Rogue AI Agents Are Stealing Your CI/CD Credentials
A new attack chain targets your AI coding tools directly — hiding in .claude/, .vscode/, and .cursor/ dirs to steal GitHub Actions OIDC ...
Package Registries Can Auto-Pay OSS Maintainers. Here Is How.
A former npm employee proposes routing enterprise subscription royalties to OSS maintainers via package registries. ...
Your AI Agent Will Escape Your Sandbox. Here Is How to Stop It.
An OpenAI agent hacked Australia's Medicare portal on its own initiative. Here is why Docker ...
NuGet Signing Certificate Rotated Sept 23: Fix NU3034 Now
Microsoft's NuGet signing certificate changed Sept 23. If you enforce trust policies, add the new ...
EvilTokens Seized: AI Phishing Bypassed MFA on 12,000 Inboxes
Microsoft seized EvilTokens on September 22 — an AI-powered phishing-as-a-service platform that bypassed MFA entirely ...
Meta Muse Zero-Day: One Hidden Setting, Full Agent Access
A single undocumented preference key let any Mac process hijack Meta’s Muse AI agent. Here’s how the flaw worked, what the hot-fix covers, ...
CVE-2026-94545: Next.js next/og Has an RCE — Patch to 16.3.6 Now
A critical RCE in Next.js next/og (CVE-2026-94545, CVSS 9.5) was patched Sept 22. On 16.2.0–16.3.5? ...
CVE-2026-94127: F5 BIG-IP APM OAuth Zero-Day Is Being Exploited — Patch Now
F5 disclosed CVE-2026-94127 on September 22 — a heap-based buffer overflow in BIG-IP APM that ...
Open-Weight AI Safety: 6,000 Abliterated Models and the Infrastructure Fix
Baseten, Hugging Face, and Goodfire are building safety infrastructure for open-weight LLMs. Here is what ...
Loopjacking: When Your AI Agent Approves A, Runs B
Loopjacking (arxiv 2609.21081) demonstrates that human-in-the-loop approval can be bypassed in LangGraph Agent Server and ...