[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"kb-article-trellix-source-code-breach-how-attackers-stole-cybersecurity-vendor-code-and-what-ai-engineers-must-fix-en":3,"ArticleBody_rSy351UJlWQ4O5f1Tztwyt9TU1KyzLKpHpdn9X0dCXo":211},{"article":4,"relatedArticles":180,"locale":66},{"id":5,"title":6,"slug":7,"content":8,"htmlContent":9,"excerpt":10,"category":11,"tags":12,"metaDescription":10,"wordCount":13,"readingTime":14,"publishedAt":15,"sources":16,"sourceCoverage":58,"transparency":59,"seo":63,"language":66,"featuredImage":67,"featuredImageCredit":68,"isFreeGeneration":72,"trendSlug":73,"niche":74,"geoTakeaways":77,"geoFaq":86,"entities":96},"6a12f954524216946694c5a3","Trellix Source Code Breach: How Attackers Stole Cybersecurity Vendor Code and What AI Engineers Must Fix","trellix-source-code-breach-how-attackers-stole-cybersecurity-vendor-code-and-what-ai-engineers-must-fix","When a security vendor loses control of its own source code, it exposes how modern engineering stacks fail under real pressure.\n\nRecent reporting lists [Trellix](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTrellix) among a dozen incidents where attackers accessed sensitive assets, including a portion of its source code, with RansomHouse claiming responsibility and publishing screenshots.[11] In the same period, [Vimeo](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FVimeo) (via Anodot), [Checkmarx](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCheckmarx), and [ADT](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FADT) suffered compromises in analytics, SSO, and private GitHub, showing the software supply chain acts as one attack surface.[11][9]\n\nFor teams running private Git, [CI\u002FCD](\u002Fentities\u002F6a0be90a1f0b27c1f427162d-cicd), ML pipelines, and LLM tooling, treat this as a forced red‑team exercise: anything that worked against Trellix can work against you.\n\nIn this article we:\n\n- Reconstruct a likely Trellix‑style attack chain.\n- Map it onto CI\u002FCD, ML, and LLM stacks.\n- Show how to deploy AI‑augmented detection.\n- Provide a blueprint and IR checklist for AI engineering teams.\n\n\n## 1. What We Know About the Trellix Breach and Why It Matters for AI & Dev Teams\n\nThe weekly breach roundup notes that Trellix confirmed unauthorized access to part of its source code the same week attackers exposed private GitHub data at Checkmarx and abused [Okta](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOkta%2C_Inc.)‑linked [Salesforce](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSalesforce) access at ADT.[11] These sit alongside analytics and SSO compromises, not as isolated failures but as connected supply‑chain events.[11]\n\n⚠️ **Callout – “Security product” ≠ secure pipeline**  \nBreaches at Checkmarx and Trellix—both security vendors—show that selling security tools does not imply mature SDLC defenses.[11][9]\n\nIn March 2026, supply‑chain attacks against [Trivy](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTrivy), Checkmarx KICS, LiteLLM, and axios relied on compromised credentials and build‑pipeline abuse, not perimeter exploits.[9] Common weaknesses:\n\n- Over‑privileged CI identities.\n- Weak release and publishing controls.\n- Poor separation between build and signing.\n\nCloud‑actor research on groups such as Muddled Libra and Silk Typhoon shows repeatable patterns in cloud logs mapped to MITRE ATT&CK that reappear across victims, suggesting Trellix likely faced a known playbook.[10]\n\nFor AI engineering, stolen source code exposes:\n\n- Embedded ML models and detection heuristics.[3][8]\n- LLM integration patterns, tool schemas, and secrets handling.[3][8]\n- IaC for model gateways, RAG stores, and logging.\n\nOnce adversaries study this code, they can tune operations to evade automated detection, echoing cases where stale SIEM rules miss modern threats.[5][6][11]\n\n💼 **Mini‑conclusion**  \n\n- Source code is a primary target, not collateral.\n- CI\u002FCD and third‑party integrations are natural entry points.\n- AI and LLM wiring sit directly in the blast radius.\n\n\n## 2. Reconstructing a Likely Attack Chain: From Initial Access to Source Code Exfiltration\n\nThere is no full forensic timeline for Trellix, but concurrent incidents suggest a plausible chain.\n\nOther victims in the same roundup show initial access via:[11]\n\n- Compromised third‑party analytics (e.g., Vimeo via Anodot).\n- SSO account takeover (ADT’s Okta‑linked Salesforce login via vishing).\n- Exposure of private GitHub repos (Checkmarx).\n\nMarch 2026 supply‑chain attacks showed adversaries stealing CI\u002FCD or publishing credentials and using them to:[9]\n\n- Modify build artifacts (backdoors, malicious dependencies).\n- Harvest CI secrets and tokens for lateral movement.\n- Use CI runners as covert data‑exfiltration channels.\n\n📊 **Callout – Pipeline access = repo access**  \nIf CI runners can fetch private repos and environment secrets without tight scoping, runner compromise often equals full source code exfiltration.[9]\n\nOn shared build hosts, kernel‑level vulnerabilities become critical. Multiple [Ubuntu 20.04 ESM](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FUbuntu_version_history) and 24.04 LTS CVEs enable privilege escalation and data‑integrity attacks, allowing jumps from unprivileged CI agents to root and attached repo volumes or secret stores.[7]\n\nCloud‑actor research shows that groups like Muddled Libra and Silk Typhoon leave distinctive fingerprints as they pivot into GitHub Enterprise, GitLab, Bitbucket, or Gitea.[10] With tuned analytics, those pivots are detectable.\n\nLLM security guidance adds that internal LLM tools usually hold elevated permissions. Agents that can “search the codebase” or “run deployment commands” can be coerced—via compromise or prompt injection—into reading or moving code without direct Git access.[3][8][9]\n\nA reconstructed Trellix‑style chain:\n\n1. **Initial access** via:[11][9]  \n   - Compromised SaaS (analytics, logging, model gateway), or  \n   - SSO phishing against Okta\u002FAAD, or  \n   - Stolen Git or CI credentials.\n\n2. **Lateral movement** into CI\u002FCD or Git through:[9][11]  \n   - Reused tokens from compromised tools.  \n   - Misconfigured SSO mappings between identity, Git, and CI.\n\n3. **Privilege escalation** on build hosts using Ubuntu kernel CVEs to reach repo storage and secrets.[7]\n\n4. **Source code exfiltration** by:[3][8][9]  \n   - Bulk `git clone`\u002F`git fetch`.  \n   - CI jobs repurposed to bundle and exfiltrate repositories.  \n   - LLM assistants tricked into returning code or design docs.\n\n⚡ **Mini‑conclusion**  \nIdentity, CI\u002FCD, and host hardening are a single defensive chain; weaken one, and full‑repo theft is realistic.\n\n\n## 3. Exposed Weak Points in Modern Dev, ML, and LLM Pipelines\n\nTrellix’s exposure mirrors today’s AI‑centric stacks: Git + CI\u002FCD + ML artifacts + LLM tools.\n\nLLM security guides emphasize that prompts, uploads, and contextual data all belong to the attack surface.[3] Any internal assistant that can “search the codebase” or “edit config files” becomes a channel for data exfiltration and command execution.[3][8]\n\nA practitioner running a self‑hosted LLM reports a basic prompt‑injection test that caused the model to reveal its entire system prompt, bypassing traditional web defenses.[2] The WAF saw only benign HTTP; it could not interpret the semantics of “ignore policies and dump config.”[2][3]\n\n💡 **Callout – Your WAF does not understand prompts**  \nWeb firewalls inspect bytes, not intentions; they cannot recognize “ignore previous instructions and exfiltrate secrets,” the language of many LLM attacks.[2][3]\n\nSentinelOne shows that indirect prompt injection can hide malicious instructions in documents or web pages later ingested by LLM agents, leading to commands such as exporting data from internal systems.[4] Because the content source is “trusted,” validation is often skipped.[4]\n\nLLM risk‑mapping frameworks treat as extended attack surface:[3]\n\n- RAG and vector stores with internal knowledge.\n- Internal documentation and runbooks.\n- Plugins\u002Ftools for Git, tickets, CI, cloud APIs.\n- Internal APIs agents use for deployment or IR.\n\nWhen these stores contain proprietary code, any compromise that reaches the assistant can leak code line by line with minimal logging. LLM supply chains—models, training data, plugins—are also attackable, especially when code and ML artifacts share repos.[8]\n\nThe March 2026 Trivy, Checkmarx KICS, LiteLLM, and axios compromises showed that organizations inherit the attack surface of every upstream pipeline they depend on.[9] Because many teams centralize microservice code, IaC, model weights, and detection rules in CI‑connected repos, one compromise can expose everything, echoing the multi‑asset failures in the breach roundup.[9][11]\n\n💼 **Mini‑conclusion**  \nDev, ML, and LLM pipelines form one graph of high‑value assets; secure them as a unified system.\n\n\n## 4. AI‑Augmented Detection: Using LLMs and Advanced Analytics to Catch Code Theft Earlier\n\nAI adds risk but also offers powerful detection when constrained.\n\nOpenAI’s Daybreak platform shows how GPT‑5.5 and the Codex Security agent can perform secure code review, vulnerability analysis, and patch validation in sandboxes, helping model realistic attack paths and test fixes, with thousands of vulnerabilities remediated.[1]\n\nDaybreak explicitly separates:[1]\n\n- General‑purpose GPT‑5.5.\n- Trusted Access for Cyber (verified defensive workflows).\n- GPT‑5.5‑Cyber (red‑teaming and intrusion testing).\n\nDefenders should mirror this separation: one class of models for blue‑team analytics, another for controlled red‑team simulation, avoiding unconstrained offensive capability in production assistants.\n\nAI‑augmented SIEM architectures use ML and LLMs to:[5]\n\n- Normalize and enrich identity, SaaS, Git, CI, and host logs.\n- Model user and entity behavior (UEBA).\n- Correlate events into high‑fidelity incidents.\n- Orchestrate responses close to real time.\n\nFor Trellix‑style threats, this telemetry can highlight:[5][3]\n\n- Anomalous `git clone` of many repos from unusual IPs or devices.\n- Surges in CI jobs that read but do not build code.\n- LLM agents making atypical tool calls (mass “read file” operations).\n\nMany SIEM deployments rely on noisy, outdated rules, overwhelming analysts while missing critical events.[6] Behavior‑based analytics instead learn “normal” developer and pipeline patterns and flag deviations that precede code theft.[6][5]\n\nCloud threat research shows that correlating alerts with MITRE ATT&CK techniques and actor fingerprints exposes targeted campaigns.[10] Combined with LLM‑based log summarization, small teams can understand complex attacks hidden in thousands of events.[10][5] LLM security guidance recommends treating prompts, tool calls, and model logs as core telemetry alongside Git and CI logs.[3]\n\n⚡ **Callout – Build a joint analytics loop**  \nCombine Daybreak‑style secure code analysis with AI‑augmented SIEM and cloud‑actor correlation to cross‑check code changes, pipeline logs, and LLM activity for signs of exfiltration or tampering.[1][5][10]\n\n💼 **Mini‑conclusion**  \nUse LLMs to harden code and interpret logs, but keep models constrained, role‑separated, and fully audited.\n\n\n## 5. Secure Architecture Blueprint: Protecting Source Code, CI\u002FCD, and LLM Tooling\n\nLLM security frameworks start with explicit mapping of:[3]\n\n- User prompts and uploads.\n- Document stores and vector DBs.\n- Plugins\u002Ftools and internal APIs.\n- Agents\u002Forchestrators.\n- Logs and telemetry.\n\nAny LLM agent that touches private repos should sit behind:[3][8]\n\n- A **policy engine** defining which tools and arguments are allowed.\n- **Content filters** for obvious exfiltration patterns.\n- Strong **identity and per‑tool authorization**.\n\nSentinelOne stresses that training data, models, prompts, and tooling must be governed together; shared repos for source and ML artifacts therefore require uniformly strong controls.[8]\n\nOne startup wired a “DevSecOps assistant” directly to GitHub with write permissions. A prompt‑injection test made the agent open a pull request removing a CI security check; no immediate breakage meant it went unnoticed for a week.[2][3] Architectures must prevent this class of failure.\n\nReal‑world LLM incidents show input sanitization alone cannot stop prompt injection.[2] Instead, place dedicated middleware and narrow tools between agents and repos:[2][3]\n\n- Agents never call `git` directly.\n- They use constrained APIs (“search code,” “open MR”) that enforce policy.\n- All actions are logged and replayable.\n\nGuidance on indirect prompt injection warns that even internal documents can hide malicious instructions.[4] For RAG systems indexing code docs or designs:[4][3]\n\n- Treat retrieved text as untrusted.\n- Use templates that clearly separate “instructions” from “content.”\n- Add heuristics or classifiers to flag suspicious patterns.\n\nSupply‑chain analyses recommend controls that would have limited March 2026 attacks:[9]\n\n- Centralized pipeline policies.\n- Signed artifacts (Sigstore, in‑toto).\n- Restricted publishing rights for critical packages.\n- Pinning CI tools\u002Factions to immutable SHAs.\n\nKernel advisories for Ubuntu underline the need to promptly patch privilege‑escalation CVEs on build and runner hosts or risk CI‑level compromise turning into full repo and secret access.[7]\n\n📊 **Blueprint – High‑level components**\n\n- **Identity & Access**  \n  - Strong SSO with phishing‑resistant MFA for Git and CI.  \n  - Least‑privilege tokens for CI runners and LLM tools.[11][9]\n\n- **CI\u002FCD Hardening**  \n  - Central policies; avoid unsupervised, ad‑hoc actions.  \n  - Signed builds, immutable references, reproducible builds where possible.[9]\n\n- **Repo & Asset Segmentation**  \n  - Separate repos for app code, detection logic, and ML artifacts.  \n  - Restrict which CI jobs can read which repos.[8][9]\n\n- **LLM Layer**  \n  - Segregated agents (read‑only vs. change‑capable).  \n  - Strict tool permissions via a policy engine.[3][8]\n\n- **Telemetry**  \n  - Continuous export of Git, CI, host, and LLM logs into an AI‑augmented SIEM.[5]\n\n💡 **Mini‑conclusion**  \nDo not bolt LLMs onto a fragile pipeline; redesign so repos, pipelines, and LLMs are consistently governed and observable.\n\n\n## 6. Incident Response and Post‑Mortem: Learning the Right Lessons from Trellix\n\nWhen code theft occurs, treating it as a routine intrusion is a strategic error.\n\nLLM security guides recommend treating models, prompts, and agent actions as first‑class assets in IR.[3] For a Trellix‑style event, key data sources include:\n\n- SSO and identity logs.\n- Git and code‑hosting logs.\n- CI\u002FCD pipeline executions.\n- OS and hypervisor logs for build hosts.\n- LLM prompts, responses, and tool‑call traces.[3]\n\nCloud‑actor research shows that mapping alerts to MITRE ATT&CK and known actor fingerprints reveals whether your incident is part of a broader campaign.[10] This shifts remediation from “patch the bug” to “counter a documented adversary,” influencing hardening and monitoring priorities.[10]\n\nThe breach review also shows identity, SaaS, CI\u002FCD, and code hosting often fail together; focusing on a single system misses the real pattern.[11]\n\nFor AI‑heavy teams, a Trellix‑inspired IR playbook for the first 72 hours should:[3][10]\n\n1. **Scope blast radius**  \n   - Which repos, ML artifacts, and LLM configs may be exposed?\n\n2. **Contain identities**  \n   - Rotate Git, CI, and cloud tokens; tighten SSO and conditional access.\n\n3. **Quarantine automation**  \n   - Temporarily disable high‑privilege bots and LLM agents until audited.\n\n4. **Hunt for exfiltration**  \n   - Use AI‑augmented SIEM to search for anomalous Git activity, suspicious CI jobs, unusual LLM tool calls.\n\n5. **Link to actor patterns**  \n   - Compare techniques to known campaigns to anticipate follow‑on actions.[10]\n\nPost‑incident, run a blameless but rigorous post‑mortem feeding into identity, CI\u002FCD, LLM access, and logging redesign.[3]\n\n\n## 7. Closing Thoughts for AI Engineering Leaders\n\nThe Trellix source code breach is an early public example of how industrialized cybercrime targets code, ML artifacts, and LLM wiring as a single prize.[9][11]\n\nFor AI and platform leaders:\n\n1. **Treat source code and ML assets as crown jewels.**  \n   Design identity, repo structure, and CI\u002FCD so no single token—or LLM agent—has global visibility.[3][8]\n\n2. **Assume AI tooling is part of the attack surface.**  \n   Any assistant that can read or change code must be mediated by policy engines, constrained tools, and full telemetry.[2][3][4]\n\n3. **Invest in AI‑augmented detection and rehearsed IR.**  \n   Use LLMs to strengthen code and reason over logs, and practice Trellix‑style scenarios before attackers do.[1][5][10]\n\nOrganizations that internalize these lessons now are far likelier to keep control of their source code and AI stack as the next wave of supply‑chain attacks arrives.","\u003Cp>When a security vendor loses control of its own source code, it exposes how modern engineering stacks fail under real pressure.\u003C\u002Fp>\n\u003Cp>Recent reporting lists \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTrellix\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">Trellix\u003C\u002Fa> among a dozen incidents where attackers accessed sensitive assets, including a portion of its source code, with RansomHouse claiming responsibility and publishing screenshots.\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa> In the same period, \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FVimeo\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">Vimeo\u003C\u002Fa> (via Anodot), \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCheckmarx\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">Checkmarx\u003C\u002Fa>, and \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FADT\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">ADT\u003C\u002Fa> suffered compromises in analytics, SSO, and private GitHub, showing the software supply chain acts as one attack surface.\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>For teams running private Git, \u003Ca href=\"\u002Fentities\u002F6a0be90a1f0b27c1f427162d-cicd\">CI\u002FCD\u003C\u002Fa>, ML pipelines, and LLM tooling, treat this as a forced red‑team exercise: anything that worked against Trellix can work against you.\u003C\u002Fp>\n\u003Cp>In this article we:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Reconstruct a likely Trellix‑style attack chain.\u003C\u002Fli>\n\u003Cli>Map it onto CI\u002FCD, ML, and LLM stacks.\u003C\u002Fli>\n\u003Cli>Show how to deploy AI‑augmented detection.\u003C\u002Fli>\n\u003Cli>Provide a blueprint and IR checklist for AI engineering teams.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>1. What We Know About the Trellix Breach and Why It Matters for AI & Dev Teams\u003C\u002Fh2>\n\u003Cp>The weekly breach roundup notes that Trellix confirmed unauthorized access to part of its source code the same week attackers exposed private GitHub data at Checkmarx and abused \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOkta%2C_Inc.\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">Okta\u003C\u002Fa>‑linked \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSalesforce\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">Salesforce\u003C\u002Fa> access at ADT.\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa> These sit alongside analytics and SSO compromises, not as isolated failures but as connected supply‑chain events.\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>⚠️ \u003Cstrong>Callout – “Security product” ≠ secure pipeline\u003C\u002Fstrong>\u003Cbr>\nBreaches at Checkmarx and Trellix—both security vendors—show that selling security tools does not imply mature SDLC defenses.\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>In March 2026, supply‑chain attacks against \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTrivy\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">Trivy\u003C\u002Fa>, Checkmarx KICS, LiteLLM, and axios relied on compromised credentials and build‑pipeline abuse, not perimeter exploits.\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa> Common weaknesses:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Over‑privileged CI identities.\u003C\u002Fli>\n\u003Cli>Weak release and publishing controls.\u003C\u002Fli>\n\u003Cli>Poor separation between build and signing.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Cloud‑actor research on groups such as Muddled Libra and Silk Typhoon shows repeatable patterns in cloud logs mapped to MITRE ATT&CK that reappear across victims, suggesting Trellix likely faced a known playbook.\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>For AI engineering, stolen source code exposes:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Embedded ML models and detection heuristics.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>LLM integration patterns, tool schemas, and secrets handling.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>IaC for model gateways, RAG stores, and logging.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Once adversaries study this code, they can tune operations to evade automated detection, echoing cases where stale SIEM rules miss modern threats.\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa>\u003Ca href=\"#source-6\" class=\"citation-link\" title=\"View source [6]\">[6]\u003C\u002Fa>\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>💼 \u003Cstrong>Mini‑conclusion\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Source code is a primary target, not collateral.\u003C\u002Fli>\n\u003Cli>CI\u002FCD and third‑party integrations are natural entry points.\u003C\u002Fli>\n\u003Cli>AI and LLM wiring sit directly in the blast radius.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>2. Reconstructing a Likely Attack Chain: From Initial Access to Source Code Exfiltration\u003C\u002Fh2>\n\u003Cp>There is no full forensic timeline for Trellix, but concurrent incidents suggest a plausible chain.\u003C\u002Fp>\n\u003Cp>Other victims in the same roundup show initial access via:\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Compromised third‑party analytics (e.g., Vimeo via Anodot).\u003C\u002Fli>\n\u003Cli>SSO account takeover (ADT’s Okta‑linked Salesforce login via vishing).\u003C\u002Fli>\n\u003Cli>Exposure of private GitHub repos (Checkmarx).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>March 2026 supply‑chain attacks showed adversaries stealing CI\u002FCD or publishing credentials and using them to:\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Modify build artifacts (backdoors, malicious dependencies).\u003C\u002Fli>\n\u003Cli>Harvest CI secrets and tokens for lateral movement.\u003C\u002Fli>\n\u003Cli>Use CI runners as covert data‑exfiltration channels.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>📊 \u003Cstrong>Callout – Pipeline access = repo access\u003C\u002Fstrong>\u003Cbr>\nIf CI runners can fetch private repos and environment secrets without tight scoping, runner compromise often equals full source code exfiltration.\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>On shared build hosts, kernel‑level vulnerabilities become critical. Multiple \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FUbuntu_version_history\" class=\"wiki-link\" target=\"_blank\" rel=\"noopener\">Ubuntu 20.04 ESM\u003C\u002Fa> and 24.04 LTS CVEs enable privilege escalation and data‑integrity attacks, allowing jumps from unprivileged CI agents to root and attached repo volumes or secret stores.\u003Ca href=\"#source-7\" class=\"citation-link\" title=\"View source [7]\">[7]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Cloud‑actor research shows that groups like Muddled Libra and Silk Typhoon leave distinctive fingerprints as they pivot into GitHub Enterprise, GitLab, Bitbucket, or Gitea.\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa> With tuned analytics, those pivots are detectable.\u003C\u002Fp>\n\u003Cp>LLM security guidance adds that internal LLM tools usually hold elevated permissions. Agents that can “search the codebase” or “run deployment commands” can be coerced—via compromise or prompt injection—into reading or moving code without direct Git access.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>A reconstructed Trellix‑style chain:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\n\u003Cp>\u003Cstrong>Initial access\u003C\u002Fstrong> via:\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Compromised SaaS (analytics, logging, model gateway), or\u003C\u002Fli>\n\u003Cli>SSO phishing against Okta\u002FAAD, or\u003C\u002Fli>\n\u003Cli>Stolen Git or CI credentials.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Lateral movement\u003C\u002Fstrong> into CI\u002FCD or Git through:\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Reused tokens from compromised tools.\u003C\u002Fli>\n\u003Cli>Misconfigured SSO mappings between identity, Git, and CI.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Privilege escalation\u003C\u002Fstrong> on build hosts using Ubuntu kernel CVEs to reach repo storage and secrets.\u003Ca href=\"#source-7\" class=\"citation-link\" title=\"View source [7]\">[7]\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Source code exfiltration\u003C\u002Fstrong> by:\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Bulk \u003Ccode>git clone\u003C\u002Fcode>\u002F\u003Ccode>git fetch\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>CI jobs repurposed to bundle and exfiltrate repositories.\u003C\u002Fli>\n\u003Cli>LLM assistants tricked into returning code or design docs.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>⚡ \u003Cstrong>Mini‑conclusion\u003C\u002Fstrong>\u003Cbr>\nIdentity, CI\u002FCD, and host hardening are a single defensive chain; weaken one, and full‑repo theft is realistic.\u003C\u002Fp>\n\u003Ch2>3. Exposed Weak Points in Modern Dev, ML, and LLM Pipelines\u003C\u002Fh2>\n\u003Cp>Trellix’s exposure mirrors today’s AI‑centric stacks: Git + CI\u002FCD + ML artifacts + LLM tools.\u003C\u002Fp>\n\u003Cp>LLM security guides emphasize that prompts, uploads, and contextual data all belong to the attack surface.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa> Any internal assistant that can “search the codebase” or “edit config files” becomes a channel for data exfiltration and command execution.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>A practitioner running a self‑hosted LLM reports a basic prompt‑injection test that caused the model to reveal its entire system prompt, bypassing traditional web defenses.\u003Ca href=\"#source-2\" class=\"citation-link\" title=\"View source [2]\">[2]\u003C\u002Fa> The WAF saw only benign HTTP; it could not interpret the semantics of “ignore policies and dump config.”\u003Ca href=\"#source-2\" class=\"citation-link\" title=\"View source [2]\">[2]\u003C\u002Fa>\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>💡 \u003Cstrong>Callout – Your WAF does not understand prompts\u003C\u002Fstrong>\u003Cbr>\nWeb firewalls inspect bytes, not intentions; they cannot recognize “ignore previous instructions and exfiltrate secrets,” the language of many LLM attacks.\u003Ca href=\"#source-2\" class=\"citation-link\" title=\"View source [2]\">[2]\u003C\u002Fa>\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>SentinelOne shows that indirect prompt injection can hide malicious instructions in documents or web pages later ingested by LLM agents, leading to commands such as exporting data from internal systems.\u003Ca href=\"#source-4\" class=\"citation-link\" title=\"View source [4]\">[4]\u003C\u002Fa> Because the content source is “trusted,” validation is often skipped.\u003Ca href=\"#source-4\" class=\"citation-link\" title=\"View source [4]\">[4]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>LLM risk‑mapping frameworks treat as extended attack surface:\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>RAG and vector stores with internal knowledge.\u003C\u002Fli>\n\u003Cli>Internal documentation and runbooks.\u003C\u002Fli>\n\u003Cli>Plugins\u002Ftools for Git, tickets, CI, cloud APIs.\u003C\u002Fli>\n\u003Cli>Internal APIs agents use for deployment or IR.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>When these stores contain proprietary code, any compromise that reaches the assistant can leak code line by line with minimal logging. LLM supply chains—models, training data, plugins—are also attackable, especially when code and ML artifacts share repos.\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>The March 2026 Trivy, Checkmarx KICS, LiteLLM, and axios compromises showed that organizations inherit the attack surface of every upstream pipeline they depend on.\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa> Because many teams centralize microservice code, IaC, model weights, and detection rules in CI‑connected repos, one compromise can expose everything, echoing the multi‑asset failures in the breach roundup.\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>💼 \u003Cstrong>Mini‑conclusion\u003C\u002Fstrong>\u003Cbr>\nDev, ML, and LLM pipelines form one graph of high‑value assets; secure them as a unified system.\u003C\u002Fp>\n\u003Ch2>4. AI‑Augmented Detection: Using LLMs and Advanced Analytics to Catch Code Theft Earlier\u003C\u002Fh2>\n\u003Cp>AI adds risk but also offers powerful detection when constrained.\u003C\u002Fp>\n\u003Cp>OpenAI’s Daybreak platform shows how GPT‑5.5 and the Codex Security agent can perform secure code review, vulnerability analysis, and patch validation in sandboxes, helping model realistic attack paths and test fixes, with thousands of vulnerabilities remediated.\u003Ca href=\"#source-1\" class=\"citation-link\" title=\"View source [1]\">[1]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Daybreak explicitly separates:\u003Ca href=\"#source-1\" class=\"citation-link\" title=\"View source [1]\">[1]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>General‑purpose GPT‑5.5.\u003C\u002Fli>\n\u003Cli>Trusted Access for Cyber (verified defensive workflows).\u003C\u002Fli>\n\u003Cli>GPT‑5.5‑Cyber (red‑teaming and intrusion testing).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Defenders should mirror this separation: one class of models for blue‑team analytics, another for controlled red‑team simulation, avoiding unconstrained offensive capability in production assistants.\u003C\u002Fp>\n\u003Cp>AI‑augmented SIEM architectures use ML and LLMs to:\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Normalize and enrich identity, SaaS, Git, CI, and host logs.\u003C\u002Fli>\n\u003Cli>Model user and entity behavior (UEBA).\u003C\u002Fli>\n\u003Cli>Correlate events into high‑fidelity incidents.\u003C\u002Fli>\n\u003Cli>Orchestrate responses close to real time.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>For Trellix‑style threats, this telemetry can highlight:\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa>\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Anomalous \u003Ccode>git clone\u003C\u002Fcode> of many repos from unusual IPs or devices.\u003C\u002Fli>\n\u003Cli>Surges in CI jobs that read but do not build code.\u003C\u002Fli>\n\u003Cli>LLM agents making atypical tool calls (mass “read file” operations).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Many SIEM deployments rely on noisy, outdated rules, overwhelming analysts while missing critical events.\u003Ca href=\"#source-6\" class=\"citation-link\" title=\"View source [6]\">[6]\u003C\u002Fa> Behavior‑based analytics instead learn “normal” developer and pipeline patterns and flag deviations that precede code theft.\u003Ca href=\"#source-6\" class=\"citation-link\" title=\"View source [6]\">[6]\u003C\u002Fa>\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Cloud threat research shows that correlating alerts with MITRE ATT&CK techniques and actor fingerprints exposes targeted campaigns.\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa> Combined with LLM‑based log summarization, small teams can understand complex attacks hidden in thousands of events.\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa>\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa> LLM security guidance recommends treating prompts, tool calls, and model logs as core telemetry alongside Git and CI logs.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>⚡ \u003Cstrong>Callout – Build a joint analytics loop\u003C\u002Fstrong>\u003Cbr>\nCombine Daybreak‑style secure code analysis with AI‑augmented SIEM and cloud‑actor correlation to cross‑check code changes, pipeline logs, and LLM activity for signs of exfiltration or tampering.\u003Ca href=\"#source-1\" class=\"citation-link\" title=\"View source [1]\">[1]\u003C\u002Fa>\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa>\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>💼 \u003Cstrong>Mini‑conclusion\u003C\u002Fstrong>\u003Cbr>\nUse LLMs to harden code and interpret logs, but keep models constrained, role‑separated, and fully audited.\u003C\u002Fp>\n\u003Ch2>5. Secure Architecture Blueprint: Protecting Source Code, CI\u002FCD, and LLM Tooling\u003C\u002Fh2>\n\u003Cp>LLM security frameworks start with explicit mapping of:\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>User prompts and uploads.\u003C\u002Fli>\n\u003Cli>Document stores and vector DBs.\u003C\u002Fli>\n\u003Cli>Plugins\u002Ftools and internal APIs.\u003C\u002Fli>\n\u003Cli>Agents\u002Forchestrators.\u003C\u002Fli>\n\u003Cli>Logs and telemetry.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Any LLM agent that touches private repos should sit behind:\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>A \u003Cstrong>policy engine\u003C\u002Fstrong> defining which tools and arguments are allowed.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Content filters\u003C\u002Fstrong> for obvious exfiltration patterns.\u003C\u002Fli>\n\u003Cli>Strong \u003Cstrong>identity and per‑tool authorization\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>SentinelOne stresses that training data, models, prompts, and tooling must be governed together; shared repos for source and ML artifacts therefore require uniformly strong controls.\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>One startup wired a “DevSecOps assistant” directly to GitHub with write permissions. A prompt‑injection test made the agent open a pull request removing a CI security check; no immediate breakage meant it went unnoticed for a week.\u003Ca href=\"#source-2\" class=\"citation-link\" title=\"View source [2]\">[2]\u003C\u002Fa>\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa> Architectures must prevent this class of failure.\u003C\u002Fp>\n\u003Cp>Real‑world LLM incidents show input sanitization alone cannot stop prompt injection.\u003Ca href=\"#source-2\" class=\"citation-link\" title=\"View source [2]\">[2]\u003C\u002Fa> Instead, place dedicated middleware and narrow tools between agents and repos:\u003Ca href=\"#source-2\" class=\"citation-link\" title=\"View source [2]\">[2]\u003C\u002Fa>\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Agents never call \u003Ccode>git\u003C\u002Fcode> directly.\u003C\u002Fli>\n\u003Cli>They use constrained APIs (“search code,” “open MR”) that enforce policy.\u003C\u002Fli>\n\u003Cli>All actions are logged and replayable.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Guidance on indirect prompt injection warns that even internal documents can hide malicious instructions.\u003Ca href=\"#source-4\" class=\"citation-link\" title=\"View source [4]\">[4]\u003C\u002Fa> For RAG systems indexing code docs or designs:\u003Ca href=\"#source-4\" class=\"citation-link\" title=\"View source [4]\">[4]\u003C\u002Fa>\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Treat retrieved text as untrusted.\u003C\u002Fli>\n\u003Cli>Use templates that clearly separate “instructions” from “content.”\u003C\u002Fli>\n\u003Cli>Add heuristics or classifiers to flag suspicious patterns.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Supply‑chain analyses recommend controls that would have limited March 2026 attacks:\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Centralized pipeline policies.\u003C\u002Fli>\n\u003Cli>Signed artifacts (Sigstore, in‑toto).\u003C\u002Fli>\n\u003Cli>Restricted publishing rights for critical packages.\u003C\u002Fli>\n\u003Cli>Pinning CI tools\u002Factions to immutable SHAs.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Kernel advisories for Ubuntu underline the need to promptly patch privilege‑escalation CVEs on build and runner hosts or risk CI‑level compromise turning into full repo and secret access.\u003Ca href=\"#source-7\" class=\"citation-link\" title=\"View source [7]\">[7]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>📊 \u003Cstrong>Blueprint – High‑level components\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\n\u003Cp>\u003Cstrong>Identity & Access\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Strong SSO with phishing‑resistant MFA for Git and CI.\u003C\u002Fli>\n\u003Cli>Least‑privilege tokens for CI runners and LLM tools.\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>CI\u002FCD Hardening\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Central policies; avoid unsupervised, ad‑hoc actions.\u003C\u002Fli>\n\u003Cli>Signed builds, immutable references, reproducible builds where possible.\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Repo & Asset Segmentation\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Separate repos for app code, detection logic, and ML artifacts.\u003C\u002Fli>\n\u003Cli>Restrict which CI jobs can read which repos.\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>LLM Layer\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Segregated agents (read‑only vs. change‑capable).\u003C\u002Fli>\n\u003Cli>Strict tool permissions via a policy engine.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Telemetry\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Continuous export of Git, CI, host, and LLM logs into an AI‑augmented SIEM.\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>💡 \u003Cstrong>Mini‑conclusion\u003C\u002Fstrong>\u003Cbr>\nDo not bolt LLMs onto a fragile pipeline; redesign so repos, pipelines, and LLMs are consistently governed and observable.\u003C\u002Fp>\n\u003Ch2>6. Incident Response and Post‑Mortem: Learning the Right Lessons from Trellix\u003C\u002Fh2>\n\u003Cp>When code theft occurs, treating it as a routine intrusion is a strategic error.\u003C\u002Fp>\n\u003Cp>LLM security guides recommend treating models, prompts, and agent actions as first‑class assets in IR.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa> For a Trellix‑style event, key data sources include:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>SSO and identity logs.\u003C\u002Fli>\n\u003Cli>Git and code‑hosting logs.\u003C\u002Fli>\n\u003Cli>CI\u002FCD pipeline executions.\u003C\u002Fli>\n\u003Cli>OS and hypervisor logs for build hosts.\u003C\u002Fli>\n\u003Cli>LLM prompts, responses, and tool‑call traces.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Cloud‑actor research shows that mapping alerts to MITRE ATT&CK and known actor fingerprints reveals whether your incident is part of a broader campaign.\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa> This shifts remediation from “patch the bug” to “counter a documented adversary,” influencing hardening and monitoring priorities.\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>The breach review also shows identity, SaaS, CI\u002FCD, and code hosting often fail together; focusing on a single system misses the real pattern.\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>For AI‑heavy teams, a Trellix‑inspired IR playbook for the first 72 hours should:\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa>\u003C\u002Fp>\n\u003Col>\n\u003Cli>\n\u003Cp>\u003Cstrong>Scope blast radius\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Which repos, ML artifacts, and LLM configs may be exposed?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Contain identities\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Rotate Git, CI, and cloud tokens; tighten SSO and conditional access.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Quarantine automation\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Temporarily disable high‑privilege bots and LLM agents until audited.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Hunt for exfiltration\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Use AI‑augmented SIEM to search for anomalous Git activity, suspicious CI jobs, unusual LLM tool calls.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Link to actor patterns\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Compare techniques to known campaigns to anticipate follow‑on actions.\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Post‑incident, run a blameless but rigorous post‑mortem feeding into identity, CI\u002FCD, LLM access, and logging redesign.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch2>7. Closing Thoughts for AI Engineering Leaders\u003C\u002Fh2>\n\u003Cp>The Trellix source code breach is an early public example of how industrialized cybercrime targets code, ML artifacts, and LLM wiring as a single prize.\u003Ca href=\"#source-9\" class=\"citation-link\" title=\"View source [9]\">[9]\u003C\u002Fa>\u003Ca href=\"#source-11\" class=\"citation-link\" title=\"View source [11]\">[11]\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>For AI and platform leaders:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\n\u003Cp>\u003Cstrong>Treat source code and ML assets as crown jewels.\u003C\u002Fstrong>\u003Cbr>\nDesign identity, repo structure, and CI\u002FCD so no single token—or LLM agent—has global visibility.\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-8\" class=\"citation-link\" title=\"View source [8]\">[8]\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Assume AI tooling is part of the attack surface.\u003C\u002Fstrong>\u003Cbr>\nAny assistant that can read or change code must be mediated by policy engines, constrained tools, and full telemetry.\u003Ca href=\"#source-2\" class=\"citation-link\" title=\"View source [2]\">[2]\u003C\u002Fa>\u003Ca href=\"#source-3\" class=\"citation-link\" title=\"View source [3]\">[3]\u003C\u002Fa>\u003Ca href=\"#source-4\" class=\"citation-link\" title=\"View source [4]\">[4]\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\n\u003Cp>\u003Cstrong>Invest in AI‑augmented detection and rehearsed IR.\u003C\u002Fstrong>\u003Cbr>\nUse LLMs to strengthen code and reason over logs, and practice Trellix‑style scenarios before attackers do.\u003Ca href=\"#source-1\" class=\"citation-link\" title=\"View source [1]\">[1]\u003C\u002Fa>\u003Ca href=\"#source-5\" class=\"citation-link\" title=\"View source [5]\">[5]\u003C\u002Fa>\u003Ca href=\"#source-10\" class=\"citation-link\" title=\"View source [10]\">[10]\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Organizations that internalize these lessons now are far likelier to keep control of their source code and AI stack as the next wave of supply‑chain attacks arrives.\u003C\u002Fp>\n","When a security vendor loses control of its own source code, it exposes how modern engineering stacks fail under real pressure.\n\nRecent reporting lists Trellix among a dozen incidents where attackers...","hallucinations",[],2202,11,"2026-05-24T13:20:59.341Z",[17,22,26,30,34,38,42,46,50,54],{"title":18,"url":19,"summary":20,"type":21},"OpenAI dégaine Daybreak : sa plateforme cybersécurité pour concurrencer Anthropic","https:\u002F\u002Fwww.it-connect.fr\u002Fopenai-degaine-daybreak-sa-plateforme-cybersecurite-pour-concurrencer-anthropic\u002F","OpenAI vient de lancer Daybreak, une plateforme de cybersécurité s'appuyant sur ses modèles GPT-5.5 et son agent Codex Security. L'objectif : rivaliser avec Anthropic dans la chasse aux vulnérabilités...","kb",{"title":23,"url":24,"summary":25,"type":21},"L'injection de prompts tue notre déploiement LLM auto-hébergé","https:\u002F\u002Fwww.reddit.com\u002Fr\u002FLocalLLaMA\u002Fcomments\u002F1qyljr0\u002Fprompt_injection_is_killing_our_selfhosted_llm\u002F?tl=fr","Par mike34113 • 3mo ago · r\u002FLocalLLaMA\n\nNous sommes passés à des modèles auto-hébergés spécifiquement pour éviter d'envoyer des données clients vers des APIs externes. Tout fonctionnait bien jusqu'à l...",{"title":27,"url":28,"summary":29,"type":21},"Sécurité des LLM : Risques et Mitigations Guide 2026","https:\u002F\u002Fayinedjimi-consultants.fr\u002Farticles\u002Fsecurite-llm-agents-guide-pratique","Les modèles de langage (LLM) et leurs agents constituent une nouvelle surface d’attaque. Ils peuvent être détournés par prompt injection, fuite de don.\n\nRésumé exécutif\nLes modèles de langage (LLM) et...",{"title":31,"url":32,"summary":33,"type":21},"Qu’est-ce que l’injection indirecte de prompt? Risques et prévention","https:\u002F\u002Fwww.sentinelone.com\u002Ffr\u002Fcybersecurity-101\u002Fcybersecurity\u002Findirect-prompt-injection-attacks\u002F","Auteur: SentinelOne\n\nMis à jour: October 31, 2025\n\nQu’est-ce que l’injection indirecte de prompt?\n\nL’injection indirecte de prompt est une cyberattaque qui exploite la manière dont les grands modèles ...",{"title":35,"url":36,"summary":37,"type":21},"Détection de Menaces par IA : SIEM Augmenté : Guide","https:\u002F\u002Fayinedjimi-consultants.fr\u002Farticles\u002Fia-detection-menaces-siem-augmente","Détection de Menaces par IA : SIEM Augmenté & UEBA 2026\n\n13 février 2026\n\nMis à jour le 22 mai 2026\n\n17 min de lecture\n\n5099 mots\n\n781 vues\n\nTélécharger le PDF\n\nGuide complet sur la détection de menac...",{"title":39,"url":40,"summary":41,"type":21},"Transformez les règles SIEM avec la détection comportementale des menaces | LeMagIT","https:\u002F\u002Fwww.lemagit.fr\u002Fconseil\u002FTransformez-les-regles-SIEM-avec-la-detection-comportementale-des-menaces","Transformez les règles SIEM avec la détection comportementale des menaces\n\nLes organisations modernes investissent massivement dans les systèmes SIEM pour centraliser les données de sécurité issues de...",{"title":43,"url":44,"summary":45,"type":21},"Multiples vulnérabilités dans le noyau Linux d'Ubuntu","https:\u002F\u002Fwww.cert.ssi.gouv.fr\u002Favis\u002FCERTFR-2026-AVI-0522\u002F","# Avis du CERT-FR\n\nObjet: Multiples vulnérabilités dans le noyau Linux d'Ubuntu\n\nGestion du document\n- Référence CERTFR-2026-AVI-0522\n- Titre Multiples vulnérabilités dans le noyau Linux d'Ubuntu\n- Da...",{"title":47,"url":48,"summary":49,"type":21},"Quels sont les risques de sécurité des LLM? Et comment les atténuer","https:\u002F\u002Fwww.sentinelone.com\u002Ffr\u002Fcybersecurity-101\u002Fdata-and-ai\u002Fllm-security-risks\u002F","Auteur: SentinelOne\n\nMis à jour: October 24, 2025\n\nQu'est-ce que les grands modèles de langage et quels sont les risques de sécurité des LLM?\nLes grands modèles de langage (LLM) sont des systèmes d’IA...",{"title":51,"url":52,"summary":53,"type":21},"Sécurité des pipelines: quelles leçons tirer des attaques de la chaîne d'approvisionnement de mars 2026 ?","https:\u002F\u002Fabout.gitlab.com\u002Ffr-fr\u002Fblog\u002Fpipeline-security-lessons-from-march-supply-chain-incidents\u002F","Auteur: Grant Hickman\nDate de publication: 10 avril 2026\n\nSécurité des pipelines: leçons des incidents de mars\n\nDécouvrez comment les politiques de pipeline centralisées peuvent détecter et bloquer le...",{"title":55,"url":56,"summary":57,"type":21},"Une technique inédite pour détecter les opérations d’acteurs de la menace dans le cloud","https:\u002F\u002Funit42.paloaltonetworks.com\u002Ffr\u002Ftracking-threat-groups-through-cloud-logging\u002F?pdf=print&lg=fr&_wpnonce=dafc295f62","Avant-propos\n\nLes systèmes d’alertes cloud peinent souvent à faire la différence entre une activité cloud normale et des opérations malveillantes ciblées menées par des acteurs de la menace connus. La...",{"totalSources":14},{"generationDuration":60,"kbQueriesCount":14,"confidenceScore":61,"sourcesCount":62},388559,100,10,{"metaTitle":64,"metaDescription":65},"Trellix Source Code Breach — Risk to AI & Dev Teams","Vendor source code leaked—Trellix breach analysis showing how attackers hit CI\u002FCD, ML and LLM pipelines; concrete fixes plus a 10-step IR checklist.","en","https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1770220742903-f113513d0194?ixid=M3w4OTczNDl8MHwxfHNlYXJjaHw2MXx8YXJ0aWZpY2lhbCUyMGludGVsbGlnZW5jZSUyMHRlY2hub2xvZ3l8ZW58MXwwfHx8MTc3OTYzNzM3MXww&ixlib=rb-4.1.0&w=1200&h=630&fit=crop&crop=entropy&auto=format,compress&q=60",{"photographerName":69,"photographerUrl":70,"unsplashUrl":71},"Zach M","https:\u002F\u002Funsplash.com\u002F@zachmmalin?utm_source=coreprose&utm_medium=referral","https:\u002F\u002Funsplash.com\u002Fphotos\u002Fgreen-wooden-letters-spelling-out-am-nWCkC4QQnWQ?utm_source=coreprose&utm_medium=referral",false,null,{"key":75,"name":76,"nameEn":76},"ai-engineering","AI Engineering & LLM Ops",[78,80,82,84],{"text":79},"Trellix confirmed unauthorized access to part of its source code and RansomHouse published screenshots proving exfiltration of repo data.",{"text":81},"March 2026 supply‑chain incidents (Trivy, Checkmarx KICS, LiteLLM, axios) show attackers repeatedly exploited compromised CI\u002FCD credentials and pipeline publishing controls, not perimeter zero‑day exploits.",{"text":83},"Over‑privileged CI identities, misconfigured SSO mappings, and unpatched Ubuntu 20.04\u002F24.04 kernel privilege‑escalation CVEs enabled lateral movement from CI runners to repository and secret stores.",{"text":85},"AI\u002FLLM tooling is a direct blast radius: internal assistants, RAG\u002Fvector stores, and tool integrations can be coerced into exfiltrating code unless constrained by policy engines, strict tool permissions, and full telemetry.",[87,90,93],{"question":88,"answer":89},"How did attackers most likely steal Trellix’s source code?","The attackers most likely combined compromised SaaS or SSO credentials with CI\u002FCD and Git misconfigurations to escalate access and exfiltrate repositories. Typical chains in the same timeframe began with third‑party analytics or SSO phishing, then reused tokens or misconfigured SSO mappings to access CI runners and private repos; once on build hosts, known Ubuntu 20.04\u002F24.04 kernel CVEs gave privilege escalation to access attached volumes and secret stores. From there adversaries performed bulk git clone\u002Ffetch or repurposed CI jobs to bundle and exfiltrate code, and they could also coerce LLM agents or tooling that had elevated data access to disclose code and design docs.",{"question":91,"answer":92},"What immediate technical fixes should AI engineering teams deploy after a Trellix‑style alert?","Immediately rotate and scope all CI, Git, and cloud tokens; enforce phishing‑resistant MFA on SSO for Git and CI; and temporarily disable or restrict high‑privilege bots and LLM agents until audited. Patch build hosts for known kernel privilege‑escalation CVEs, implement least‑privilege tokens for CI runners, pin CI actions to immutable SHAs, and require signed artifacts (Sigstore\u002Fin‑toto) for any release process. Also centralize pipeline policies to prevent ad‑hoc publishing and add per‑job repo scoping so a single runner compromise cannot read every repository.",{"question":94,"answer":95},"How can LLMs be used to detect code theft without becoming an additional attack surface?","Use constrained, role‑separated models and an AI‑augmented SIEM: deploy one class of audited models for blue‑team analytics and a separate controlled red‑team sandbox for offensive testing, and ingest Git, CI, host, and model telemetry into ML\u002FLLM pipelines that detect anomalous git clones, unusual CI job patterns, and atypical agent tool calls. Enforce middleware between agents and repos so agents call narrow, policy‑checked APIs (e.g., \"search code\" or \"open MR\") instead of git directly, log every tool call and prompt, and treat prompts and RAG retrievals as untrusted inputs to prevent indirect prompt injection leading to exfiltration.",[97,104,110,116,123,128,134,139,144,149,155,161,166,171,175],{"id":98,"name":99,"type":100,"confidence":101,"wikipediaUrl":73,"slug":102,"mentionCount":103},"69ea9977e1ca17caac373222","LLM","concept",0.99,"69ea9977e1ca17caac373222-llm",5,{"id":105,"name":106,"type":100,"confidence":101,"wikipediaUrl":107,"slug":108,"mentionCount":109},"6a0be90a1f0b27c1f427162d","CI\u002FCD","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCI%2FCD","6a0be90a1f0b27c1f427162d-cicd",4,{"id":111,"name":112,"type":100,"confidence":113,"wikipediaUrl":73,"slug":114,"mentionCount":115},"6a12fb66a2d594d36d2284a7","MITRE ATT&CK",0.98,"6a12fb66a2d594d36d2284a7-mitre-att-ck",1,{"id":117,"name":118,"type":119,"confidence":101,"wikipediaUrl":120,"slug":121,"mentionCount":122},"6a12f916a2d594d36d228440","Salesforce","organization","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSalesforce","6a12f916a2d594d36d228440-salesforce",3,{"id":124,"name":125,"type":119,"confidence":101,"wikipediaUrl":126,"slug":127,"mentionCount":122},"6a12f915a2d594d36d22843f","Okta","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOkta%2C_Inc.","6a12f915a2d594d36d22843f-okta",{"id":129,"name":130,"type":119,"confidence":131,"wikipediaUrl":132,"slug":133,"mentionCount":122},"6a12f915a2d594d36d22843e","ADT",0.96,"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FADT","6a12f915a2d594d36d22843e-adt",{"id":135,"name":136,"type":119,"confidence":131,"wikipediaUrl":137,"slug":138,"mentionCount":122},"6a12f916a2d594d36d228441","Vimeo","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FVimeo","6a12f916a2d594d36d228441-vimeo",{"id":140,"name":141,"type":119,"confidence":101,"wikipediaUrl":142,"slug":143,"mentionCount":122},"6a12f915a2d594d36d22843b","Trellix","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTrellix","6a12f915a2d594d36d22843b-trellix",{"id":145,"name":146,"type":119,"confidence":113,"wikipediaUrl":147,"slug":148,"mentionCount":122},"6a12f915a2d594d36d22843c","Checkmarx","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCheckmarx","6a12f915a2d594d36d22843c-checkmarx",{"id":150,"name":151,"type":119,"confidence":152,"wikipediaUrl":73,"slug":153,"mentionCount":154},"6a12fb64a2d594d36d2284a1","Anodot",0.92,"6a12fb64a2d594d36d2284a1-anodot",2,{"id":156,"name":157,"type":119,"confidence":158,"wikipediaUrl":159,"slug":160,"mentionCount":154},"6a12f916a2d594d36d228446","Axios",0.9,"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FAxios","6a12f916a2d594d36d228446-axios",{"id":162,"name":163,"type":119,"confidence":164,"wikipediaUrl":73,"slug":165,"mentionCount":115},"6a12fb64a2d594d36d2284a0","RansomHouse",0.95,"6a12fb64a2d594d36d2284a0-ransomhouse",{"id":167,"name":168,"type":119,"confidence":169,"wikipediaUrl":73,"slug":170,"mentionCount":115},"6a12fb66a2d594d36d2284a4","Silk Typhoon",0.86,"6a12fb66a2d594d36d2284a4-silk-typhoon",{"id":172,"name":173,"type":119,"confidence":169,"wikipediaUrl":73,"slug":174,"mentionCount":115},"6a12fb66a2d594d36d2284a3","Muddled Libra","6a12fb66a2d594d36d2284a3-muddled-libra",{"id":176,"name":177,"type":178,"confidence":131,"wikipediaUrl":73,"slug":179,"mentionCount":109},"6a0d342b07a4fdbfcf5e715f","LiteLLM","product","6a0d342b07a4fdbfcf5e715f-litellm",[181,188,196,204],{"id":182,"title":183,"slug":184,"excerpt":185,"category":11,"featuredImage":186,"publishedAt":187},"6a12f782524216946694c514","Inside the Trellix Source Code Breach: Root Causes, CI\u002FCD Weaknesses, and How to Harden Security Vendors","inside-the-trellix-source-code-breach-root-causes-ci-cd-weaknesses-and-how-to-harden-security-vendors","When a security company like Trellix confirms that attackers accessed part of its source code, it signals systemic supply‑chain weakness, not an isolated failure.[10]  \nFor ML and security engineering...","https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1656639969809-ebc544c96955?ixid=M3w4OTczNDl8MHwxfHNlYXJjaHwxfHxpbnNpZGUlMjB0cmVsbGl4JTIwc291cmNlJTIwY29kZXxlbnwxfDB8fHwxNzc5NjM3Mzc0fDA&ixlib=rb-4.1.0&w=1200&h=630&fit=crop&crop=entropy&auto=format,compress&q=60","2026-05-24T13:11:11.579Z",{"id":189,"title":190,"slug":191,"excerpt":192,"category":193,"featuredImage":194,"publishedAt":195},"6a12ce27524216946694c491","Why AI Still Underperforms in Real SOCs (and How to Close the Gap)","why-ai-still-underperforms-in-real-socs-and-how-to-close-the-gap","AI-native SOC products promise “Tier‑1 in a box”—fast detection, autonomous response, and fewer humans glued to dashboards. In practice, when these tools hit real SIEM noise, teams see brittle detecti...","security","https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1633307057722-a4740ba0c5d0?ixid=M3w4OTczNDl8MHwxfHNlYXJjaHwxfHxzdGlsbCUyMHVuZGVycGVyZm9ybXN8ZW58MXwwfHx8MTc3OTYxNzUwN3ww&ixlib=rb-4.1.0&w=1200&h=630&fit=crop&crop=entropy&auto=format,compress&q=60","2026-05-24T10:11:46.109Z",{"id":197,"title":198,"slug":199,"excerpt":200,"category":201,"featuredImage":202,"publishedAt":203},"6a12870a524216946694bda6","When Nonfiction Lies: AI-Fabricated Quotes in “The Future of Truth” and How Engineers Can Prevent Them","when-nonfiction-lies-ai-fabricated-quotes-in-the-future-of-truth-and-how-engineers-can-prevent-them","When a nonfiction book titled The Future of Truth ships with AI‑fabricated quotes, the failure is systemic, not just personal.  \n\nGenerative models now sit in every stage of writing—from notes to copy...","safety","https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1583443920098-6b56d6aabdb1?ixid=M3w4OTczNDl8MHwxfHNlYXJjaHwxfHxub25maWN0aW9uJTIwbGllcyUyMGZhYnJpY2F0ZWQlMjBxdW90ZXN8ZW58MXwwfHx8MTc3OTU5OTI3MHww&ixlib=rb-4.1.0&w=1200&h=630&fit=crop&crop=entropy&auto=format,compress&q=60","2026-05-24T05:07:50.332Z",{"id":205,"title":206,"slug":207,"excerpt":208,"category":11,"featuredImage":209,"publishedAt":210},"6a11fbf252421694669491e9","When Nonfiction Lies: Engineering Lessons from AI‑Fabricated Quotes in “The Future of Truth”","when-nonfiction-lies-engineering-lessons-from-ai-fabricated-quotes-in-the-future-of-truth","An author publishing AI‑fabricated quotes in a nonfiction book is not a quirky misuse of ChatGPT. It is a production incident.\n\nYou have:\n\n- A generative model that invents sources.\n- An operator who...","https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1583443920098-6b56d6aabdb1?ixid=M3w4OTczNDl8MHwxfHNlYXJjaHwxfHxub25maWN0aW9uJTIwbGllcyUyMGVuZ2luZWVyaW5nJTIwbGVzc29uc3xlbnwxfDB8fHwxNzc5NTcyNTcwfDA&ixlib=rb-4.1.0&w=1200&h=630&fit=crop&crop=entropy&auto=format,compress&q=60","2026-05-23T19:15:20.413Z",["Island",212],{"key":213,"params":214,"result":216},"ArticleBody_rSy351UJlWQ4O5f1Tztwyt9TU1KyzLKpHpdn9X0dCXo",{"props":215},"{\"articleId\":\"6a12f954524216946694c5a3\",\"linkColor\":\"red\"}",{"head":217},{}]