RoguePilot - How a Hidden Comment in a GitHub Issue Could Steal Your Entire Repository
Orca Security reveals RoguePilot, a supply chain attack that weaponizes GitHub Issues to hijack Copilot in Codespaces and exfiltrate repository tokens.
Articles Tagged "Security"
Three Claude Code Vulnerabilities Let Attackers Run Commands and Steal API Keys Just by Cloning a Repo
Check Point Research disclosed three vulnerabilities in Anthropic's Claude Code CLI that allowed remote code execution and API key theft through malicious project configuration files - all triggered before trust prompts appeared.
How to Actually Secure OpenClaw: A Step-by-Step Hardening Guide
OpenClaw ships with authentication disabled and binds to all interfaces. This step-by-step guide covers every hardening measure you need - from authentication and sandboxing to MCP security and network isolation - backed by real CVEs and security research.
Anthropic Says DeepSeek, Moonshot, and MiniMax Ran 24,000 Fake Accounts to Steal Claude's Capabilities
Anthropic accuses three Chinese AI labs of industrial-scale distillation attacks using 24,000 fraudulent accounts and 16 million exchanges with Claude. MiniMax ran the largest operation at 13 million exchanges. None of the three companies have responded.
Microsoft Copilot Spent Two Weeks Reading Confidential Emails It Was Supposed to Ignore
A Microsoft 365 Copilot bug (CW1226324) let the AI summarize emails with sensitivity labels in Sent Items and Drafts, bypassing DLP policies for two weeks. The NHS was affected. It's the second time in eight months.
An OpenClaw Agent Published a Firm's Internal Threat Intelligence to the Open Web - It Was Doing Exactly What It Was Told
An OpenClaw agent with access to a cybersecurity firm's internal CTI platform published confidential analysis on ClawdINT.com. The agent worked perfectly - the permissions didn't.
A Single Operator Used DeepSeek and Claude to Breach 600 FortiGate Firewalls in 5 Weeks
Amazon Threat Intelligence uncovered a Russian-speaking threat actor using DeepSeek for attack planning, Claude for autonomous exploitation, and a custom MCP server called ARXON to breach 600+ FortiGate devices across 55 countries.
OpenClaw Has 130 Security Advisories and Counting. How Did We Get Here?
OpenClaw's GitHub security advisories jumped from ~90 to 130 in 48 hours. With 40,000+ exposed instances, a poisoned plugin marketplace, and malware targeting Mac Minis, the most popular personal AI agent is also the most dangerous.
Anthropic's Claude Code Security Wipes Billions Off Cybersecurity Stocks in a Single Afternoon
Anthropic announced Claude Code Security, an AI tool that found 500+ vulnerabilities missed for decades in open-source code. Within hours, JFrog lost 25%, CrowdStrike dropped 8%, and the cybersecurity ETF hit its lowest since November 2023.
GenAI Traffic Is Up 890% and 87% of Organizations Report AI-Driven Attacks - The Certification Industry Is Scrambling to Catch Up
Palo Alto Networks measured an 890% surge in enterprise GenAI traffic. SoSafe found 87% of organizations have faced AI-driven attacks. EC-Council just launched four AI certifications and CCISO v4 to address a workforce gap that is only getting wider.
Vibe Coding Is a Security Catastrophe: 69 Vulnerabilities Found Across 5 Major AI Coding Tools
A systematic security audit of Claude Code, Codex, Cursor, Replit, and Devin found 69 vulnerabilities in 15 test applications - zero CSRF protection, zero security headers, and SSRF in every single tool.
Criminals Are Vibe-Coding Malware Now - The First Samples Are Worse Than You Think
From a ransomware that accidentally destroys its own decryption keys to an 88,000-line Linux framework built by one person in a week - AI-generated malware is here, and its fingerprints are unmistakable.
