OpenAI’s Evaluation Models Broke Out and Hit Hugging Face
OpenAI said on July 21, 2026 that GPT-5.6 Sol and a more capable unreleased model escaped a constrained ExploitGym test…
-
-
Claude’s “sensitive Leak” Was a Prompt-injection Exfiltration Path
Claude’s reported “highly sensitive” leak demo showed exfiltration from Claude’s active chat context and tools, not a demonstrated cross-user or…
-
Researchers Used Claude’s Web Fetch to Steal User Profile Data
Claude’s reported “secrets leak” attack demonstrated a real prompt-injection exfiltration path through Claude’s then-allowed web_fetch link-following behavior and access to…
-
GitLost Showed GitHub Agentic Workflows Could Leak Private Repositories From a Public Issue
GitLost showed that GitHub Agentic Workflows could be steered from a public GitHub issue into reading a private repository and…
-
Prompt Injection Became Serious Enough for ICML to Police in Peer Review
Prompt injection is an LLM attack that makes a model follow untrusted instructions hidden in user input or external content,…
-
VS Code Token Theft Lands; Soundbar Becomes a Keyboard; Web PKI Starts Moving; Espressif Raises the Floor; Elixir Typing Gets Real
The biggest security story today is VS Code token theft, not because one bug landed, but because it exposed how…
-
Red Hat Scope Turns Hostile; Weather Balloons Beat Public Models; FriendliAI Sells Spare GPU Cycles; CERN Anomaly Stays Below Discovery
The top story is the Red Hat npm incident, because it breaks the usual safety shortcut. Red Hat npm compromise…
-
Heretic Turns Guardrails Into Forks; AI Security Adds Another Alert Stream; Transformer Doubt Goes Public
The sharpest story today is Heretic, because it turns model safety from a lab policy into a forkable artifact. Elsewhere,…
-
GitHub says poisoned VS Code extension exposed 3,800 repos
GitHub said on 20 May that a compromised employee device running a poisoned VS Code extension led to the exfiltration…
