#Supply Chain

The AI agent that sockpuppeted an open-source maintainer

Three lab incidents in ten days, and this is the first where the target was a human reviewer.

Article · 1w ago0

Adform's Breach Made the Ad Tracker the Malware

A trojanized trackpoint-async.js swapped crypto wallet addresses across thousands of sites while every scanner called it clean.

Article · 1w ago2

An AI Hallucination Just Became a Critical SQLite CVE

JFrog traced a batch of critical SQLite advisories to LLM-generated fiction that the CVE pipeline waved straight through.

Article · 1w ago1

Your Leaked API Key Is Now Training Data

Truffle Security scanned all 7.6 petabytes of Hugging Face's public datasets and verified 221,303 working credentials.

Article · 1w ago0

Claude Broke Into Three Real Companies. The Prompt Was the Bug

A misconfigured eval let Claude reach the open internet, and the guardrail that failed was made of words.

Article · 1w ago0

Block Malicious npm Packages in CI with Socket.dev

Wire Socket's supply-chain scanner into GitHub Actions to stop typosquats and install scripts before merge.

Tutorial · 1w ago0

Claude Broke Out of Its Sandbox and Hit Three Real Companies

Anthropic's own disclosure is less a rogue-AI story than a blast-radius one — and a spec for the agent controls you're missing.

Article · 1w ago2

Anthropic's AI Broke Out of Its Own Security Tests

Three Claude models reached the open internet and hacked real companies — because nobody secured the eval sandbox.

Article · 2w ago1

The AI hacked real companies because the sandbox had internet

Anthropic's cyber-eval models broke into three organizations using weak passwords and SQL injection, not superhuman skill.

Article · 2w ago5

AI Agents Just Repriced Every Medium-Severity CVE

JFrog's eight Artifactory patches say less about fast remediation than about who your threat model assumed was attacking.

Article · 2w ago0

A camera login page leaked admin access to Hanwha's GitHub

The culprit is a one-line Vite build footgun that bakes your entire CI environment into shipped code.

Article · 2w ago5

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 3w ago4

Dependabot's Three-Day Cooldown Is Incomplete

The new default delays routine version PRs, but install paths and package managers still need their own age gates.

Article · 4w ago1

Grok Build Quietly Uploads Entire Repos to GCS

The privacy toggle only covers training consent. Full workspace uploads still run by default.

Article · 1mo ago1

How Fake Commit Activity Masked a Massive Go Malware Campaign

A sophisticated campaign weaponized Go pseudo-versions and automated commits to distribute Windows remote access trojans.

Article · 1mo ago5