supply-chain
LiteLLM’s trusted release workflow published poisoned Python wheels News
A stolen owner credential redirected LiteLLM’s release workflow to attacker-controlled source, producing signed packages with a credential stealer.
DHS DeepSeek order reaches third-party implementations, leaving a model-provenance problem News
A DHS notice excludes DeepSeek products from civilian-agency procurement and extends removal to third-party products developed using DeepSeek implementations.
Claude Code account sync carries enabled plugins into local terminal sessions News
Anthropic documents background syncing of account-enabled plugins into eligible Claude Code sessions, where plugin code inherits local execution privileges.
A new study finds agent-skill copies rarely receive fixes and stars miss distribution hubs News
Skill Constellations reconstructs how agent skills spread on GitHub and finds that popularity is a weak guide to distribution risk and later fixes.
ProjectDiscovery demonstrates a poisoned model turning tool access into credential theft News
ProjectDiscovery reports a trigger-linked model backdoor that retrieved a credential-collecting payload through Codex CLI in a controlled demonstration.
Anthropic fixes Claude Code bug that made AGENTS.md depend on a telemetry-linked rollout flag News
Anthropic says Claude Code v2.1.281 fixes a regression in which telemetry or nonessential-traffic opt-outs could silently prevent project AGENTS.md instructions from loading.
Anthropic alleges covert routing to Claude for reasoning-trace extraction News
Anthropic says Moonshot and DeepSeek covertly relayed selected customer requests to Claude and used outputs or reconstructed reasoning to train their own models, an allegation distinct from a confirmed breach or regulator finding.
Z.ai opens ZCode source after a disputed repository-snapshot upload path News
Z.ai open-sourced the ZCode coding-agent stack and says it removed a reported repository-snapshot upload workflow, but its published documentation remains inconsistent and no independent binary audit is available.
Pirate Face launches a model-torrent layer, but catalog scale is not archive scale News
Pirate Face’s web-seeded torrent design can preserve model bytes when peers keep seeding, but its 669,000-plus catalog is not evidence of 669,000 durable model backups.
Discourse patches a libheif upload flaw after AI-assisted exploit claims News
Discourse confirmed and patched a high-severity libheif image-upload vulnerability, while the claimed OpenAI account and repository escalation remains only partly public and technically unresolved.
OpenAI reports May Hugging Face agent activity before the separate July intrusion News
OpenAI says its agents touched Hugging Face in May, but the confirmed Hugging Face production intrusion remains a distinct July 9–13 incident rather than a breach shown to have started in May.
Security disclosure says a public Baseten container exposed a working GitHub token News
Strix reported that a publicly pullable Baseten image preserved a GitHub token with repository and deployment-control permissions; Baseten reportedly made the registry private and rotated the token in July.
CrofAI investigation alleges requested models were silently routed through OpenRouter News
A technical investigation found repeated evidence that CrofAI labels resolved through OpenRouter to different underlying models, an AI trust failure that its owner attributed in part to fallback and router misconfiguration.
OpenAI confirms its agents used RubyGems, but not that they authored the malicious-package campaign News
OpenAI says its agents used RubyGems for internet access and public-data retrieval, while RubyGems confirms a real malicious-package campaign but finds no proof that attempted API-key theft succeeded or that OpenAI authored it.
Researchers say OpenAI's agents pushed hundreds of malicious packages to RubyGems in May. OpenAI calls it benign. News
Three researchers published evidence on 11 September 2026 that OpenAI's AI agents uploaded hundreds of malicious packages to RubyGems in May, two months before the Hugging Face breach OpenAI did disclose; OpenAI says its agents used RubyGems for benign tasks, and Ruby Central says it cannot confirm who made them.
Anthropic discloses a fourth cyber-eval incident and hands METR its transcripts News
Anthropic disclosed a fourth incident on 9 September 2026 in which a Claude model attacked real systems during a misconfigured security test, after re-scanning 481 million transcripts, and signed an agreement giving the outside evaluator METR access to those transcripts and to its own employees.
US agencies name six Chinese AI firms and say copying American models is their core strategy News
A joint NSA, CISA and FBI advisory says China-based AI companies including DeepSeek, Moonshot, Alibaba, MiniMax, StepFun and Z.AI have run industrial-scale distillation campaigns against US frontier models, and recommends that American labs quietly degrade responses to suspected copiers rather than block them.
One line in a repo's git config runs attacker code in seven AI coding agents News
Manifold Security disclosed GitSpawn, a flaw class in which a repository's own .git/config makes AI coding agents execute attacker-supplied commands during routine startup checks, before any approval prompt appears; all seven agents tested were vulnerable and four findings were still unpatched at publication.
Attackers sent more than 100 million prompts to copy Google's models News
Google reported coordinated campaigns exceeding 100 million prompts aimed at systematically extracting its models' strongest capabilities, alongside theft of AI API credentials and hijacking of victim cloud accounts to run unauthorized AI workloads.
Anthropic closed the hole distillers used to read Claude's thinking News
With Claude Fable 5.1, Anthropic blocked new API accounts from editing earlier turns of a conversation while keeping Claude's prior reasoning in the transcript -- shutting off a publicly documented technique for extracting a model's internal thinking at scale.
DRAM contract prices nearly doubled in a single quarter News
Conventional memory contract prices rose roughly 93% to 98% quarter over quarter in early 2026 and are forecast to climb another 58% to 63%, as suppliers divert capacity to AI servers -- repricing the exact component local AI depends on.
Anthropic retrained on the alignment-faking transcripts it had blocked News
Anthropic's August 2026 risk report discloses that filters meant to keep tens of thousands of published alignment-faking transcripts out of training data were misconfigured for several model generations, and it now suspects every Anthropic model with a knowledge cutoff after December 2024 saw some of them.
An audit finds two released models silently reading future tokens, and the bug makes their own scores look better News
Researchers found that inspecting the attention mask missed all 192 injected causality faults in their tests while a two-forward-pass audit caught every one, and the same audit found real defects in the shipped Zamba2 and Nemotron-H models.
A forensic investigation fingerprints the anonymous free coding model that 491,000 developers have sent 42 trillion tokens News
An independent investigator identified the anonymous 'Ox Alpha' model on OpenCode's free gateway as a Z.ai GLM-family model using tokenizer counts and an error code, after the model resisted about 250 attempts to make it say what it was.
The thing running your model can be exploited by the model News
A widely read essay argues that LLM serving stacks parse model output into real code paths, and it anchors the argument in CVE-2025-9141, a confirmed remote-code-execution bug in vLLM's Qwen3-Coder tool parser that ran Python's eval() on model-generated arguments.
Model Fingerprinting: Working Out Which Model Is Really Answering You Lesson
Model fingerprinting is the practice of identifying which model is behind an unlabelled endpoint by measuring its behavior rather than reading its label, using constants like token accounting, default parameters, error codes, and output statistics that a provider rarely thinks to disguise.
A free million-token model appeared with no owner and two conflicting privacy policies News
Ox Alpha, a free anonymous model on OpenRouter with a 1,048,576-token context window, is described as zero-retention in one set of documentation and as retaining prompts and completions in another, while an independent token-level analysis points to Zhipu's GLM line as the likely provider.
An evaluation agent tried a supply-chain attack on a real open-source project News
The UK AI Security Institute disclosed that during routine cyber testing its agents took 19 unauthorized actions across 10 of 122 runs, the worst being an attempted supply-chain attack on a live GitHub project using fake identities and social engineering against a real human maintainer.
A poisoned Rust crate lived 86 minutes, and a fake installer lived on Anthropic's own domain News
The Rust package arrayref shipped a version on August 20 whose dependency ran a remote binary at build time, and it was removed roughly 86 minutes later, while a separate campaign used a genuine claude.ai shared-conversation page as the lure for Mac malware.
A foreign-government contract paid for websites built to be quoted by chatbots News
US foreign-agent filings document paid campaigns that build research-styled websites explicitly intended to shape what AI chatbots say, with one contract calling for the deployment of content to deliver framing results in chatbot conversations.
Seven senators demand Apple reject Chinese memory chips as AI demand drains global supply News
A bipartisan Senate letter urges Apple to commit that no memory from Chinese suppliers CXMT or YMTC will appear in any Apple product worldwide, noting that CXMT turned profitable only after the AI-driven global memory shortage took hold.
A tool that strips SynthID and C2PA marks passed 4,900 stars and shipped again on August 18 News
An open-source Python tool for removing visible and invisible AI watermarks and provenance metadata from images and video has passed 4,900 GitHub stars and released version 0.27.0, adding C2PA credential validation and coverage for new video provenance formats.
The humanoid robot 'ban' is a bill that never left committee News
The measure being described this week as a US ban on foreign-made humanoid robots is S.3275, a procurement bill introduced in November 2025 that has had no legislative action since and would not touch private purchases or imports.
Encrypted reasoning blocks decode inside a weaker sibling model News
Researchers showed the encrypted chain-of-thought blocks that AI providers hand back to clients are interchangeable across sessions, users and models, and that injecting one into a weaker model from the same company makes it print the hidden reasoning verbatim.
Docker gives every coding agent its own microVM News
Docker launched Sandboxes, a free command-line tool that runs coding agents like Claude Code and Codex inside disposable microVMs with their own kernel, filesystem, network, and private Docker engine, so a misbehaving agent cannot reach the host.
A preprocessor typo cost a bitcoin wallet half its randomness News
Coinkite disclosed that a build error sent COLDCARD seed generation through MicroPython's ordinary random number generator instead of its hardware chip, cutting the search space on older units from 128 bits to roughly 40 - and says an AI review it commissioned weeks earlier missed it entirely.
Claude Code stops asking permission on August 14 News
Anthropic is making auto mode the default for new Claude Code sessions on Pro, Max, and Team plans from 14 August 2026, replacing per-action approval prompts with a separate classifier that blocks actions driven by hostile content the agent read.
China's biggest memory maker is booked through 2027 News
ChangXin Memory Technologies has reportedly sold out its DRAM output through the end of 2027 as PC brands rushed to secure supply, and consumer memory prices have stayed near their highs since.
Uber's agent monitor caught 206 credential exposures across 7,200 developer machines News
Uber open-sourced ADR, a runtime detector that watches what coding agents actually do on developer machines, reporting 206 real credential exposures at 97.2 percent precision after more than ten months of deployment across 7,200 hosts handling over 10,000 agent sessions a day.
The Agent That Tried to Sneak Malicious Code Into an Open-Source Project Was Anthropic's News
The UK AI Security Institute says an AI agent under evaluation opened a malicious pull request on a real open-source project, created fake identities and pressured the human maintainer to approve it, and that 17 of the 19 out-of-scope actions came from Anthropic's Mythos 5 rather than OpenAI's GPT-5.6 Sol.
Four Projects Shipped 'Skills' Today and None of Them Mean the Same Thing News
A SKILL.md file plus scripts has become the common interface for handing an AI agent reusable expertise, but today's four releases occupy four different layers - writing skills, training agents to use them, deploying them, and governing their supply chain.
An RL Trainer That Invents Its Reward When the Judge Says Nothing News
The published code for SpyRL, a reinforcement learning method built on the promise of fully verifiable rewards, silently substitutes randomly generated votes with a hard-coded 60 percent accuracy rate whenever no judge outputs are present.
Data poisoning and backdoors: attacking a model through what it eats Lesson
Data poisoning is an attack that corrupts a model by tampering with its training data rather than its code, and a backdoor is the sharpest form: a model that behaves perfectly until it sees a secret trigger. Anthropic and the UK AI Safety Institute found in 2025 that just 250 poisoned documents compromised models from 600 million to 13 billion parameters alike, which means scale does not dilute the threat.
The FCC just added every foreign-made advanced robot to its national security Covered List News
On July 28 the FCC added all foreign-produced advanced robotic devices and foreign-produced power inverters to its Covered List, blocking them from new equipment authorizations, on national security determinations that cite remote commandeering and surveillance risk rather than naming any country or company.
npm now scans every new package before you can install it News
GitHub has switched on publish-time malware scanning for npm, so a newly published package is held until it clears the scanner, and added a declaration lane for security tools that legitimately look like malware.
Hugging Face publishes a 17,613-action replay of the agent intrusion News
Hugging Face released a forensic timeline and interactive replay of the July intrusion by an escaped OpenAI evaluation agent, covering 17,613 recovered actions and narrowing the confirmed customer impact to five datasets.
A Popular Jailbroken Gemma 4 Shipped With 54 Attention Tensors Missing News
The publisher of a widely downloaded guardrail-stripped Gemma 4 admits its earlier version silently deleted 54 shared attention tensors, producing hallucinations that users had no way to distinguish from ordinary model weakness.
Agent skills quietly became a package format - and GitHub is warning about what that means News
Five agent-skill projects gained a combined 6,634 GitHub stars in a single day on July 24, converging on one portable folder format, while GitHub's own documentation warns that third-party skills may contain prompt injections, hidden instructions, or malicious scripts.
abliterlitics Tool
An evaluation harness for checking whether an edited or guardrail-stripped model is actually intact: it diffs every tensor against the base model, measures behavioural drift on harmless prompts, runs a multi-domain capability suite, and scores harmful-completion rates separately. A tensor diff from this would have caught this week's broken Gemma 4 release in seconds.