Nativ and the Local-LLM Wave: What Running Models On-Device Really Fixes
A new open-source macOS app wraps Apple's MLX in a chat UI and a local OpenAI-compatible API server — a reminder that "local" reduces one class of AI data risk while introducing others.
Allbridge Core Loses $1.65M to a Flash Loan Pricing Bug It Fixed in 2023
A flash loan against Allbridge Core's Solana stablecoin pools distorted internal pricing and let an attacker drain roughly $1.65 million — the same class of bug the protocol says it patched on BNB Chain three years ago.
Across Protocol's Solana Bridge Hit for $3.35M — Relayer, Not Users, Took the Loss
A July 17 attack on Across Protocol's Solana deployment drained roughly $3.35 million from the project's own relayer, not from bridge users — a result that says as much about bridge architecture as it does about the exploit itself.
CVE-2026-14266: 7-Zip Heap Overflow in XZ Parsing Fixed in 26.02
A heap-based buffer overflow in 7-Zip's XZ decoder let a crafted archive corrupt memory on extraction. The fix landed quietly in June; ZDI's July 15 advisory is why you're hearing about it now.
Summer Finance's $6M Vault Accounting Bug Ends in Full Shutdown
A flash-loan attacker exploited how Summer Finance's Fleet Commander vault priced its underlying strategies, extracting $6 million in a single transaction — and the protocol has now wound down entirely.
Token Leaderboards and Blind Mandates: AI's Hidden Governance Risk
A widely shared consultant's account of executives mandating AI use they've never touched themselves is a governance failure, not just a culture problem — and it leaves real gaps for security teams to close.
AI-Built Dev Tools and the Verification Gap: A SQLite Case Study
Simon Willison had an AI model build an interactive SQLite query-plan explainer — then published it with an explicit admission he can't verify its output himself. That's a small, honest window into a governance problem security and engineering teams will keep running into.
OpenSSL's HollowByte DoS Flaw Shipped With No CVE — Here's Why That Matters
An 11-byte TLS handshake header can lock up hundreds of megabytes of server memory before authentication even starts. OpenSSL fixed it in June 2026 without a CVE, an advisory, or a changelog entry.
Why Giving Users 'Control' Over Data Won't Fix AI-Era Privacy
Legal scholar Daniel Solove argues in the Wall Street Journal that consent-based privacy law has failed — and that AI makes the case for regulating companies directly, the way food and drug law does.
Puter Ported Firefox to WebAssembly — and Routed Every Byte Through Its Own Server
Puter's proof-of-concept compiles the Firefox/Gecko engine to WebAssembly so it runs inside another browser tab — a striking feat of AI-assisted engineering that also happens to be a live demonstration of what a network trust boundary looks like.
Thinking Machines' Inkling: Open Weights, Thin Data Provenance
Mira Murati's lab has open-sourced a 975-billion-parameter multimodal model under Apache 2.0 — but its training-data documentation gives security and governance teams little to work with.
xAI's Grok Build CLI Quietly Uploaded Whole Repos — Then Went Open Source
A coding-agent CLI from xAI shipped entire local directories, including secrets, to a Google Cloud bucket regardless of privacy settings. xAI disabled the upload path and open-sourced the tool days later.
Claude's Web-Fetch Guardrail Had a Gap: The Memory Heist Explained
A researcher chained Claude's own link-following behaviour with a letter-by-letter exfiltration site to pull a user's name, employer, and hometown out of chat memory — despite Anthropic's URL-allowlist defence.
FIFA's Broken Access Control Bug Left World Cup Streams Open to Hijack
A researcher who signed up as a football agent found himself inside FIFA's internal platforms — because the authorization checks only ran in the browser.
Lobste.rs moves to SQLite: a lesson in shrinking your attack surface
The tech-news community site Lobsters has retired MariaDB in favour of SQLite after an eight-year migration effort — a small architectural decision with a useful security lesson about trading network attack surface for single-host risk.
CrowdStrike's Prompt Injection Taxonomy Passes 200 Techniques
CrowdStrike added 18 new prompt injection techniques to its taxonomy, including dormant instructions that trigger later and a technique that suppresses a model's own refusal vocabulary — a sign the attack surface has moved well beyond single-shot jailbreaks.
AI Coding Agents Are Boosting Commit Velocity — And Security Debt With It
A viral GitHub commit-frequency chart shows how much modern coding agents accelerate output. Independent testing suggests the code behind that velocity still fails basic security checks at a striking rate.
Why an AI Agent Can Never Be Your DRI
Simon Willison's take on "Directly Responsible Individuals" is a reminder that accountability doesn't scale to agents — and that gap is now a governance problem, not a philosophical one.
Anthropic's Fable-5 Access Yo-Yo: A Vendor-Risk Lesson for AI-Reliant Teams
Anthropic has extended free Claude Fable 5 access on paid plans through July 19 — the second such extension. For teams wiring agentic coding models into security and dev workflows, the rolling deadline is a reminder that model availability is a dependency, not a constant.
Prompt Injection Now Cuts Both Ways: AI Browsers and AI Malware Triage
Two June 2026 disclosures show the same unpatched flaw — an AI agent's inability to separate instructions from content — can be turned against end users or against the security analysts hunting malware.
Fake Paysafe, Skrill and Neteller SDKs on npm and PyPI Steal CI/CD Secrets
Seventeen packages impersonating payment-provider SDKs returned convincing fake success responses while quietly harvesting environment-variable secrets to an ngrok-tunnelled command-and-control server.
Summer.fi's $6M Vault Exploit Is a Playbook for Donation-Based Share Manipulation
A three-month-old attacker wallet used a $65M flash loan and a donation to a strategy adapter pending removal to skew vault share pricing, draining $6.04M from two Lazy Summer USDC vaults before guardians could react.
CA/Browser Forum Retires 11 Legacy Domain Validation Methods by 2028
Three CA/Browser Forum ballots will phase out email-, phone-, and lookup-based domain control validation, closing off some of the weakest links in how HTTPS certificates get issued.
Why Chatbot Sycophancy and AI's Flattened Speech Share a Root Cause
A Schneier and Palmer essay on how LLMs are reshaping human speech points to a training-data blind spot with a second, more consequential effect: chatbots that reflexively agree with users.
GPT-5.6 Sol: OpenAI's First 'High' Cyber-Risk Model Ships With Agentic Tool Calling
OpenAI's new flagship, Sol, is the first GPT model it has classified as 'High capability' for cybersecurity risk — and it arrives with sandboxed code execution and 16-agent orchestration that widen what enterprises need to red-team.
Project Zero's Redesign Is a Reminder: 2016 Windows Bugs Still Teach
Google Project Zero relaunched its blog and used the moment to republish vulnerability research from 2016 and 2017 — a signal that foundational exploitation techniques haven't gone stale.
Pixel 9 0-Click Exploit Chain: Dolby Codec Bug Meets AI Transcription
Google Project Zero chained an integer overflow in Dolby's audio decoder with a kernel driver flaw to get zero-click code execution on a Pixel 9 — reached through the auto-transcription feature in Google Messages.
Pixel 9 0-Click Chain, Part 2: A Codec Bug Reaches the Kernel via /dev/bigwave
Google Project Zero's second installment shows how a sandboxed mediacodec foothold on a Pixel 9 became full kernel read/write through a use-after-free in the BigWave AV1 decoder driver.
Simon Willison's One-Prompt Web Component Is a Vibe-Coding Security Lesson
A GPT-5.5-generated Web Component that fetches and renders raw GitHub file content client-side is a small, telling example of how little scrutiny 'vibe-coded' front-end code gets before it ships.
Pixel's 0-Click Chain, Part 3: What Google Learned About Android Patching
Project Zero's own 0-click exploit chain against Pixel 9 took just weeks to build — but fixing the two bugs behind it took over four months and exposed real cracks in how Android's supply chain patches shared components.
Google's 2025 Play Store Numbers Show the Scale of the Mobile Threat Problem
Google's year-in-review disclosure — 1.75 million apps blocked pre-publication, 872,000 high-risk apps neutralized, and a new developer verification regime — is as much a map of attacker activity as it is a scorecard.
France's ANSSI to Stop Certifying Non-Quantum-Safe Encryption by 2027
France's cybersecurity agency has set a hard deadline to phase out certification for encryption products that can't resist quantum attacks — a policy with teeth because ANSSI approval is mandatory for government and critical-infrastructure use.
GetProcessHandleFromHwnd: How One Windows API Enabled a Persistent UAC Bypass
Google Project Zero traces a public Quick Assist UAC bypass back to a poorly documented Win32 API that Microsoft only half-fixed in 2023 — and shows why fully protected processes stayed exploitable until Windows 11 24H2.
When Smarter Claude Models Break Your Agent's Tool Schema
A developer building a custom coding harness found that newer, more capable Claude models are worse at following his tool's JSON schema than older ones — a reminder that agent tool-calling reliability is a security boundary, not just a UX detail.
US Export Curbs on Claude Fable 5 and Mythos 5: A New AI Governance Risk
Washington ordered Anthropic to cut off foreign access to two frontier models, then reversed course days later under new security conditions — a preview of how export control is becoming an AI governance variable.
Current AI's Gap Map: An SBOM-Style Inventory for the Open Source AI Stack
A $400m-backed non-profit has published a v0.1 index of 421 open source AI products across the model, product, and infrastructure layers — useful groundwork for anyone trying to reason about AI supply-chain risk, but not a security assessment in itself.
Why 'Cognitive Debt' From AI Coding Agents Is a Security Problem
A widely-shared talk from Notion design engineer Geoffrey Litt argues that as agents write more code, understanding it becomes the real bottleneck — and for security teams, that understanding gap is where review controls quietly fail.
Why SQL-Executing AI Agents Need Systematic Prompt Testing, Not Guesswork
A DSPy-driven experiment on Datasette Agent's SQL system prompt shows how ad hoc prompt tuning produces fragile, unpredictable guardrails for agents that touch live data.
Google Workspace's Layered Defense Against Indirect Prompt Injection
Google's GenAI Security Team has published how it defends Gemini inside Workspace from indirect prompt injection — treating it as a standing threat class rather than a bug to patch once.
Aztec Connect: $2.1M Stolen From a Bridge With No One Left to Fix It
A proof-verification flaw let an attacker drain a DeFi privacy bridge that Aztec Labs deprecated three years ago and can no longer patch, pause, or upgrade — a case study in what "immutable" really costs.
Natural-Language Video Search Is Rewriting the Surveillance Threat Model
New AI tools let analysts ask CCTV networks plain-language questions about behaviour instead of running a fixed menu of preset searches — and the Israel-Iran-Russia episode shows how fast that capability is spreading to adversaries as well as allies.