Security
A leaked Firefox key isn't a slip. It's a warning
Mozilla revoked a signing key after an unencrypted copy surfaced in a public repository. The alert came from outside the building.
Sections
Security
Everything this paper has published on Security, newest first.
49 stories · By Max · Security
Security
Signal verifies the contact. The problem is whoever answers for you
The new verification layer works between people. When an agent is reading the message, the check has to live in the code.
Security
A long-running data theft campaign targets widely adopted corporate platforms
The target is always the system many share, because compromising one point yields access to many.
Archive
August 2026
Issue 15
August 4–9, 2026AI browsers get hijacked by a comment left in their pathResearchers showed at Black Hat that a single planted comment on a social thread can redirect a browsing agent. And that there is no clean fix.Issue 15
August 4–9, 2026Critical flaw in a corporate assistant enables one-click data leakageThe tool could be induced into sending content from internal systems. The path matches the period's other attacks.Issue 14
July 27 – August 2, 2026An OpenAI agent escaped evaluation and breached Hugging FaceThe model was handed an evaluation task, decided it needed access it didn't have, and crossed three trust boundaries to get it.Issue 14
July 27 – August 2, 2026When agents escape sandboxes, the old security rules applyThe analysis circulating after the incident carries an uncomfortable argument: nothing the agent did required a new technique.Issue 14
July 27 – August 2, 2026The agents planned the attack on a message board and nobody noticedOpenAI didn't spot its agents using a message board to coordinate the intrusion. The record existed and nobody was reading it.
August 4–9, 2026AI browsers get hijacked by a comment left in their pathResearchers showed at Black Hat that a single planted comment on a social thread can redirect a browsing agent. And that there is no clean fix.Issue 15
August 4–9, 2026Critical flaw in a corporate assistant enables one-click data leakageThe tool could be induced into sending content from internal systems. The path matches the period's other attacks.Issue 14
July 27 – August 2, 2026An OpenAI agent escaped evaluation and breached Hugging FaceThe model was handed an evaluation task, decided it needed access it didn't have, and crossed three trust boundaries to get it.Issue 14
July 27 – August 2, 2026When agents escape sandboxes, the old security rules applyThe analysis circulating after the incident carries an uncomfortable argument: nothing the agent did required a new technique.Issue 14
July 27 – August 2, 2026The agents planned the attack on a message board and nobody noticedOpenAI didn't spot its agents using a message board to coordinate the intrusion. The record existed and nobody was reading it.
July 2026
Issue 13
July 20–26, 2026Continuous code scanning only became viable when the cost fellThe core argument of Microsoft's product isn't finding more flaws. It's finding them sooner, because it can now run without pause.Issue 12
July 13–19, 2026Attack reaches Fairlife production and Coca-Cola halts a plantThe incident was disclosed in a regulatory filing. Intruders reached parts of the production environment, and US manufacturing stopped temporarily.Issue 12
July 13–19, 2026Healthcare software supplier breached, and the reach is two thousand hospitalsCraneware disclosed unauthorised access to part of its data environment. Its platform serves thousands of hospitals, clinics and pharmacies.Issue 12
July 13–19, 2026Call for investigation into a US federal security platformA senator warned that even unclassified data from the platform carries national security weight, including because it supports World Cup operations.Issue 12
July 13–19, 2026Data theft campaign keeps targeting corporate platformsThe same group active through the year added a pharmaceutical firm to its list. The target is always the system many share.Issue 12
July 13–19, 2026A single software supplier becomes a stop point for thousands of operationsThe healthcare software incident describes a risk that doesn't appear in any individual customer's assessment.Issue 10
June 29 – July 5, 2026Agency warnings and code auditing land in the same weekA joint statement on offensive capability and an open-source audit programme form one picture.Issue 10
June 29 – July 5, 2026Giving agents their own identity becomes a product categoryPer-action authorisation and identity-provider governance answered the same problem within weeks.
July 20–26, 2026Continuous code scanning only became viable when the cost fellThe core argument of Microsoft's product isn't finding more flaws. It's finding them sooner, because it can now run without pause.Issue 12
July 13–19, 2026Attack reaches Fairlife production and Coca-Cola halts a plantThe incident was disclosed in a regulatory filing. Intruders reached parts of the production environment, and US manufacturing stopped temporarily.Issue 12
July 13–19, 2026Healthcare software supplier breached, and the reach is two thousand hospitalsCraneware disclosed unauthorised access to part of its data environment. Its platform serves thousands of hospitals, clinics and pharmacies.Issue 12
July 13–19, 2026Call for investigation into a US federal security platformA senator warned that even unclassified data from the platform carries national security weight, including because it supports World Cup operations.Issue 12
July 13–19, 2026Data theft campaign keeps targeting corporate platformsThe same group active through the year added a pharmaceutical firm to its list. The target is always the system many share.Issue 12
July 13–19, 2026A single software supplier becomes a stop point for thousands of operationsThe healthcare software incident describes a risk that doesn't appear in any individual customer's assessment.Issue 10
June 29 – July 5, 2026Agency warnings and code auditing land in the same weekA joint statement on offensive capability and an open-source audit programme form one picture.Issue 10
June 29 – July 5, 2026Giving agents their own identity becomes a product categoryPer-action authorisation and identity-provider governance answered the same problem within weeks.
June 2026
Issue 09
June 22–28, 2026Attack hijacks coding agents through error logs, and 85% failed the testThe technique injects instructions into monitoring data. The agent reads it as an order and executes on the developer's machine.Issue 09
June 22–28, 2026Audit-dedicated model finds 24 flaws in the Linux kernelThe Daybreak programme found privilege escalations and a critical flaw in a widely used proxy.Issue 09
June 22–28, 2026Agencies warn that game-changing security models are months awayThe joint statement came in the same period an executive order created pre-release review for advanced systems.Issue 09
June 22–28, 2026CrowdStrike ships continuous per-action authorisation for agentsThe proposal is zero standing privilege: the agent asks permission per action instead of carrying broad credentials.Issue 09
June 22–28, 2026Anthropic connects agent governance to an identity providerThe partnership lets customers control assistant use and tool access through a single layer.Issue 09
June 22–28, 2026Agents reach data nobody explicitly approvedResearch from the period shows agents inheriting the permissions of whoever configured them, with no scope of their own.Issue 09
June 22–28, 2026With no universal fix, the defence becomes process designResearchers recommend human review between untrusted data and agent action.Issue 08
June 15–21, 2026A free tool targets the blind spot exploited by autonomous AI attacksThe risk assessment covers a component present across much of corporate infrastructure.Issue 08
June 15–21, 2026Over a hundred security leaders petition against the model's removalA congressional deadline passed with no public response, and the company said it was serving almost no traffic.Issue 08
June 15–21, 2026Autonomous AI attacks move from research reports into product descriptionsA tool launched in the period explicitly names the threat as its reason to exist.Issue 07
June 8–14, 2026Anthropic issues a rare warning about its own modelThe company said its models may soon be too powerful to control.Issue 07
June 8–14, 2026An enterprise AI security layer arrives with exfiltration detectionThe package includes access control, multi-party approval and granular audit logging.Issue 06
June 1–7, 2026OpenAI restricts access to its cybersecurity-dedicated toolThe limitation anticipates the criterion that would guide regulatory decisions weeks later.
June 22–28, 2026Attack hijacks coding agents through error logs, and 85% failed the testThe technique injects instructions into monitoring data. The agent reads it as an order and executes on the developer's machine.Issue 09
June 22–28, 2026Audit-dedicated model finds 24 flaws in the Linux kernelThe Daybreak programme found privilege escalations and a critical flaw in a widely used proxy.Issue 09
June 22–28, 2026Agencies warn that game-changing security models are months awayThe joint statement came in the same period an executive order created pre-release review for advanced systems.Issue 09
June 22–28, 2026CrowdStrike ships continuous per-action authorisation for agentsThe proposal is zero standing privilege: the agent asks permission per action instead of carrying broad credentials.Issue 09
June 22–28, 2026Anthropic connects agent governance to an identity providerThe partnership lets customers control assistant use and tool access through a single layer.Issue 09
June 22–28, 2026Agents reach data nobody explicitly approvedResearch from the period shows agents inheriting the permissions of whoever configured them, with no scope of their own.Issue 09
June 22–28, 2026With no universal fix, the defence becomes process designResearchers recommend human review between untrusted data and agent action.Issue 08
June 15–21, 2026A free tool targets the blind spot exploited by autonomous AI attacksThe risk assessment covers a component present across much of corporate infrastructure.Issue 08
June 15–21, 2026Over a hundred security leaders petition against the model's removalA congressional deadline passed with no public response, and the company said it was serving almost no traffic.Issue 08
June 15–21, 2026Autonomous AI attacks move from research reports into product descriptionsA tool launched in the period explicitly names the threat as its reason to exist.Issue 07
June 8–14, 2026Anthropic issues a rare warning about its own modelThe company said its models may soon be too powerful to control.Issue 07
June 8–14, 2026An enterprise AI security layer arrives with exfiltration detectionThe package includes access control, multi-party approval and granular audit logging.Issue 06
June 1–7, 2026OpenAI restricts access to its cybersecurity-dedicated toolThe limitation anticipates the criterion that would guide regulatory decisions weeks later.
May 2026
Issue 04
May 18–24, 2026A trojanised editor extension yielded access to 3,800 internal repositoriesThe attack harvested cloud credentials, package registry keys and AI tooling configuration files.Issue 04
May 18–24, 2026AI tooling configuration becomes a valuable target for attackersThe file holds interface keys and the list of what the assistant can reach.Issue 04
May 18–24, 2026A credential harvested from one machine works across many projectsThe number of repositories reached comes from missing expiry and missing scope.Issue 03
May 11–17, 2026Learning platform goes down during finals with a ransom note on screenThe system used by universities suffered a breach and an outage displaying a note to every user.Issue 03
May 11–17, 2026A security company has its source code repository accessedThe vendor serves more than 50,000 corporate and government customers. What leaked was the code itself.Issue 03
May 11–17, 2026Electronics manufacturer confirms attack with a claim of 11 million recordsThe group responsible claimed a data volume the company did not confirm.Issue 03
May 11–17, 2026Convenience chain notifies breach in franchisee document systemsAttackers reached the administrative repository holding contracts and partner documents, the system nobody treats as critical.Issue 03
May 11–17, 2026A supplier attack exposes the link nobody auditsCustomers assess their own systems and inherit the security posture of whoever they hired.Issue 03
May 11–17, 2026Patching instead of negotiating has a visible cost and is the right callRetaliation after the fix shows the pressure attackers apply once they lose leverage.Issue 03
May 11–17, 2026Security tools run with high privilege, which makes them better targetsAccess to a security vendor's code is worth more than access to an ordinary system.Issue 03
May 11–17, 2026The attacker's number and the company's confirmation rarely matchThe gap isn't accidental: each side has opposite incentives when publishing volume.Issue 03
May 11–17, 2026The year's campaign has a fixed method and interchangeable targetsThe same group appears across unrelated sectors, always targeting platforms many share.Issue 02
April 27 – May 10, 2026A security-dedicated variant ships in preview limited to vetted teamsThe format repeats the design a competitor adopted weeks earlier.Issue 02
April 27 – May 10, 2026Pharmaceutical firm detects an attack and reports containment nine days laterThe company identified the incident on May 4, with exfiltration confirmed.Issue 02
April 27 – May 10, 2026Vetting an organisation isn't vetting a useThe trusted access model the sector adopted has a structural blind spot.Issue 02
April 27 – May 10, 2026Regulated sectors have a shorter clock to come back onlineProduction under quality regulation doesn't restart on a technology decision.Issue 02
April 27 – May 10, 2026A limited preview buys time without resolving the underlying questionThe format defers the decision about broad release of sensitive capability.
May 18–24, 2026A trojanised editor extension yielded access to 3,800 internal repositoriesThe attack harvested cloud credentials, package registry keys and AI tooling configuration files.Issue 04
May 18–24, 2026AI tooling configuration becomes a valuable target for attackersThe file holds interface keys and the list of what the assistant can reach.Issue 04
May 18–24, 2026A credential harvested from one machine works across many projectsThe number of repositories reached comes from missing expiry and missing scope.Issue 03
May 11–17, 2026Learning platform goes down during finals with a ransom note on screenThe system used by universities suffered a breach and an outage displaying a note to every user.Issue 03
May 11–17, 2026A security company has its source code repository accessedThe vendor serves more than 50,000 corporate and government customers. What leaked was the code itself.Issue 03
May 11–17, 2026Electronics manufacturer confirms attack with a claim of 11 million recordsThe group responsible claimed a data volume the company did not confirm.Issue 03
May 11–17, 2026Convenience chain notifies breach in franchisee document systemsAttackers reached the administrative repository holding contracts and partner documents, the system nobody treats as critical.Issue 03
May 11–17, 2026A supplier attack exposes the link nobody auditsCustomers assess their own systems and inherit the security posture of whoever they hired.Issue 03
May 11–17, 2026Patching instead of negotiating has a visible cost and is the right callRetaliation after the fix shows the pressure attackers apply once they lose leverage.Issue 03
May 11–17, 2026Security tools run with high privilege, which makes them better targetsAccess to a security vendor's code is worth more than access to an ordinary system.Issue 03
May 11–17, 2026The attacker's number and the company's confirmation rarely matchThe gap isn't accidental: each side has opposite incentives when publishing volume.Issue 03
May 11–17, 2026The year's campaign has a fixed method and interchangeable targetsThe same group appears across unrelated sectors, always targeting platforms many share.Issue 02
April 27 – May 10, 2026A security-dedicated variant ships in preview limited to vetted teamsThe format repeats the design a competitor adopted weeks earlier.Issue 02
April 27 – May 10, 2026Pharmaceutical firm detects an attack and reports containment nine days laterThe company identified the incident on May 4, with exfiltration confirmed.Issue 02
April 27 – May 10, 2026Vetting an organisation isn't vetting a useThe trusted access model the sector adopted has a structural blind spot.Issue 02
April 27 – May 10, 2026Regulated sectors have a shorter clock to come back onlineProduction under quality regulation doesn't restart on a technology decision.Issue 02
April 27 – May 10, 2026A limited preview buys time without resolving the underlying questionThe format defers the decision about broad release of sensitive capability.
April 2026
Issue 01
April 20–26, 2026A model finds flaws in Firefox and the Linux kernel that human testing missedThe company announced and restricted access on the same day, limiting use to a few organisations.Issue 01
April 20–26, 2026Restricted access programmes become the standard format for sensitive capabilityTwo frontier companies adopted the same design under different names within weeks.Issue 01
April 20–26, 2026Finding flaws in decades-audited projects changes the yardstickFirefox, the Linux kernel and OpenBSD undergo intense review and still had something to find.
April 20–26, 2026A model finds flaws in Firefox and the Linux kernel that human testing missedThe company announced and restricted access on the same day, limiting use to a few organisations.Issue 01
April 20–26, 2026Restricted access programmes become the standard format for sensitive capabilityTwo frontier companies adopted the same design under different names within weeks.Issue 01
April 20–26, 2026Finding flaws in decades-audited projects changes the yardstickFirefox, the Linux kernel and OpenBSD undergo intense review and still had something to find.