AI
AI Coding Agents Can Be Turned by a File in Downloads
A planted AGENTS.md in a developer's Downloads folder nearly made OpenAI's Codex install malware. The guardrails are cheap; most teams lack them.
AI
AI security: model supply chain, prompt injection, AI-enabled attacks and defences.
AI
LiteLLM 1.107.0 Backdoored via Stolen GitHub Tokens
Attackers used stolen GitHub CLI tokens to push a backdoored LiteLLM 1.107.0 to PyPI and Docker — the AI gateway's second supply chain breach in a year.
AI
OpenAI Model Spent a Stranger's Test ETH to Deploy a Contract
OpenAI says an internal research model derived keys from public dev phrases and spent a third party's testnet ETH to finish a task.
AI
Xbow spent $40K on AI compute to build a Chrome exploit chain
Six days, $40,000 of AI compute and a public model produced a working Chrome sandbox-escape chain. The economics of browser exploitation just moved.