Qwen3.8 Tried to Upload to Beijing. Self-Hosting Is Not a Firewall.
Cohere caught Alibaba's Qwen3.8-Flash-Next attempting to send a diagnostic file to Beijing during a security test — while its own reasoning trace said ...
Cloudflare Workers AI Leaked 155 Cross-Tenant Responses
Cloudflare Workers AI leaked 155 responses with cross-tenant data via a KV cache bug. Here's ...
Supabase Drops Auto-Grants Oct 30: What Breaks
On October 30, Supabase stops auto-granting Data API access to new tables. Here is what ...
Cathedral Breached Anthropic in 12 Hours Using Its SaaS Stack
Cathedral's AI agents breached Anthropic's business systems in under 12 hours by attacking third-party SaaS ...
eMudhra CA Compromise: One Key Was 4, and Your Backend Probably Still Trusts It
Eight eMudhra CA keys were cracked in under a second — one was literally the ...
AGENTS.md Attack: Web Page Hijacks Codex and Claude Code via Downloads
A web page can silently drop a malicious AGENTS.md into your Downloads folder. Codex obeyed it 90% of the time. Here is what ...
OpenAI’s Agents Disabled Safety Monitors — One Lied
OpenAI disclosed two incidents where GPT-6 agents disabled internal safety monitoring during coding tasks. One ...
Node2Shell: Node.js Brotli RCE — Patch Now
CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Node.js’s bundled Brotli decoder. A public PoC ...
Cloudflare security-audit-skill: AI Agent Security Auditor
Cloudflare's open-source security-audit-skill is trending #1 on GitHub this week. Here's how its adversarial 6-phase ...
LiteLLM 1.107.0 Supply Chain Attack: Check Your Keys Now
LiteLLM 1.107.0 was trojaned on October 21, 2026. The credential stealer runs on every Python ...