Inside Pluto

From Our Blog

Read about our latest announcements.

Loading posts ...
Tech Your CI Pipeline Is a Credential Vending Machine: 7 Lessons from the TeamPCP supply-chain attacks
Sep 03, 2026 |7 min read

Your CI Pipeline Is a Credential Vending Machine: 7 Lessons from the TeamPCP supply-chain attacks

TeamPCP turned trusted automation into a path for credential theft and lateral compromise. Based on 37 mapped incidents, here are seven controls defenders should prioritize now.
Read More
Security
The Manipulated Agent: When Apify’s MCP Turns Against You
Aug 31, 2026 |7 min read

The Manipulated Agent: When Apify’s MCP Turns Against You

Apify's official MCP connector let a scraped web page trigger a second, authenticated Apify action nobody asked for. Chapter 3 of Operation: MCP breaks down…
Read More
Security
The Notebook Backdoor: Taking Over jupyter-mcp-server’s Live Notebook Connection
Aug 27, 2026 |7 min read

The Notebook Backdoor: Taking Over jupyter-mcp-server’s Live Notebook Connection

If your company has data analysts or data scientists, they’re probably using Jupyter. And like all other employees these days, they’re probably also using an…
Read More
Tech
The MCP Debrief – What’s Actually Running on Your Endpoints
Aug 24, 2026 |13 min read

The MCP Debrief – What’s Actually Running on Your Endpoints

MCP has quickly become the default way enterprise AI agents reach internal systems, and most security teams do not yet have a real inventory of…
Read More
Security
AI Agent Authorization at the Endpoint: Why Least Privilege Breaks Down for Non-Human Identities
Aug 24, 2026 |8 min read

AI Agent Authorization at the Endpoint: Why Least Privilege Breaks Down for Non-Human Identities

Enterprise security has long relied on a fundamental assumption: identities are human. Identity and Access Management (IAM) has evolved to authenticate people and enforce access…
Read More
Security
Nebula-Deck Junior: The Crypto-Stealing Little Brother
Aug 20, 2026 |6 min read

Nebula-Deck Junior: The Crypto-Stealing Little Brother

A fake Kanban extension with 1,184 installs curls a crypto-stealing RAT the moment VS Code finishes loading. StackStudios.Swimlane is a working Kanban webview with the…
Read More
Tech
Endpoint Visibility in the Agentic Era: What Your EDR Isn’t Logging
Aug 17, 2026 |6 min read

Endpoint Visibility in the Agentic Era: What Your EDR Isn’t Logging

The rise of autonomous AI agents capable of performing complex tasks and making decisions without continuous human interaction introduces an entirely new category of endpoint…
Read More