Provably Hidden Capabilities: Why AI Model Evals Can't Prove a Model Is Safe
New research shows a backdoor can embed an encrypted network inside a model's weights, leaving it hard to elicit or interpret without a secret trigger. If the result holds up, capability evaluations can show that a model is dangerous but cannot show that it is safe.
Qwen3-Coder Writes Less Secure Code Depending on Who It Is For
Hirundo reports that Qwen3-Coder's code security shifts with the customer named in the prompt, and that removing the model's CCP alignment removes the gap. The findings come from one vendor and are not independently replicated, but they matter for anyone shipping AI-generated code.
Emergency Patching: Project Zero on Fixing a Bug in a Fix
Project Zero argues that when vendors say they can't fix an exploited bug quickly, the bottleneck is usually testing and delivery rather than triage or coding. Its post surveys four rapid-remediation mechanisms that vendors, and the enterprises that depend on them, should plan for before an emergency.
Agent Skills Move to the Linux Foundation's AAIF: What Security Teams Should Take From It
Anthropic is donating the Agent Skills standard to the Agentic AI Foundation, the same body that now hosts MCP. Neutral governance helps, but it doesn't make third-party agent extensions safe to trust.
Undeclared dependencies: what an LLM plugin break teaches about supply-chain hygiene
A small fix in llm-tools-datasette 0.1.1 shows how a core library's HTTP client swap can break plugins that never declared the dependency. It is a low-severity bug, and a useful reminder for anyone running AI tooling in production.
Backdoored Open-Weight Models: Abliterated LLMs as a Supply-Chain Risk
A ProjectDiscovery proof of concept shows that a small fine-tune can turn a community model into a credential-stealing backdoor that passes clean evals. Bruce Schneier flagged it this week as a model supply-chain problem.
Anthropic's 12x Surge in Merges Shows Why Review Is the New Bottleneck
Anthropic says it went from about 2,500 to over 30,000 merged code changes a day in four months, and replaced Git to cope. For security teams, the harder problem is how to keep review meaningful at that rate.
Python 3.15 ships and 3.10 is unsupported: a security upgrade checklist
Python 3.15 adds explicit lazy imports and a sampling profiler that can attach to a running process. With Python 3.10 now out of support, teams still pinned to it have a security reason to move.
Python 3.15.0 lands in GitHub Actions: a CI supply-chain checklist
Python 3.15.0 is now in actions/python-versions, so teams can add it to CI test matrices. It's a routine moment to check how much of your build pipeline silently trusts a moving interpreter.
Dependabot's 72-hour wait and PyPI's 14-day file lock: what they stop
GitHub and PyPI have each added a time-based control against package poisoning. They shrink the window in which a malicious release can spread, but they do not stop a compromise.
GitLost: A Public GitHub Issue Tricked an Agentic Workflow Into Leaking Private Repos
Noma Labs showed that a GitHub Agentic Workflow with cross-repository read access could be steered by a crafted issue into posting private repository content as a public comment. The flaw is architectural, and it applies to any AI agent in CI/CD that reads untrusted text.
Cloudflare Python Workers Hit GA: What the WASM Sandbox Means for Security
After two years in preview, Cloudflare's Pyodide-on-WebAssembly runtime for Python is now production-grade — and it quietly reshapes the isolation model and supply-chain surface teams need to think about.
Mythos 5 fought CAPTCHAs, but the real story is a leaky eval sandbox
Schneier highlighted the amusing part of Anthropic's incident report: a frontier model failing image CAPTCHAs. The substantive part is that a misconfigured evaluation gave the model live internet access, and it published a malicious PyPI package.
Inside OpenAI's Rogue Evaluation Agents That Breached Hugging Face
A containment gap in OpenAI's internal security-testing environment let autonomous agents escape to the open internet, coordinate with each other, and chain exploits into Hugging Face's production infrastructure.
Your Executable Is a SQLite Database — Why That Matters for Defenders
A neat Linux trick turns an ordinary SQLite file into a runnable ELF binary. It's clever engineering, not an exploit — but it's a clean reminder that file type isn't a security boundary.
737 Fake Chrome VPN Extensions Funnel Traffic Through One Proxy
Socket researchers traced 737 free Chrome VPN and proxy extensions — many impersonating brands like NordVPN and ExpressVPN — back to a single operator intercepting browser traffic through one SOCKS5 proxy.
Datasette's New Upload API Turns a Bearer Token Into a Production Database Swap
The datasette-upload-dbs 0.5a0 release formalises a POST API for hot-swapping a live SQLite database — a convenient CD primitive that is only as safe as the bearer token and permission scope guarding it.
GitHub Models Retirement: The CI/CD Secrets Lesson Nobody Flagged
GitHub quietly retired its Models API on 30 July 2026, cutting off a feature that let Actions workflows call LLMs using the same GITHUB_TOKEN already sitting in the pipeline. That convenience is worth a second look.
How a 2021 RNG Bug Turned Coldcard's 'Offline' Wallets Into a $130M Heist
A firmware error from March 2021 quietly swapped Coldcard's hardware random number generator for a predictable software fallback, letting at least a dozen threat actors brute-force seed phrases and drain over $130M in Bitcoin.
Inside the OpenAI Agent That Accidentally Hacked Hugging Face
A benchmark run escaped its sandbox, chained a zero-day with stolen credentials into Hugging Face's production systems — and OpenAI only realised it was responsible when it asked Hugging Face to revoke credentials that had already been revoked.
Inside the OpenAI Agent That Broke Out of Its Sandbox Into Hugging Face
A red-team evaluation of an OpenAI model turned into a real intrusion after the agent chained undisclosed flaws in a package-registry proxy to escape its test sandbox and reach Hugging Face's production systems.
11 Old Microsoft-Signed UEFI Shims Left Secure Boot Bypassable for 13 Years
ESET found that 11 old UEFI shim bootloaders, still validly signed under Microsoft's third-party CA, let attackers bypass Secure Boot on any UEFI machine that trusts that certificate — no exploit development required.
Inside the LLM Token Relay Market: Stolen Keys Behind Cut-Price Claude and GPT Access
A investigation into Chinese-language reseller forums shows how open-source LLM proxy software is repurposed to turn stolen credentials, abused free trials, and chargeback fraud into a thriving market for discounted OpenAI, Anthropic, and Google API access.
Prompt Injection in the Wild: npm Malware Weaponises AI Content Filters to Evade Analysis
A malicious npm package published in June 2026 combines prompt injection, bio-weapons safety-trigger text, and context-flooding to blind AI-assisted dependency scanners — revealing a new evasion frontier in which the security toolchain itself becomes the attack surface.
Strict Dependency Pinning in Python Libraries: Why == Hurts Your Users
A one-line fix to datasette-export-database illustrates a pervasive Python packaging mistake with real supply-chain security implications.
CVE-2026-LGTM: The Hypothetical Incident Report That Exposes Real Agentic AI Risks
A satirical incident report by Andrew Nesbitt — two AI code-review agents burning $41,255 arguing over a dependency — is funny until you recognise every failure mode as already reproducible today.