Search
9 stories found
Researchers found a malicious instruction file that tricked a coding agent into installing an unauthorized npm package — and reproduced it with a 90% success rate. Five settings that close the hole.
A plugin that watches what your agent does, compresses it into searchable memories in a local SQLite database, and feeds the relevant bits back into your next session. How it works and what to watch out for.
DeepSeek's Harness team published an MIT-licensed research prototype that watches a GitHub repo, takes authorized requests and answers with pull requests. It passed 11,000 stars within days — but DeepSeek itself says it is not production-ready and runs with full user access.
Microsoft Threat Intelligence has graded eight North Korean groups on how deeply they use AI. The findings — bulk-generated lures, AI-coded malware, fake recruiters and an open-source agentic attack framework — show where defenders should tighten up now.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
Floorplan, a free MIT-licensed plugin, scans your repo locally and has your coding agent label every part, producing a browsable map with a security health check. It was one of GitHub's top trending repos on November 2.
Three small projects from this week's GitHub trending list that are clever, useful, or both — with what they do, how they work, and the catches.
Carbon tops the Artificial Analysis Intelligence Index and posts big security benchmark numbers. Google is rolling it out to vetted defenders before anyone else. Here's what's in it and what it costs.
Anomaly's open-source Hex lets you hold a key, talk, and have text pasted into any app without sending audio to the cloud. Version 3.0 brings one app to Mac, Windows and Linux, and it was one of GitHub's fastest-climbing repos on November 2.
