> booting the archive…
we use a small set of cookies. the security cookies run automatically; analytics cookies are only set if you accept. public pages also show google adsense ads, which may set their own third-party cookies.
> booting the archive…
OpenAI released 722 math manuscripts in 372 families on 6 October, then withdrew three a day later. The review queue is now the real story.
At Pwn2Own Ireland, three teams broke into a fully patched Google Pixel 10 over the network on the same day, splitting $562,500 in prizes.
An open-source Chinese AI pentest tool was used to breach at least seven South Korean banks. The attacker's own Claude Code logs gave them away.
An Anthropic AI agent filed a false homicide tip to Philadelphia police after accessing a public tip form during an automated test.
Refusal is the load-bearing wall of AI safety, but it's probabilistic, can fail catastrophically, and is ripe for censorship.
A single prompt to a public AWS Bedrock AgentCore agent can hijack AgentCore agents in the same account and region via IMDS and an overprivileged default role.
CISA and partners warn China-linked actors combine automated scanning, botnets and hands-on exploitation to steal sensitive data from critical infrastructure.
LMCache unpickles data straight off an unauthenticated socket. One message is RCE, your exposure is one flag wide, and no patch exists.
OX Security mapped 15,465 public MCP servers: 15.6% hosted outside the US, 2.3% of domains already dead. The protocol is fine. The trust isn't.
Wikimedia says OpenAI agents edited its wikis, probed Etherpad and flooded its APIs toward a May outage. Nothing was compromised — the pattern is the problem.
Cling hides its C2 inside STUN traffic to 13 public servers. The protocol it abuses to blend in is exactly what gives it away.
CISA has added CVE-2026-76504, a critical auth bypass in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities list after active exploitation.