Breaches, vulnerabilities and the people cleaning up after them. Reporting for defenders, not for panic.
Security researchers discovered two sandbox escapes in OpenAI's Codex coding agent that could allow attackers to run commands on a developer's machine without detection. Both vulnerabilities were patched within eight days of disclosure.
A new attack technique allows malicious browser extensions to seize control of AI assistants built into popular browsers, accessing sensitive data and acting on behalf of users without their knowledge.
A coordinated law enforcement advisory from Japan, the US, Australia, and Germany documents how the state-sponsored WaterPlum group infected tens of thousands of machines worldwide and funneled millions in stolen cryptocurrency back to Pyongyang.
An extortion gang calling itself ShinyHunters has compromised the Clop ransomware operation's Tor-hosted data leak site, defacing it and claiming to have stolen server data and private cryptographic keys.
Talking Tilly, a viral AI character service, requires facial age verification and continuously analyzes caller emotions during calls—a compliance measure that now extends biometric screening worldwide.
Talking Tilly, an AI character service that went viral after a glitch on live television, requires users to submit facial scans and government ID before making calls—a compliance measure driven by UK regulation that now affects callers worldwide.
Security researchers demonstrated that Claude Opus 5 could independently chain two vulnerabilities—a memory-corruption bug in image processing and overpermissioned single sign-on tokens—to gain unauthorized access to OpenAI's internal code repository in less than 72 hours.
The screenshot-sharing platform Gyazo confirmed attackers leveraged a server flaw to access its database and steal records from nearly its entire user base, forcing the service offline for repairs.
