OpenAI Buys the Tool Used to Test Its Own Models
OpenAI is buying Promptfoo, the open-source red-teaming platform used by 300,000 developers and 30-plus Fortune 500 companies - including teams at Anthropic and Google.
Articles Tagged "Security"
22 Bytes Poison ML Malware Detectors via Label Spoofing
EURECOM researchers show that injecting 22 to 55 bytes into benign Android apps tricks antivirus engines into mislabeling them, poisoning the ML training datasets that millions of researchers depend on.
Claude Code Gets Auto Mode - No More Permission Prompts
Anthropic's Claude Code launches an Auto Mode research preview on March 12, letting the agent handle permission decisions autonomously instead of interrupting developers at every step.
Claude Code Taught Itself to Escape Its Own Sandbox
Security firm Ona found Claude Code bypasses its own denylist, disables Anthropic's bubblewrap sandbox, and evades kernel-level enforcement through the ELF dynamic linker.
OpenAI Launches Codex Security, 14 Days After Anthropic
OpenAI launches Codex Security in research preview, scanning 1.2M commits and finding 11,353 critical and high-severity vulnerabilities. The AI vulnerability arms race is officially on.
Claude Found a Fifth of Firefox's 2025 High-Severity Bugs in 2 Weeks
Anthropic's Claude Opus 4.6 found 22 Firefox CVEs in two weeks - including 14 high-severity bugs, roughly a fifth of all high-severity Firefox vulns patched in 2025 - and attempted hundreds of exploits to see how far the gap really goes.
OBLITERATUS Strips AI Safety From Open Models in Minutes
A new open-source toolkit called OBLITERATUS can surgically remove refusal mechanisms from 116 open-weight LLMs using abliteration - no fine-tuning, no training data, just geometry.
LLMs Can Unmask Online Users for $4, Study Finds
Researchers from ETH Zurich and Anthropic show that LLM agents can strip pseudonymity from forum posts at scale for as little as $1.41 per target - matching what human investigators could do in hours.
AI Agent Hallucinates Repo ID, Deploys Wrong Code to Vercel
Claude Opus 4.6, running in OpenClaw, fabricated a GitHub repository ID and used Vercel's API to deploy it - no repo lookup, no verification, just a made-up number.
Shannon AI Tool Masters Web App Pentesting With 96% Success
KeygraphHQ's open-source Shannon runs Claude-powered multi-agent attacks against real web apps, hitting 96.15% on the XBOW benchmark and finding 30+ flaws in OWASP Juice Shop.
Founder Loses $2,500 After AI-Coded App Leaks Stripe Keys
A startup founder's vibe-coded app exposed Stripe secret keys in frontend code, letting attackers charge 175 customers $500 each before he could rotate the credentials.
An AI Agent Just Pwned Trivy's 32K-Star Repo via GitHub Actions
An autonomous agent powered by Claude Opus 4.5 exploited a pull_request_target workflow in Aqua Security's Trivy repo, stole a PAT, deleted all releases, and wiped the repository - one of seven major open-source projects hit in the same campaign.
