[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

tip (vendor guidance)

Tip: if your site runs on Studio, rotate every API key or token you pasted into it, re-link Google Sheets, and swap the proxy key

Studio says stored integration secrets may be readable even though they were encrypted, because the key was read too. Regenerate keys at the source service (not just in Studio) and check that service's logs for use since Sep 30. Remove Studio under Google Account > Linked apps before re-linking Sheets. Change webhook endpoints or add a secret if your receiver trusts the URL alone. Delete old live-preview URLs and change passwords on password-protected pages. If your forms collect personal data, you may owe notice to the people who filled them in.

Sources: Studio notice (first report, updated Oct 18)