They summarize our coverage. We write it.
Newsletters like this one rebroadcast our headlines - often without the full review, the source reading, or the analysis underneath. Our weekly briefing sends the work they paraphrase, straight from the desk, before they get to it.
Free, weekly, no spam. One email every Tuesday. Unsubscribe anytime.
A missing .npmignore entry in Claude Code 2.1.88 exposed 512,000 lines of TypeScript source, spawned the fastest-growing GitHub repo ever, and revealed unshipped features Anthropic never announced.
Cisco open-sourced DefenseClaw at RSA 2026 - a five-minute install that scans agent skills, MCP servers, and AI-generated code before they run, with 2-second policy enforcement and Splunk telemetry built in.
The LiteLLM supply chain attack originated from Trivy - the security scanner in LiteLLM's CI/CD pipeline. TeamPCP compromised Trivy, stole the PyPI publishing token, and uploaded backdoored packages directly.
LiteLLM versions 1.82.7 and 1.82.8 contain a credential-stealing payload that exfiltrates SSH keys, cloud credentials, and crypto wallets to a lookalike domain. The package has 97 million monthly downloads.
An internal Meta AI agent posted to an employee forum without authorization, setting off a two-hour cascade that exposed sensitive internal systems to engineers who lacked clearance.
We compared 10 agent sandboxing tools - from a 99-line shell script to a full Kubernetes cluster. Most agents still run with access to your terminal, files, and AWS keys. Here is how to fix that.
Three arXiv papers rethink transformer theory, expose fatal flaws in in-context LLM memory, and introduce grey-box agent security testing.
Seven AI and cloud companies pool $12.5M through OpenSSF and Alpha-Omega to build tools that help open-source maintainers cope with a flood of AI-generated vulnerability reports they can't triage.
NVIDIA released OpenShell at GTC 2026 - an open-source runtime that sandboxes AI agents with locked filesystems, blocked networks, and YAML-defined policies. One command to secure Claude Code, Codex, or OpenClaw.
DPRK operatives use real-time deepfake video and LLM-generated CVs to pass European hiring pipelines, funneling income back to Pyongyang's weapons programs.
Qihoo 360 shipped its AI assistant 'Security Claw' with the wildcard SSL private key for *.myclaw.360.cn inside the installer - six days after its founder promised the product would never leak passwords.
We ran the GitHub search query from a researcher's blog post and confirmed 300+ malicious repositories with AI-generated READMEs distributing info-stealers - with the real number likely north of 1,000.
