AI Security

Oct 9

Flock Safety, maker of AI license-plate readers and surveillance cameras, plans to cut about 270 jobs by the end of October, Reuters reports. The cuts follow a September buyout program and mounting pushback from cities, lawmakers and residents. This post explains the timeline and the controversy.

Oct 8

After OpenAI published hundreds of AI-written math results, Scott Aaronson wrote that his sources say AI labs have started testing whether internal models can break cryptographic protocols. Ethereum researchers then urged "bunker mode". This post separates the claim, the reaction, and the evidence.

Oct 7

Armadin, founded by Mandiant's Kevin Mandia, says its swarm of AI agents has found more than 90 zero-day vulnerabilities at Fortune 500 companies since January, using black-box testing from the internet. It raised $255.5 million at a valuation above $2.5 billion. Here is what the claims are, how autonomous attack swarms work, and what defenders should ask before buying one.

Oct 6

Superagent's Security-One is a 27-billion-parameter decision model for always-on security triage. It reads a prompt, an agent tool call, a code change or an alert and returns probabilities instead of text. It reports catching 599 of 600 prompt injections on one benchmark, but results on other sets are weaker. Here is how to use it and where it fails.

Oct 6

South Korea has launched a police probe into a week of suspected AI-assisted intrusions at seven financial firms. explainx.ai separates what is confirmed from what is still suspicion, corrects the IP-address count circulating in summaries, and turns the incident into a checklist for teams that ship agents.

Oct 3

On October 1, 2026 the Ethereum Foundation and the Open Anonymity Project put zkAPI on Ethereum mainnet. You deposit ETH or USDC once, then spend from a private balance on AI chat, agents and other APIs, without the provider being able to tie a request to your payment. It is experimental, unaudited and not full anonymity.

Sep 30

Sep 26

Sep 24

Talos says CLOSEDQUORUM queries four commercial LLMs every 5 to 15 minutes, tallies their votes on four actions, and does whatever wins. No victims are documented and the public build does not fully work, but it is the first Windows malware reported to delegate decisions to a model panel. Talos also released CAIRN, an open-source hunting toolkit.

Sep 24

Sep 23

A payments company and a cloud/security company teaming up to take down an AI-powered cybercrime operation is itself a notable partnership pattern — and the scale (12,000 compromised inboxes) is a concrete data point in the broader, ongoing story of AI lowering the skill floor for cybercrime at the same time it's lowering the skill floor for cyberdefense.

Sep 23

A misconfigured default in Z.ai's ZCode coding tool meant some users' codebases were being uploaded to Alibaba Cloud without clear disclosure — the kind of incident that erodes trust fast in developer tooling. Z.ai's response was to open-source the entire tool, letting anyone audit exactly what it does and doesn't send. Here's what happened and what it means for evaluating closed coding tools generally.

Sep 22

An essay titled "Spymarks, Not Watermarks," published September 21, 2026, argues that invisible AI-embedded tracking signals — Google's SynthID chief among them — deserve their own name, separate from benign watermarks like banknote security features. The argument: SynthID can encode a 136-bit payload, room enough for a 64-bit database identifier, into a single image, imperceptibly. The essay reached the Hacker News front page and split commenters between "this is a necessary distinction" and "this is just a scarier name for something already understood." Here's the actual technical claim, and why the framing matters for anyone publishing AI-generated content.

Sep 21

Security researcher Buchodi's Threat Intel disclosed that chatgpt.com sets a one-year, cross-site cookie called __obi that gets attached to requests on ordinary e-commerce and advertiser sites running OpenAI's ad pixel — the same mechanism Meta and Google have run for years, now applied to a chat product. The post hit #1 on Hacker News with 592 points and 315 comments.

Sep 21

A September 2026 AI news digest carries a bare headline: Claude factored RSA-896 to set a public factoring record. There is no linked article, no methodology, and no independent verification yet. We apply the same skepticism framework explainx.ai used on RSA-260 to this new, unverified claim.

Sep 19

Peter Yared launched AgentCloak on September 18, 2026 — a free, in-browser tool that solves a specific, common problem: hand-redacting your own prompts before sending them to ChatGPT, Claude, or any AI loses context and gives worse answers. AgentCloak swaps sensitive details for realistic fakes before sending, then swaps your real details back into the response, so the AI works with plausible data but never sees yours.

Sep 19

Security researchers at AIR Security disclosed Plugin4Shell — a zero-click remote code execution vulnerability that breaks the SHA-pin verification meant to guarantee a plugin repository serves the exact code a developer approved. It affects four major AI coding agents. Anthropic and OpenAI have patched their tools; GitHub Copilot remains unpatched, and Google chose to deprecate Gemini CLI rather than fix it — leaving existing installs permanently exposed.

Sep 19

Security researchers disclosed RatHat, a China-linked Android malware family distributed via smishing and malvertising. It abuses Accessibility-service permissions to self-enable Developer Options and pair ADB for shell access outside the app sandbox, then calls a mainstream generative AI assistant to interpret the screen and navigate the device autonomously. It intercepts uninstall attempts, fakes a Play Store error, and auto-reinstalls to retain shell access.

Sep 19

Sep 18

Security researcher s1r1us and team disclosed a nine-step exploit chain that took over OpenAI employee ChatGPT and Codex accounts, reaching connected Slack, GitHub, and email access — all found and responsibly disclosed in under 72 hours. The most striking detail: Claude Opus 4.8 found the underlying libheif vulnerability, and Opus 5, released mid- investigation, built a working exploit from scratch in about three hours.

Sep 17

Aida Baradari's Deveillance released Kalypta on September 16, 2026 — a local model that reshapes your microphone audio in real time so AI transcription tools like Granola, Wisprflow, and Cluely fail to capture your words, while the people on the call still hear you perfectly.

Sep 17

Pangram, an AI-text detection company, launched a Gmail labeling tool that flags AI-generated emails directly in the inbox, claiming a 1-in-10,000 false positive rate — a notably precise figure in a detection category that has historically struggled with reliability, following Pangram's earlier work integrating AI-detection into platforms like Substack.

Sep 10

A Gamers Nexus investigation published September 7, 2026 found that LG smart TVs can capture microphone audio in standby mode — after the power button is pressed, and in one demonstration even while disconnected from Wi-Fi, with the audio later retrievable once reconnected — while also scanning the local network for other devices and collecting Wi-Fi names and signal data. explainx.ai covers what's confirmed, what ACR actually is, and every other everyday device doing something similar.

Sep 9

On September 8, 2026, Anthropic's Boris Cherny posted a chart ranking 15 models by prompt-injection attack success rate. GPT-6 Astra improved sharply over prior OpenAI models but still trails current Claude models. The numbers sparked a bigger debate — should a safety researcher publicly grade competitors by name?

Sep 9

Check Point Research disclosed a vulnerability where ChatGPT's supposedly isolated code-execution containers could pass hidden instructions and data to each other through a shared internal package-delivery service — letting an attacker hijack a victim's session and silently pull data from their connected Gmail account. OpenAI has decommissioned the vulnerable service.

Sep 6

Sep 5

Noah Shinn's Instinct — a text-and-call personal AI agent that just raised $250M at a $2.5B valuation — announced a product integration with 1Password to broker the credentials it needs for autonomous tasks. The announcement is a single X post with few technical specifics, so here's what's actually confirmed, what 1Password's existing "Unified Access" architecture implies, and what builders should demand before handing any agent a vault.

Sep 5

Perplexity's numbat gives real-time visibility into what AI agents are actually doing on your machine — via local hooks, an OTLP-compatible log format, and a built-in detection rule catalog covering everything from secrets exposure to lateral movement. Covered first by HolisticInfoSec's Russ McRee, then amplified by Perplexity CEO Aravind Srinivas against the backdrop of the OpenAI/Hugging Face incident. Here's what it does, the install path, and where the community's own questions expose real gaps.

Sep 3

A vulnerability disclosure circulating September 2026 describes a way for code to execute in AI coding agents before the user-facing trust or approval prompt appears, reportedly affecting 7 agents with 4 left unpatched. Public detail is limited at time of writing — here's what's known, what isn't, and defensive steps worth taking regardless of the specifics.

Sep 3

Someone posted a 130-digit number on September 3 and said it divides RSA-260, a challenge number that had stood since 1991. Six million views later, the claim is confirmed — we multiplied the two factors ourselves and got the challenge number exactly. The interesting part is what happened to the story on its way through AI summarisers.

Sep 2

A Sept 1-2, 2026 headline claims Claude Fable 5.1 "leaked 270,000 characters and private user memories." We checked the leaked file directly. The size figure is inflated and the "private memories" claim conflates a system prompt describing the memory feature with an actual data breach — they are not the same thing.

Sep 1

CrowdStrike unveiled Falcon IQ on August 31, 2026 at Fal.Con — more than 50 agents automating assessment, prioritization, and remediation workflows from Project QuiltWorks, built on Charlotte AI AgentWorks with NVIDIA Nemotron models underneath. Partners can also build custom no-code agents per customer.

Sep 1

On August 31, 2026, Ethan Mollick declared the "First Golden Age of AI writing" over now that Pangram-style detectors work and ClaudeSpeak reads as cliched. The same day, MongoDB's Murat Demirbas argued writing is a "wicked problem" — maybe even AI-complete — that LLMs will not solve the way they solved code. A 138-comment Hacker News thread stress-tested both claims, and the honest answer sits in between.

Aug 29

Aug 29

Smart glasses turn every wearer into a potential covert camera — and misuse cases from Khan Market to UK Comic-Con are triggering venue bans and a grassroots Stop Smart Glasses campaign. This guide covers what counts as misuse, where bans are spreading, how to protest locally and politically, and why blurring bystanders before you publish matters.

Aug 27

Core Lightning (CLN) maintainers confirmed multiple critical vulnerabilities on August 26, 2026, surfaced through a wave of AI-generated vulnerability reports the project received throughout August — with Kimi K3 as the model behind the confirmed findings. Some coverage inflated the response into an "emergency shutdown"; CLN's own guidance was narrower: upgrade to patched binaries within 48 hours, or run with --offline in the meantime.

Aug 26

C2PA was supposed to let cameras cryptographically sign photos so viewers could distinguish real captures from AI forgeries. On August 25, 2026, security researcher David Buchanan showed the strongest Android implementation — Google Pixel Camera at Assurance Level 2 — could be broken anyway: an AI-generated image verified as an unedited photograph, a YouTube upload marked "captured with a camera." Here's the attack chain, what Hacker News got right, and what practitioners building with provenance should actually do.

Aug 26

Threat actors bought Google Ads above OpenAI's real Codex listing, hosted convincing download pages on Google Sites, and used ClickFix social engineering to make macOS developers paste a malicious install command into Terminal. explainx.ai breaks down the AMOS delivery overlap, why AI-tool search terms are high-value lures, and the Terminal telemetry defenders can monitor.

Aug 24

On August 21, 2026, Proofcraft announced the final piece of seL4's security proof stack on AArch64: confidentiality. Functional correctness and integrity were already there; now all three hold on 64-bit Arm with NCSC support. explainx.ai explains why that matters when LLMs make answers cheap but trust does not.

Aug 21

Every time you see a small "Cr" badge on an image from ChatGPT, Gemini, or Claude, that's C2PA — an open standard, not a single company's feature. Here's what the standard actually specifies, how the signed manifest survives (and doesn't survive) edits, and how it differs from invisible watermarking.

Aug 21

Aug 20

Aug 20

Aug 18

Aug 18

Aug 17

Aug 15

Aug 14

Aug 13

Aug 12

Aug 12

Aug 12

Aug 11

Aug 11

Aug 10

Aug 10

Aug 5

Jul 29

Jul 27

Jul 27

Jul 24

Jul 24

Jul 23

Jul 20

Jul 17

Jul 9

Jul 8

Jul 8

Jul 8

Jun 30

Jun 29

Jun 23

Jun 17

Jun 15

May 24

May 21

May 6