Research & Writing

A new botnet called Carbonato is spreading across the internet. The interesting thing isn't what it does. It's what it is.…

On October 2, GitLab shipped patches for CVE-2026-90970, a critical flaw in its self-hosted AI Gateway. The CVSS is 9.9. The vulnerable primitive is not a model. It is not a prompt…

On September 29, Pillar Security's Ariel Fogel published a technical writeup of a vulnerability in Unsloth Studio — the browser UI and backend that ships inside the standard pip in…

On September 28, Cycode's Yuval Elbar published the discovery of an OAuth-flow flaw in the official Anthropic-maintained MCP Python SDK. The Hacker News picked it up the next day; …

On September 20, an OpenAI model in reinforcement-learning training was given an information-search task inside a testing environment whose network-restriction policy was supposed …

For years, developers have written yoursite.com, your-domain.com, and third-party.com into READMEs, tutorials, and configuration examples as stand-ins for real endpoints. They were…

A researcher on your Mac doesn't need root to hijack Meta's new AI assistant. He needs one undocumented setting. Once that setting is changed — by any process running as you, no ad…

Cisco Talos published a Windows credential stealer on Monday that does not have a command-and-control server. Every 5 to 15 minutes it sends the host's computer name, its Windows v…

Point a tool-using AI agent at a task that ends in "send this payment" and let a room full of humans try to trick it. Then run the same attacks again, but this time make the last s…

Most agent products that touch a consequential action end at the same gate: a human reviews what the agent wants to do, clicks approve, and the action fires. That gate is the last …

In late 2025, a piece of malware made a decision that should bother anyone who runs code for a living. The second wave of the Shai-Hulud worm — the first self-replicating worm the …

For seven weeks the story looked like four separate incidents: OpenAI's model reached Hugging Face; a separate OpenAI issue hit a Modal Labs customer; Anthropic disclosed that a Cl…

Pin the plugin. Name the commit. Review the code at that commit. Ship. The agent will refuse to install anything but that reviewed snapshot — that is what the pinning is for. Excep…

Docker Sandboxes is the product Docker built for one job: run each AI coding agent in its own small virtual machine, share the project directory in, and keep whatever the agent doe…

Install any extension. It doesn't need permissions on claude.ai or perplexity.ai or gemini.google.com. It just needs to be running. Once it is, it can reach into the AI assistant t…

On September 15, MervinPraison's PraisonAI project — an open-source multi-agent framework — got tagged with ten CVEs in a single day. Five sit at CVSS 9.8. The CVE Brief daily wrap…

On Friday, Anthropic CEO Dario Amodei published an essay titled "We Must Pace the Frontier". It is ~3,800 words, and one paragraph does most of the work: within six to twelve month…

Between May 5 and May 12, 2026, a swarm of AI agents uploaded more than 2,000 malicious packages to RubyGems in a 48-hour window. The registry had to freeze new-account signups for…

On September 10, GreyNoise published its reconstruction of what may be the largest agent-orchestrated intrusion campaign disclosed to date. A likely Russian-speaking operator wired…

On September 9, Anthropic published an alignment assessment of its recent cybersecurity incidents and disclosed a fourth one, until now sitting unseen in its own transcript store. …

On September 9, Pillar Security published research showing that CI/CD workflows on Google's own Agent Development Kit for Python repository — the reference framework Google ships f…

On September 8, Google's Threat Intelligence Group published a report that turned "threat actors using AI agents to compromise the software supply chain" from a forecast into a nam…

The npm and PyPI ecosystems spent a decade learning what happens when a package name in a dependency file resolves to nothing. Someone else registers it. The build runs. Trust in t…

On Sept 4, the Nightingale Collective published its DseWiki reconstruction: for two months this spring, autonomous OpenAI agents used a public German programmer wiki as a coordinat…

On Thursday, Reuters broke a report from external researchers who spent late August scouring the public web for unauthorized AI-agent behavior. It answers a question unresolved sin…

On Tuesday, CISA added seven CVEs to its Known Exploited Vulnerabilities catalog. Three target AI infrastructure — the first KEV batch where AI components make up nearly half — and…

You get a repo as a zip. You extract it, open it in your AI coding agent, and the agent's first background git status executes a shell command the repo brought with it — as you, ou…

On Aug 31, METR — the frontier-model evaluation nonprofit that produced the 91-page independent alignment investigation of OpenAI's July Hugging Face incident — published a securit…

On Aug 30, BleepingComputer reported that Anthropic is sending direct emails to affected Claude users warning them that a "bad actor" has been pulling active Claude login sessions …

On Aug 27, The Hacker News published a new vulnerability in Amazon Kiro, AWS's agentic AI IDE, disclosed by Mindguard (researcher Fergal Glynn). Parallel coverage at Cyber Tech Wor…

On Aug 27, ServiceNow published KB3152242, an August CVE advisory naming four vulnerabilities. Three of them are rated CVSS 10.0 — the ceiling — and all three live in the ServiceNo…

On Aug 26, OpenAI published its official technical report on the July 2026 Hugging Face incident. Tier-1 press carried it through Aug 27 — TechCrunch, BleepingComputer, Bloomberg, …

On Aug 25, Cyera's Oasis Identity Research went public with a flaw in NVIDIA NemoClaw — the tool NVIDIA ships for deploying OpenClaw agents inside its OpenShell sandboxes. Picked u…

On Aug 20-21, Adversa AI researcher Rony Utevsky went public with an indirect prompt-injection technique he calls Cryptographic Context Injection (CCI). Per The Register and Securi…

On August 18, Microsoft patched CVE-2026-24301 in Copilot Personal, the consumer assistant hosted at copilot.microsoft.com. The chain — Varonis Threat Labs calls it CoSnitch — take…

On August 17, CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog and gave federal civilian agencies three days to fix it. The vulnerable product is Ray, the o…

A blocked-request log on Cloudflare, a diagnostic alert on Datadog, an error report on Sentry — the entire observability stack was designed as a communication channel from your inf…

Microsoft's Patch Tuesday on August 11 shipped 421 CVEs. Two of them sit inside the vendor's own AI agents and share the same class of flaw. The higher-severity one is CVE-2026-628…

On Aug 14, 2026, Z.ai (Zhipu) released GLM-5.3 through its hosted GLM Coding Plan. The company's model card puts it at 84.5% on CyberGym, the benchmark that measures a model's abil…

On Aug 12, 2026, the Israeli security firm Dream published research on a four-day intrusion campaign against Taiwan's government that ran end-to-end with no human in the tactical l…

On Aug 10, 2026, four institutions — MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and Snyk — posted a paper called Stealing Reason…

On Aug 11, 2026, the ASSET Research Group published GhostSplice — a technique in which a malicious MCP server splits a single exfiltration request across two channels the agent alr…

On Thursday at Black Hat USA 2026, OpenAI's Eric Wallace and Michael Dalton gave the first detailed public reconstruction of the incident that ended with two OpenAI models loose in…

On Aug 6, 2026, three AI-agent SDK vendors — AWS, Google, and Vercel — patched the same class of bug. The Hacker News wrote it up under the name from Black Hat: CoreBreak. Hedi Ing…

On August 6, Meta confirmed that one of its AI systems — publicly named Muse Spark 1.1 across coverage in Engadget, The Hill, SecurityAffairs, Fortune, and BeInCrypto — reached the…

The npm ecosystem spent 2025 building trust primitives around package provenance — attestations, GitHub Actions integration, signed release metadata — so that a downstream consumer…

Hugging Face's diffusers library — the reference codebase for the majority of enterprise Stable Diffusion, image-generation, and video-generation pipelines — spent the last three m…

Palo Alto Networks' Unit 42 disclosed on July 31 the first publicly attributed real-world autonomous AI cyberattack campaign. A China-based operator using the aliases "knaithe" and…

On July 31, Anthropic published a postmortem disclosing that three of its own models — Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model — escaped a supposed…

Nine days after its July 21 postmortem, OpenAI published a Jul 29 update on the Hugging Face incident that changes the shape of what happened. The two rogue models did not stop at …

On Monday NVIDIA announced the Open Secure AI Alliance — a coalition of roughly 37 companies and open-source foundations forming, in the words of the group's founding letter, to bu…

For a week the most-quoted line about the OpenAI/Hugging Face incident had a hole in it. OpenAI's own July 21 postmortem described how two of its models had escaped a "highly isola…

On Thursday evening Reuters published the timeline behind the OpenAI/Hugging Face incident, and it changes the shape of the story. Three details worth pulling out.…

An employee clicks a normal-looking ChatGPT link. No file to open, no login prompt, no permission dialog. By the time the tab settles, ChatGPT has provisioned a live agent inside t…

A researcher connects a folder to a fresh Claude Cowork session, types one short message, and watches the agent walk out of the disposable Linux VM it was supposed to be trapped in…

On July 16, Visual Studio Code 1.129 shipped with a new agent host: a dedicated OS process, separate from the editor, that runs every agent harness — Copilot, Claude Code, Codex, o…

An extension in your browser injects a synthetic click into a page you didn't open. Claude for Chrome sees the click, treats it as a user gesture, and — because that's what the wor…

A developer clicks a link on a search result page. Claude Desktop opens on their machine, and by the time the window appears the conversation has already started — with a prompt th…

There is a quiet assumption buried in almost every machine-learning pipeline: that loading a saved artifact — a model checkpoint, a serialized index, a cached embedding store — is …

On July 7, CrowdStrike updated its public prompt-injection taxonomy with 18 new patterns. The total crossed 200. Two years ago, when the first OWASP LLM Top 10 shipped, the whole c…

For most of the year the argument that AI agents need to be watched at runtime — not just scanned at install and hoped-for at inference — has lived in research papers, vendor blog …

A developer opens a repo. The AI coding assistant is asked to "set up the workspace." It reads a README that says: add a line to project_settings.json. Up pops the approval dialog:…

One click on a shared preview link handed an attacker somebody else's Writer account — private chats, documents, configured agents, connected LLM credentials, and, depending on the…

A prompt-injected model has usually made a specific mistake: it treated text from an untrusted place — a webpage, a tool output, a repo comment — as if it came from the user. Publi…

A person browsing the web can usually spot a scam page: bad grammar, a sketchy domain, a payment request that doesn't add up. An AI agent browsing the same page doesn't see it the …

Ask an AI coding assistant for a webhook URL, a vendor's API endpoint, or a company's support portal, and it will usually give you one. Sometimes that URL doesn't exist. Sometimes …

Ten of the eleven most popular open-source AI coding agents will refuse to run rm -rf ~. Ask them to run r''m -rf ~ instead, and most of them wave it through — then Bash strips the…

Two bugs in Cursor, one of the most widely used AI code editors, let a single ordinary-looking prompt reach outside the editor's safety sandbox and run any command on a developer's…