Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

We built an embeddable AI chat widget, hybrid RAG search, and agent portability — here's how (CrewForm v1.8.0)

CrewForm is an open-source AI agent orchestration platform — think "Slack for AI workers." You create agents, wire them into teams (pipeline, orchestrator, or collaboration mode), and let them handle tasks. BYOK, self-hostable, all three a…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

CrewForm is an open-source AI agent orchestration platform — think "Slack for AI workers." You create agents, wire them into teams (pipeline, orchestrator, or collaboration mode), and let them handle tasks. BYOK, self-hostable, all three agentic protocols (MCP + A2A + AG-UI).



Today we're shipping v1.8.0 with three major features we're really excited about.



💬 Embeddable Chat Widget

You can now deploy any CrewForm agent as a chat bubble on your website with a single script tag:




<script
src="https://runner.crewform.tech/chat/widget.js"
data-key="cf_chat_your_key_here"
data-theme="dark"
data-position="bottom-right"
async
></script>






That's it. No React, no build step, no npm install. Paste it before closing body tag and your visitors can chat with your agent in real-time with streaming responses.



What we built under the hood:



Standalone Vite build that outputs a single widget.js bundle

Shadow DOM isolation — zero CSS conflicts with your existing site

Domain whitelisting via cf_chat_ API keys

Session memory — conversations persist across page reloads

Rate limiting per visitor

Settings UI with embed snippet generator and live preview

The widget connects directly to your task runner via SSE, so responses stream in word-by-word. We bundle it inside the Docker image so self-hosted deployments get it for free.



🔍 Knowledge Base: Hybrid Search + Retrieval Testing

Our RAG pipeline got a serious upgrade. Previously it was basic vector search — now it's production-grade.



Hybrid Search

We combine vector similarity (cosine distance via pgvector) with PostgreSQL full-text search (tsvector + ts_rank_cd):



Final Score = (0.7 × cosine_similarity) + (0.3 × ts_rank)

The over-fetch + rerank strategy retrieves 2× results from each method, deduplicates, and returns the top-K. This dramatically improves recall for queries that mix semantic meaning with specific keywords.



Metadata Tags

Documents can now be tagged (e.g., "FAQ", "Technical", "Policy") with GIN-indexed filtering. Tag your docs, then filter search results by tag — both in the UI and via the API.



Retrieval Tester

This is my favorite part. Before deploying retrieval to agents, you can test it interactively:



Type a query, see matched chunks with color-coded similarity scores

Toggle between vector-only and hybrid search

Filter by document or tag

Adjust top-K (1–20)

See response times for benchmarking

No more "deploy and pray" — you can validate retrieval quality before it touches your agents.



📦 Agent/Team Export & Import

Share agents and teams as portable JSON files:




{
"format": "crewform-export",
"version": 1,
"type": "team",
"data": {
"name": "Content Pipeline",
"mode": "pipeline",
"agents": [
{ "ref_id": "abc", "role": "researcher", "agent": { ... } },
{ "ref_id": "def", "role": "writer", "agent": { ... } }
]
}
}






Export an agent or team with one click — the JSON includes everything (model, prompt, tools, voice profile, config). Team exports are self-contained with all member agents embedded inline.



Import into any workspace — agent IDs get remapped automatically to maintain referential integrity in team configs. Custom tools are stripped (not portable across workspaces).



This is the foundation for agent sharing — export a team, send it to a colleague, they import it and they're running.



Also in this release

AG-UI Rich Interactions — Agents can now pause mid-execution and ask for approval, data confirmation, or present choices

Marketplace Agent README — Published agents can include rich Markdown documentation

License Key Validation — HMAC-SHA256 cryptographic verification

OpenTelemetry + Langfuse — Opt-in tracing for LLM calls, tool use, and team runs



Try it

🌐 Hosted: crewform.tech — free tier, no credit card

🐳 Self-hosted: docker compose up -d

⭐ GitHub: github.com/CrewForm/crewform

📖 Docs: docs.crewform.tech

💬 Discord: discord.gg/TAFasJCTWs

We'd love feedback — especially on the hybrid search and retrieval tester. What features would you want next?

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
1 Warnungen
title: Detect Exploitation - We built an embeddable AI chat widget, hybrid RAG search, and agent portability — here's how (CrewForm v1.8.0)
id: a266d085-0cd0-44c2-a9de-09e4f339ddaf
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "We built an embeddable AI chat" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("We built an embeddable AI chat widget hy")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*We built an embeddable AI chat widget hy*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "We built an embeddable AI chat widget hy"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich We built an embeddable AI chat widget, h.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten We built an embeddable AI chat widget, hybrid RAG search, and agent portability — here's how (CrewForm v1.8.0)

Thematisch verwandte Begriffe: built, embeddable, chat, widget · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100503 | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerabil…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag