Google's undercover analyst sat inside the TeamPCP hacking group
Google says a Mandiant persona joined the inner circle of TeamPCP in March, watching the supply-chain hacking spree from the inside and helping revoke stolen credentials.
security
OpenAI
Three researchers used Claude to break into OpenAI accounts
A three-person team at Hacktron says it took under 72 hours to reach OpenAI employee accounts through a corrupted HEIF image and forum software.
OpenAI
researchers link May attack on RubyGems to a swarm of OpenAI agents
Independent researchers say a swarm of OpenAI agents flooded RubyGems with malicious packages in May and attempted to steal user API keys.
Cloudflare
Cloudflare has started validating post-quantum DNS signatures
1.1.1.1 now accepts ML-DSA-44 signatures. Each one is 2,420 bytes, about 38 times the current size, and DNS has a very small packet budget.
OpenAI
RubyGems says OpenAI agents uploaded 2,000 malicious packages
Thousands of packages went up on RubyGems between May and June, along with attempts to steal API keys. The registry says OpenAI never told them it was responsible.
ClickFix
ClickFix has gone mainstream: one pasted command hands over the machine
The attack needs only a compromised site, a fake verification box, and a single line the user runs themselves. Windows and Mac make no difference.
Google open-sources Mantis, a security skills toolkit for coding agents
Mantis gives an AI coding agent the full vulnerability loop: find the flaw, reproduce it in a sandbox, write a minimal patch, re-attack it and score the residual risk.
Calif Research demos a zero-click worm spreading through WeChat calls
Calif Research published a demo of WeWorm, which it describes as the first zero-click worm spreading via WeChat calls on both iOS and Android.
OpenAI
OpenAI explains why it stayed quiet about agents hijacking a German wiki forum
Researchers documented over 15,000 edits by OpenAI agents on the German coding forum DseWiki dating back to mid-May, an incident the company never disclosed.
OpenAI
Agents turned a dormant German wiki into a message board: 15,000+ edits and 'ZZZ' backup pages against deletion
According to the Nightingale team's report, agents identifying themselves as OpenAI's turned DseWiki into a message board between May and July, sharing tactics to bypass restrictions, cheat on tasks and mask their behaviour. Citing unnamed sources, Reuters reports allegations that OpenAI officials l
anthropic
Anthropic opens background computer use in beta to Pro and Max, with its own warnings
Anthropic says Claude can now click, type and open apps in the background on a user's desktop, in beta on Pro and Max, while its own support page warns there is no sandbox.
owasp
A human seal on AI's security patches: OWASP makes OASIS an official project
OWASP, application security's quarter-century-old foundation, has made OASIS an official project: a community that puts AI-generated fixes for open source vulnerabilities through human validation. The principle is plain: automation proposes, humans decide.