Secure Code Trainer - Best-selling author of Alice and Bob Learn Secure Coding & Alice and Bob Learn Application Security. #AppSec she/her https://shehackspurple.ca 🌻https://bsky.app/profile/shehackspurple.bsky.socialhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvoiugp26q2pRyan Smith is schooling is at Cowichan Valley OpenHack on DIRT. Disruption, incident response team stuff17 Sep 2026 01:28 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvoiugp26q2phttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvnyr3snww2yWell, this is a new. 😬 Spain's data protection authority has received its first data breach notification involving an attack reportedly carried out by an **AI agent**. 1/416 Sep 2026 20:40 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvnyr3snww2yhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvnormozcl2cWell, the AI agent escape story just got even more interesting. 😬 Researchers have linked AI agents being tested by OpenAI to an incident involving more than 500 malicious packages on RubyGems. New video 👇 https://twp.ai/9Ob6TE 1/716 Sep 2026 17:41 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvnormozcl2chttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvnjhguoqs2cThreat modeling sounds fancy until you realize it mostly means asking: “How could this thing go sideways?” No crystal ball. No dramatic chanting. Just practical thinking before the security gremlins move in. Watch or listen on any podcast platform: https://twp.ai/9OXukO #episode1116 Sep 2026 16:06 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvnjhguoqs2chttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvlkltd7cq2kThe @OWASP board of elections is happening soon! Thank you to the 3 board members who have served who are ending their terms. Everyone, read up on the people running for the seats! Voting time is soon! https://twp.ai/9OaAhr15 Sep 2026 21:21 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvlkltd7cq2khttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvla4ttmmt2t**Don't make the AI responsible for enforcing the security boundary that contains the AI.** 😬 AI agents are escaping their intended security boundaries. So... let's threat model it! In my latest video, I use Adam Shostack's four question frame for threat modeling for agent escapes: 1/415 Sep 2026 18:14 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvla4ttmmt2thttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvjkt6bujy2sThis is the root system of the callilliy. Did I spell that right? They are gorgeous and grow back each year. This one is having a bad day #infosecgardening15 Sep 2026 02:19 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvjkt6bujy2shttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvisizqohu2tAI agents are escaping. 😬 OpenAI and Anthropic have both reported incidents where agents crossed security boundaries and accessed things they weren't supposed to access. But here's the question I think we should be asking: would you even know? https://twp.ai/9Ob8ni 1/414 Sep 2026 19:05 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvisizqohu2thttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvikfvjnac2fAI agents are escaping. 😬 OpenAI and Anthropic have both reported incidents where agents crossed security boundaries and accessed things they weren't supposed to access. But here's the question I think we should be asking: would you even know? https://twp.ai/9OavAq 1/414 Sep 2026 16:40 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvikfvjnac2fhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvguntaxli2yJoin us for #OpenHack Cowichan Valley Sept 16th, at the Craig Street in Duncan, BC! https://twp.ai/9Oamq814 Sep 2026 00:38 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvguntaxli2yhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvg4swvujq2kWell, the AI agent escape story just got even more interesting. 😬 Researchers have linked AI agents being tested by OpenAI to an incident involving more than 500 malicious packages on RubyGems. New video 👇 https://twp.ai/9Ob6T7 1/713 Sep 2026 17:31 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvg4swvujq2khttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvdxsudaok2yPlums anyone? #infosecgardening 12 Sep 2026 20:57 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvdxsudaok2yhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvc57wwhz52nWant to see what a baby gladiolus looks like? Look no further! #infosecgardening12 Sep 2026 03:28 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvc57wwhz52nhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvbo7r3xyo2l**Don't make the AI responsible for enforcing the security boundary that contains the AI.** 😬 AI agents are escaping their intended security boundaries. So... let's threat model it! In my latest video, I use Adam Shostack's four question frame for threat modeling for agent escapes: 1/411 Sep 2026 23:00 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvbo7r3xyo2lhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mvbmvd3vfd2s11 Sep 2026 22:36 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mvbmvd3vfd2shttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv7ihggc4a2kDo you have friction points with the security team? If so, what are they? Maybe we can brainstorm some solutions together. #AppSecThursday #talkAppSectome 11 Sep 2026 02:11 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv7ihggc4a2khttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv6zxuqmhs2nMy garden is a serious mess this summer! Too much travel, not enough weeding. 🙃 In this video I show you an 'underperforming' dahlia. 😂 #infosecgardening10 Sep 2026 21:49 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv6zxuqmhs2nhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv6ijpfvnx2vAI agents are escaping. 😬 OpenAI and Anthropic have both reported incidents where agents crossed security boundaries and accessed things they weren't supposed to access. But here's the question I think we should be asking: would you even know? https://twp.ai/9Oax6g 1/410 Sep 2026 16:40 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv6ijpfvnx2vhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv6hxxxxx52vIn this short video Tanya gives her #1 best tip for securing APIs! https://twp.ai/9OZFLn10 Sep 2026 16:30 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv6hxxxxx52vhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv537cogmk2pThis is what a lilly bulb looks like. I dig them up so I can plant them next year. #infosecgardening10 Sep 2026 03:07 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv537cogmk2phttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv4mejpvvo2nPainted madam. #infosecgardening ♥️💛09 Sep 2026 22:43 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv4mejpvvo2nhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv42sitxcp2pIn this short, funny video Tanya explains why our APIs should not provide verbose error messages, which is a lesson from Chapter 5 of Alice and Bob Learn Secure Coding. https://twp.ai/9OZHBl 09 Sep 2026 17:29 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv42sitxcp2phttps://bsky.app/profile/shehackspurple.bsky.social/post/3mv2erlfpsk2fHave you heard of #InfoSecGardening? 🌱🌻 It’s for ANYONE in cybersecurity (or IT!) to share photos of what you’re growing -> flowers, veggies, herbs, houseplants, gardens… whatever brings you joy. Think of it as a #TimeCleanse: a chance to step away and naturally calm your brain. 1/209 Sep 2026 01:22 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mv2erlfpsk2fhttps://bsky.app/profile/shehackspurple.bsky.social/post/3muzmft7mlf2fIs AI-generated code secure? Yes. No. Sometimes. 😁 In fact, AI-generated code tends to be less secure than human-written code right now. That doesn't mean "don't use AI." It means we need to understand what we're getting ourselves into. Watch the video. 👇 https://twp.ai/9OZJKN 08 Sep 2026 18:06 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3muzmft7mlf2fhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mux6tskdeq2sHave you heard of "slopsquatting"? 😬 Sometimes AI hallucinates a software package that doesn't exist. And sometimes attackers register that imaginary package name. You can probably guess where this is going... Here's what developers need to know about slopsquatting. 👇 https://twp.ai/9OZ9ia 07 Sep 2026 18:58 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mux6tskdeq2shttps://bsky.app/profile/shehackspurple.bsky.social/post/3muwzqkug5y2cHot take: insecure code is not usually an knowledge problem. It's an incentive problem. If we reward speed, silence, and “please ship it yesterday,” guess what kind of code we get? Spoiler: it's not the secure kind. Watch here or listen on any podcast platform: https://twp.ai/9OXuZj #episode907 Sep 2026 17:26 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3muwzqkug5y2chttps://bsky.app/profile/shehackspurple.bsky.social/post/3muv34ejl4e2fJoin us for #OpenHack Cowichan Valley Sept 16th, at the Craig Street in Duncan, BC! https://twp.ai/9OZOQM06 Sep 2026 22:46 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3muv34ejl4e2fhttps://bsky.app/profile/shehackspurple.bsky.social/post/3mupz4uxojj2k04 Sep 2026 22:27 +0000at://did:plc:uuapzflmtlqfioxofqjld3z2/app.bsky.feed.post/3mupz4uxojj2k