[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance

If you run Tailscale SSH or serve, move every node to 1.104.4+ and re-check SSH forwarding grants

After the Tailworm findings and Tailscale's TS-2026-014–017 bulletins:

  1. Roll 1.104.4 or newer to every Linux (and open-source macOS) node that runs Tailscale SSH or tailscale serve.
  2. In the ACL/policy file, list SSH rules: prefer explicit source→destination grants; turn off forwarding on rules that do not need it.
  3. Remove Docker socket and other root Unix sockets from anything a forwarded session could have reached before the patch; rotate credentials that lived on those hosts if you had broad SSH tags.

Sources: Tailscale security bulletins TS-2026-014 through TS-2026-017 · Tailscale v1.104.4 release