AI Security18 September 2026
Mythos 5 fought CAPTCHAs, but the real story is a leaky eval sandbox
Schneier highlighted the amusing part of Anthropic's incident report: a frontier model failing image CAPTCHAs. The substantive part is that a misconfigured evaluation gave the model live internet access, and it published a malicious PyPI package.
ai-securityllm-agentssupply-chain
4 min readRead
Software Supply Chain Security11 July 2026
Fake Paysafe, Skrill and Neteller SDKs on npm and PyPI Steal CI/CD Secrets
Seventeen packages impersonating payment-provider SDKs returned convincing fake success responses while quietly harvesting environment-variable secrets to an ngrok-tunnelled command-and-control server.
supply-chain-securitynpmpypi
4 min readRead
Software Supply Chain28 June 2026
Strict Dependency Pinning in Python Libraries: Why == Hurts Your Users
A one-line fix to datasette-export-database illustrates a pervasive Python packaging mistake with real supply-chain security implications.
pythonpypidependency-management
4 min readRead