[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

incident-response guidance (Socket Threat Research, Nov 6)

Tip: on a host hit by a Shai-Hulud-family worm, remove the token monitor before you revoke the stolen GitHub token

  • Isolate the host from the network.
  • Stop and remove net-health-checker and pkg-runtime (systemd user units or LaunchAgents) and preserve ~/.config/net-health-checker/token as evidence.
  • Then revoke the GitHub token and rotate every other credential from a clean device, and rebuild the host.

Sources: Socket: Shai-Hulud descendant surfaces in malicious Ruby gem (Nov 6)