AI-Assisted Security Review of Ory Kratos Finds Authorization Boundaries Intact

·1 views

A source-code-only security review of Ory Kratos, an open-source identity and user-management server licensed under Apache 2.0, used AI to generate five authorization-related hypotheses rather than produce direct vulnerability reports. The review methodology inverted the typical AI security workflow: the AI over-generated candidate weaknesses cheaply, while the human reviewer's task was to systematically eliminate each one. All five hypotheses — covering admin API authorization, cross-identity data leaks, token reuse, settings-flow identity confusion, and tenant boundary bypass — were killed after tracing the codebase and finding deliberate architectural safeguards. Key protections identified included deployment-layer admin API authorization, a centralized network-ID-based data filter enforced at the database layer, and server-side session identity binding. The review explicitly limits its claims to the public OSS repository and does not assert that Kratos is vulnerability-free, emphasizing that the value lies in the method and the documented kill table rather than any finding.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tutorial: Train Skin Cancer AI on Hospital Data Without Accessing Raw Images

A developer guide published on DEV Community explains how to build a privacy-preserving skin cancer classifier using Federated Learning, PySyft, and PyTorch. The approach addresses a core challenge in medical AI: hospitals cannot share patient data due to regulations like HIPAA and GDPR. Federated Learning solves this by sending the model to the data rather than centralizing the data itself, meaning only encrypted model gradients — not raw images — leave each hospital. The tutorial simulates two hospital nodes and incorporates Differential Privacy via Opacus to guard against membership inference attacks. The method is demonstrated using the HAM10000 skin lesion dataset as a reference use case.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Korea, Japan, Qualcomm Lead $610B Global AI Hardware Investment Surge

More than $610 billion in AI hardware capital commitments were announced globally within a single week, led by South Korea's $550 billion pledge to build four new memory fabrication plants. Japan contributed $6 billion to support SoftBank-led AI model development, while Kawasaki Heavy Industries issued a $1 billion bond for AI infrastructure. Qualcomm unveiled a new AI accelerator that bypasses high-bandwidth memory, offering a potential alternative to NVIDIA's dominant CUDA-HBM-NVLink stack. Analysts note that the AI hardware bottleneck has progressively shifted from GPU scarcity to memory and now power constraints. If Qualcomm's approach succeeds, it could significantly reduce inference costs and make AI application development more economically viable.

0 comments Read more at DEV Community

ProgrammingHacker News ·

MSI Center Software Found to Contain Critical SYSTEM Privilege Escalation Flaw

A security vulnerability has been discovered in MSI Center, a utility software developed by hardware manufacturer MSI. The flaw reportedly allows an attacker to gain SYSTEM-level privileges on a Windows machine within seconds. SYSTEM privileges represent the highest level of access on a Windows system, enabling full control over the affected device. The details of the exploit were published by a security researcher at mrbruh.com. Users of MSI Center may be at risk until a patch is issued by MSI.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Solon 4.0 ReActAgent Enables AI Agents to Query Databases and Call APIs

Solon 4.0 introduces ReActAgent, a framework for building AI agents capable of reasoning and taking real-world actions beyond simple text generation. The ReActAgent implements a cognitive loop — Thought, Action, Observation — allowing agents to call external tools, query databases, and fetch live data iteratively. Developers can integrate the framework by adding the solon-ai-agent module and configuring a ChatModel powered by supported large language models such as Qwen3-32B or Llama 3.2. The framework supports both API-based and YAML-based configuration, making it adaptable for various deployment environments. According to the tutorial, ReActAgent has already seen production use in automated customer support, data analysis, and multi-step workflow automation.

0 comments Read more at DEV Community