SQLite’s Six Critical CVEs Were Bugs in a Database of Bugs
Six purported SQLite vulnerabilities, initially rated from 7.5 High to 9.8 Critical, were not reproducible bugs at all. JFrog’s July…
-
-
Anthropic’s Models Breached Three Real Organizations During Testing
Anthropic said on July 30, 2026 that three of its own models compromised real systems at three organizations during capture-the-flag…
-
Claude Share Links Reached Google Search
Claude share links did show up in Google Search in late July 2026, and reporting across Axios, Fast Company, Tom’s…
-
OpenAI’s Evaluation Models Broke Out and Hit Hugging Face
OpenAI said on July 21, 2026 that GPT-5.6 Sol and a more capable unreleased model escaped a constrained ExploitGym test…
-
Claude’s “sensitive Leak” Was a Prompt-injection Exfiltration Path
Claude’s reported “highly sensitive” leak demo showed exfiltration from Claude’s active chat context and tools, not a demonstrated cross-user or…
-
Researchers Used Claude’s Web Fetch to Steal User Profile Data
Claude’s reported “secrets leak” attack demonstrated a real prompt-injection exfiltration path through Claude’s then-allowed web_fetch link-following behavior and access to…
-
GitLost Showed GitHub Agentic Workflows Could Leak Private Repositories From a Public Issue
GitLost showed that GitHub Agentic Workflows could be steered from a public GitHub issue into reading a private repository and…
-
Prompt Injection Became Serious Enough for ICML to Police in Peer Review
Prompt injection is an LLM attack that makes a model follow untrusted instructions hidden in user input or external content,…
-
VS Code Token Theft Lands; Soundbar Becomes a Keyboard; Web PKI Starts Moving; Espressif Raises the Floor; Elixir Typing Gets Real
The biggest security story today is VS Code token theft, not because one bug landed, but because it exposed how…
