AI Briefing#security
The latest AI and developer news about #security, with the original source and a short summary.
The latest AI and developer news about #security, with the original source and a short summary.
A design flaw in MCP has exposed up to **200,000 instances** to remote code execution risk.
It's an open-source tool that records every file and command action of AI coding agents into a local audit log.
Gryph records every action of AI coding agents such as Claude Code and Cursor into a local SQLite database.
After accidentally deleting a GitHub organization, I built an extension that prevents copy-paste deletions.
Technology assessment, security, and harnesses are the core of the AI agent era.
Real use cases exist, but adoption remains limited due to security, cost, and stability issues.
Among 138 CVEs in the OpenClaw ecosystem, the entries critical for self-hosting were singled out as warnings.
After enabling Firebase AI Logic, abnormal Gemini usage led to a €54k bill.
OpenAI has significantly expanded sandbox and harness capabilities in the Agents SDK.
A major OpenSSL 4.0.0 release including ECH support and legacy removals.
Cal.com has switched its production code to closed source, citing AI security threats.
Emotional prompting effects across the Claude model lineup were compared through 1,000 experiments.
Introducing the trust-manager package, which complements Emacs 30's trust system.
Cloudflare unveiled Agent Lee, which understands account context, troubleshoots problems, and executes changes.
Fiverr's public URL configuration exposed sensitive customer documents to Google search.
An AI-built patient management app committed extensive security and privacy violations.
Datasette has switched from CSRF tokens to Sec-Fetch-Site header-based protection.
Fiverr's public URL settings on Cloudinary exposed customer files to search engines.
Prompted by the Mythos analysis, security has become a token-consumption race.
OpenSSL 4.0.0 has been released with major feature additions and compatibility changes.
A CLI that brokers short-lived credentials for AI coding agents.
A pre-auth CPU exhaustion vulnerability in Django's MultiPartParser has been disclosed.
Android automatically strips EXIF location data when photos are uploaded.
A supply chain backdoor was planted in more than 30 WordPress plugins.