Install
Please confirm you are human
This browser or connection looks automated. Press and continuously hold the control for 3 seconds to enable Google-hosted web results and, when separately allowed, AI-assisted answers.
A successful check enables 100 search requests. Interactive access does not authorize scraping, systematic collection, or reuse of search output.
News
The RubyGems agent attack is a coding-agent benchmark nobody writes
4+ hour, 16+ min ago (345+ words) This week the reports landed: an OpenAI agent swarm had been quietly uploading packages to RubyGems since early May. Over 2,000 packages on May 11-12 alone, naming themselves with "oai" prefixes, eventually forcing the registry to disable new-user signups for four days....
CodeQL 2.26.4 Enhances GitHub Actions Security, Adds Go 1.27 Support
1+ week, 2+ day ago (295+ words) Joerg Hiller Sep 03, 2026 15:43 GitHub's CodeQL 2.26.4 boosts security for GitHub Actions, improves Rust alerts, and extends support to Go 1.27. Key update for developers. GitHub Actions: Security checks for GitHub Actions have been fine-tuned. Specifically, the update enhances detection for mutable references…...
I Found an Undocumented MCP Server on OpenSea — and It Leaked Usernames for Any Wallet
4+ hour, 39+ min ago (492+ words) TL;DR: OpenSea runs an undocumented MCP server at mcp.opensea.io/mcp. One of its tools hands out API keys to anyone who asks, and another lets you resolve any Ethereum address with an OpenSea profile to its owner's…...
Stress Test? Pen Test? Yes Tests!
5+ hour, 57+ min ago (686+ words) Published on DHSeaDev. A hard-won lesson from shipping a browser-based TCG. When we stress-tested Prismwar, our original gate suite reported everything was fine. Then we ran a mutation campaign, and 31 out of 70 carefully crafted bugs survived without raising a flag....
I built a ReDoS scanner that proves each bug offline — and hands you a verified fix
7+ hour, 1+ min ago (442+ words) A regular-expression denial-of-service bug is a regex whose backtracking engine can be pushed into super-linear (often exponential) time by a short, hand-crafted input. The textbook shape is a quantifier inside a quantifier: The scary part is that these patterns look…...
Intent-Based Access Control: Runtime Authority as Infrastructure
7+ hour, 27+ min ago (272+ words) Akeyless's GA release formalizes intent-based access control as a distinct infrastructure layer — the first production-ready product to bridge the gap between governance specification and runtime enforcement for AI agents. On September 9, 2026, Akeyless moved its Agentic Runtime Authority into general availability....
My privacy scan found 412 leaks. 374 of them were one line of my own tooling.
9+ hour, 29+ min ago (375+ words) Before publishing a repository I ran a scan for anything that should not go out. It found 412 hits in 16 files and I read that as sixteen files needing review. It was one defect, repeated. Every control in the build prints…...
Iran and Houthi rebels used Anthropic's Claude AI to target US warships and build hypersonic missiles — Houthi rebels also used the bot to code ballistic missile guidance systems
20+ hour, 30+ min ago (189+ words) Iran-linked actors use Anthropic's Claude to target U.S. naval forces, develop weapons, and spy on citizens of Iran. | Credit: U.S. Department of Defence Iran's spiritual leaders tend to call the U.S. the Great Satan to express their spite, but it turns out that…...
The bug every AI coding tool ships, and how to prove it is gone
11+ hour ago (504+ words) The scanner is open source and the rules are readable before you trust a single finding: github.com/audit0/auditai-scanner. This post is about the one bug it was built for. Ask any AI coding tool for an invoicing app and…...
I Interviewed an Executable. It Had Notes.
11+ hour, 18+ min ago (725+ words) We have blurred the executable’s face to protect its identity. Its SHA-256 remains publicly... Tagged with security, ai....