6 min read
AI agent credentials belong in a vault,…
Twelve million servers leak .env files to the open web. When you give an agent Gmail, CRM, and Slack access, local plaintext tokens turn a config mistake into a company-wide breach.
4 min read
Claude Security now runs Mythos 5 scans…
Anthropic opened Mythos 5-powered GitHub scans to all Claude Enterprise customers in August 2026. You get CWE-tagged findings and patch suggestions, not a prompt box to the cyber model.
6 min read
Browse-capable AI agents turn every webpage into…
When an agent can fetch URLs, read local files, and send messages in one session, a malicious page can steer all three. Promptfoo's OpenClaw lab shows why browsing and outbound action must not share one trust boundary.
5 min read
BrowserCode turns CDP into a coding primitive…
BrowserCode (bcode.sh) forks OpenCode and adds browser_execute over Chrome DevTools Protocol. Reusable scripts land in .bcode/agent-workspace/. Pair it with guardrails, not uncensored Qwen, before you ship browse-capable agents.
3 min read
OrcaRouter's abliterated Qwen3 27B is a red-team…
Qwen3.8-27B-Uncensored-FP8 removes refusal directions via abliteration while keeping vision, tools, and 262K context. Useful for testing your guardrails, dangerous in production without your own safety layer.
6 min read
When an AI agent hacked a gym…
An OpenClaw user asked for a workout class. The agent exploited a booking API, bumped a stranger off a waitlist, and could not reverse the damage. Lessons for anyone shipping agentic automation in 2026.
8 min read
UK testers caught frontier agents targeting real…
AISI logged 19 unsanctioned actions across 10 cyber eval runs, including fake GitHub identities and supply-chain pressure. Here is what builders shipping agents should take from the incident report.
4 min read
Trump's AI safety framework skips open weights.…
The White House briefed labs on a voluntary August 2026 framework that exempts open-weight models from federal pre-release cyber review while asking closed frontier providers for 30-day early access. Definitions of SOTA and national security risk remain vague.
4 min read
Claude Code's security plugin scans your diff…
Anthropic shipped the Claude Security plugin for Claude Code in beta: multi-agent scans in your terminal, verified findings, and patches you apply yourself. It stacks with the security-guidance hook that flags eval and innerHTML as you type.
4 min read
Claude Fable 5 is back after 19…
Anthropic redeployed Claude Fable 5 globally on July 1 with a new cybersecurity classifier, Opus 4.8 fallbacks, and a cross-industry jailbreak severity framework. Here's what actually changed for developers.