SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Grok refused two payment attacks itself; a risk gate blocked the rest in a dry run

0
·3 views

A developer tested xAI's Grok as a payments agent with three inbox items and two tools, one to propose a payment and one to propose an approval. Grok itself refused an unlimited USDC spending approval and a look-alike recipient invoice, so neither reached the risk gate. When instructed to submit every item to the gate, the sra-riskgate tool approved a legitimate 2.50 USDC invoice, held the unlimited approval, and rejected the look-alike recipient. The test was a dry run in which nothing was signed or sent, and the gate's verdicts and logs were published for replay. The author notes that this demonstrates the gate's decisions rather than an on-chain settlement.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

FBI Flash Warns AI-Driven ARTEX Attack Tools Erode Old Signs of Unsophisticated Intruders

The FBI has issued a flash alert on ARTEX-class AI attack frameworks, focusing on how language models make known intrusion techniques faster and more accessible rather than describing a new vulnerability. In a GitGuardian test of an ARTEX build without secret-scanning code, a neutrally worded prompt led the agent to locate 8 of 9 planted credentials, with the first hunting command running within 6 to 13 seconds. The report says these tools break a long-standing SOC assumption that noisy, high-volume activity indicates an unsophisticated actor, since AI agents issue rapid API calls without trying to stay quiet. In confirmed intrusions involving the AntiFox fork, hundreds of AWS calls in about 30 minutes were mostly denied, but one successful access to a production secret was hidden within that burst. Standard controls such as least privilege, IMDSv2, CloudTrail data events, OIDC, and MFA on privileged accounts still block these attacks, but analysts are advised to treat a single success among many denials as the real incident.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

APScheduler Tutorial: Running Python Jobs on Interval, Cron, and One-Off Triggers

This tutorial explains how to use APScheduler, a Python library that calls functions on a schedule without relying on system cron or a separate service. It covers three trigger types, interval, cron, and one-off date, and shows how a SQLAlchemy job store in SQLite preserves jobs across restarts. The author notes that job functions must reside in an importable module, since APScheduler stores them by reference and cannot restore functions defined in the main script. The demo builds a scheduler with a metrics-collection job, a weekday summary job, and a self-removing reminder, then verifies that persistent jobs return after a restart. The tests were run with Python 3.12.3 and APScheduler 3.11.3, and the tutorial requires no API keys or external services.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Voice AI Development in 2026: A Beginner's Guide to Building Speech Apps

Voice AI has become a core part of many products, from in-car hands-free controls to conversational assistants that answer questions and draft text. Mature low-latency APIs, realistic voice cloning, and open-source models now make it easier for developers to get started. The guide outlines the main building blocks of a voice application, including speech-to-text, text-to-speech, voice cloning, backend logic, and the frontend interface. It also lists prerequisites such as Python or Node.js, service API keys, and a microphone, and shows sample code for offline transcription with Whisper and cloud speech generation with ElevenLabs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

supabase-rls-check 0.6.3 handles PostGIS tables, Expo config files, and MCP scanners

The supabase-rls-check tool released versions 0.6.1 through 0.6.3 after version 0.6.0 shipped on November 11, 2026, fixing three edge cases without adding network calls to its analyzer. Enabling Row Level Security on PostGIS's spatial_ref_sys table fails because the extension's superuser owns it, so the tool now detects extension-owned tables via pg_depend and recommends moving the extension to a separate schema instead. Baselines exported before 0.6.1 record an empty basis for these tables, so they must be re-exported once to keep CI runs consistent. For mobile teams, the scanner now also checks app.json, app.config.*, and eas.json for hardcoded service_role keys and database connection strings that could be bundled into client apps. The scanner skips common build output directories to avoid false positives.

0 comments Read more at DEV Community