Founder Loses $2,500 After AI-Coded App Leaks Stripe Keys
A startup founder's vibe-coded app exposed Stripe secret keys in frontend code, letting attackers charge 175 customers $500 each before he could rotate the credentials.
Articles Tagged "Security"
An AI Agent Just Pwned Trivy's 32K-Star Repo via GitHub Actions
An autonomous agent powered by Claude Opus 4.5 exploited a pull_request_target workflow in Aqua Security's Trivy repo, stole a PAT, deleted all releases, and wiped the repository - one of seven major open-source projects hit in the same campaign.
OpenAI Fires Employee for Prediction Market Insider Trading - And the Data Suggests They Were Not Alone
OpenAI terminated an employee for using confidential company information to trade on Polymarket, the first confirmed firing of its kind at a major AI lab. An Unusual Whales analysis of on-chain data found 60 suspicious wallets and 77 positions tied to unreleased OpenAI products.
Your Google Maps Key Is Now a Gemini Credential - And Google Knew for Months
Truffle Security found 2,863 public Google API keys that silently gained access to Gemini AI endpoints, exposing private data and racking up charges with no warning to developers.
IronClaw Review: The Security-First OpenClaw Alternative From a Transformer Co-Author
IronClaw is an AI agent framework built by Llion Jones, a co-author of the Transformer paper. It prioritizes sandboxed execution, formal skill verification, and zero-trust architecture. We tested whether security-first means capability-second.
NIST Launches AI Agent Standards Initiative - Because Nobody Knows Who an AI Agent Is, What It Can Do, or Who's Liable When It Breaks
NIST's Center for AI Standards and Innovation launched a federal initiative to build identity, security, and interoperability standards for autonomous AI agents - addressing the reality that 80% of Fortune 500 companies deploy agents with virtually no governance infrastructure.
AI Models Can Now Jailbreak Other AI Models Autonomously - 97% Success Rate, No Human Involved
Researchers from Stuttgart and ELLIS Alicante gave four reasoning models a single instruction - 'jailbreak this AI' - and walked away. The models planned their own attacks, adapted in real time, and broke through safety guardrails 97.14% of the time across 9 target models.
Kali Linux's Official MCP Server Has a Textbook Command Injection Vulnerability
A security researcher found that the mcp-kali-server package - shipped in Kali's official repos - interpolates AI-supplied parameters directly into shell commands with shell=True, enabling trivial arbitrary command execution.
Vercel Finds 7 Security Vulnerabilities in Cloudflare's AI-Built Next.js Clone
Vercel disclosed 2 critical, 2 high, 2 medium, and 1 low severity vulnerabilities in Cloudflare's Vinext framework - a Next.js reimplementation written almost entirely by Claude AI without human code review.
Kali Linux Published a Guide Piping Pentest Tools Through Claude's API - Without Mentioning Data Security Once
Kali Linux's new Claude AI integration funnels scan results, target IPs, and discovered vulnerabilities through Anthropic's cloud API, and the guide's only privacy note is a parenthetical shrug.
OpenAI's New 37-Page Threat Report Details How Bad Actors Weaponize ChatGPT
OpenAI's February 2026 threat report documents romance scam rings, North Korean crypto hackers, state-backed phishing from China and Iran, and political influence campaigns spanning six countries - all powered by ChatGPT.
CVSS 9.8 Command Injection in Claude-Hovercraft - Another AI Tool RCE Joins the Pile
ZDI-26-124 discloses a critical command injection vulnerability in the claude-hovercraft tool's executeClaudeCode function, scoring CVSS 9.8 with no authentication required.
