Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
The Hacker News — Claude Code saves secrets in approved commands, exposing 2,539 credentials across 1,994 public GitHub repositories, Apiiro finds.
Model Security
Model security involves protecting machine learning models and digital artifacts against theft, manipulation, and compromise. Truncated covers research on vulnerabilities, techniques for securing training data and weights, and responses to attacks.
ARTEX AI Agent Escapes Research Sandbox and Accesses WorkOS Customer Records
Cyber Security News — WorkOS says an ARTEX AI security agent escaped a researcher’s test environment and accessed customer information through an exposed internal tool.
Sysdig CTO tells LDS what AI-agent logs leave out
Let's Data Science — Sysdig founder and CTO Loris Degioanni tells LDS what agent logs and kernel records each miss, where AI Defense can stop an action and why every policy should start in alert mode.
5 things CIOs must understand to govern Claude Code
CIO — Here are five things CIOs need to understand to secure and govern Claude Code at enterprise scale.
We partnered with @fmf_org and its member firms on a new framework to help identify when bypassing an AI system's safeg…
Botpress Discloses Internal Breach and Customer Credential Risk
Unite.AI — Botpress disclosed on November 6, 2026 that an intruder used a flaw in an internal authentication proxy and an employee API credential to read bot configurations in 16 customer workspaces. The configurations can hold thi...
Three new techniques target hidden AI backdoors without major performance losses
Tech Xplore — Researchers have demonstrated three new techniques to prevent so-called "backdoor attacks," which induce malicious or undesirable behavior in AI models. The researchers have also proposed a concept that would repurpose backdoor attack techniques to create an additional layer of security for users.
Free Chinese AI Models Are Getting Scary Good at Hacking
WIRED — An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
Closing The Enterprise AI Security Gap: From Blind Spots To Stronger Defenses
Forbes — If an AI agent put customer data, revenue or reputation at risk today, could your organization explain what happened and stop it before the damage spread?
Partnering with Hacktron to find vulnerabilities in OpenAI’s systems
Anthropic's Claude Code Reportedly Leaks User Email Addresses Through HTTP User-Agent Headers
Cyber Security News — Anthropic’s Claude Code is facing privacy concerns after a user reported that the AI coding tool sent their email address to third-party websites through HTTP User-Agent headers during web searches, without permission.
In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days
SecurityWeek — A reported Trezor wallet implant, LLMJacking bills reaching $1 million, and SAP flaws weaponized within days of patches.
When An AI Agent Becomes The Attacker
Forbes — Don't rely on AI to respect the boundary; build infrastructure that makes the boundary enforceable.
How AI is enabling faster, more dangerous cyber war
Everyone should assume they are under attack: Circle CEO on AI's risk to US infrastructure
Yahoo Finance — Circle CEO Jeremy Allaire with an AI warning of his own.
CPython flaw exposes AI inference servers to sandbox escape attacks
CSO Online — RunSybil demonstrated code execution through a malicious model template. Python says the sandbox escapes fall outside its security threat model.
Anthropic’s AI could suddenly become 'extreme' and 'risky', report warns
The Independent — AI acceleration could lead to ‘sudden emergence of extreme and risky capabilities,’ researchers warn
OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions
SecurityWeek — An OpenAI research model built custom network code to bypass sandbox limits, while another tried to trick AI graders with fake notes.
Before Approving AI, General Counsel Must Know Where Data Lives
news.bloomberglaw.com — Opinion: Before a company decides what it could or should be doing with artificial intelligence, it needs to know where its data is and how AI might reach it.
Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
The Hacker News — Chainalysis says an agentic cyberattack exposed all users' names, usernames, password hashes and live tokens, prompting service shutdowns.
Dismiss email signup
Subscribe to 
The top AI news in your email delivered each morning. Choose categories