection, and unmediated delegation — and what is provable about each.
A TrustFix explainer on the OWASP Non-Human Identity Top 10 — the emerging shared vocabulary for the risks that service accounts, tokens, and AI agents introduce. We map each category to what is provable versus assumed.
Not phished passwords — leaked tokens, forgotten OAuth apps, unrotated service accounts, stolen signing certs. The machine identities nobody was watching. Real, public incidents; click any to read the source.
Sourced from vendor postmortems, CISA, and reputable security press. TrustFix inventories, proves, and governs exactly these identities — and tells you, with signed proof, the moment one steps out of line.