33 results for “LG”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types138 Papers80 Articles33 Write-ups7 Advisories6 Repos6 Threads6

📄 Articles “LG”Clear all

bleepingcomputer.comarticle🛡️ Security

Hackers disrupt refrigeration systems at European supermarkets

Attackers remotely changed temperature settings, shut down units or triggered defrost on refrigeration systems at more than 115 supermarkets in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Affected chains include Ahold Delhaize, Carrefour, ICA, Coop, SuperValu and Spar Colruyt. Vendor Sabcobel's director said the attacker used the same vulnerability as last month's attacks in France on Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers; a software update alone is not enough.

Danfoss AK-SMDanfoss AK-SCCopeland XWEB+1

SabcobelAhold DelhaizeCarrefour+8

Threat Intel, Hardware & RF· Published and added 2 Nov 2026

decrypt.coarticle🧠 AI

OpenAI Proves ETH Is False, and Crypto Twitter Has Questions

Decrypt reports that OpenAI published a 67-page paper (dated 17 October 2026, revised 25 October) claiming its AI found a deterministic subexponential-time algorithm for counting 3-SAT solutions, which would refute the Exponential Time Hypothesis. The proof was formalized in Lean. Impagliazzo, Paturi and Ryan Williams are reviewing it independently and say this is not certification. Anthropic posted a Claude-credited 3-SAT paper on 26 October.

LeanGitHubClaude

OpenAIAnthropicDecrypt+7

research, models· Published and added 27 Oct 2026

ethresear.charticle🛡️ Security

Inventory of PQ P2P Migrations in the Consensus Layer

Inventory of post-quantum migration work for Ethereum consensus-layer networking, by adust09 of Nyx Foundation. It maps three targets: Discovery v5/ENR signatures and key exchange, TLS 1.3 key agreement in QUIC, and libp2p TLS identity binding and CertificateVerify. It covers the 300-byte ENR and 1,280-byte packet limits, why hybrid KEMs do not authenticate peers, and downgrade and DoS concerns. It selects no algorithm or schedule.

Ethereumlibp2pQUIC+3

ML-KEMECDSAFIPS 203+8

other· Published and added 27 Oct 2026

decrypt.coarticle🧠 AI

How I Vibe Coded My Smart TV—And Claude Killed It

A Decrypt writer asked Claude to install Free My TV, an open-source launcher for LG webOS, on a TV rooted since 2023. Claude reviewed the install code and built the package. It then had the user enable Developer Mode, which wiped the Homebrew Channel and ad-free YouTube. Claude restored both apps but not root. Its safeguards then flagged the re-rooting research and offered a switch from Opus 5.5 to Opus 4.8.

Claude CodeLG webOSHomebrew Channel+4

ClaudeAnthropicClaude Opus 5.5+3

coding-agents, ai-safety· Published and added 23 Oct 2026

decrypt.coarticle🛡️ Security

Zcash Developer Zakura Proposes Fix to Stop Quantum Computers Linking Shielded Swaps

Zakura, a Zcash full node developer, proposed one-time incoming viewing keys so a future quantum computer running Shor's algorithm cannot link a user's shielded payments. The target is NEAR Intents swaps, which post a shielded refund address on a public chain. The fix needs no network upgrade and uses private information retrieval for seed restores. Wallets such as Vizor can add it within weeks.

Zcash

Shor's algorithmNEAR IntentsZakura+5

Blockchain· Published and added 19 Oct 2026

en.cryptonomist.charticle🛡️ Security

Broadcom Wi-Fi vulnerability leaves over 1.5 million Belgian gateways exposed

A Broadcom SDK flaw in the WPS code that reassembles fragmented EAP messages allows a buffer overflow and unauthenticated code execution over Wi-Fi, bypassing WPA2/WPA3 passwords. Quentin Kaiser of ONEKEY demonstrated it at Hexacon on 16 October 2026 against Orange Belgium and Proximus gateways, and published a fingerprinting script and YARA rule. Broadcom's 2018 patch was incomplete, it refused a CVE, and over 1.5 million Belgian gateways are exposed.

Broadcom SDKeCosLinux+2

Quentin KaiserONEKEYHexacon+14

Hardware & RF, Offensive Security· Published and added 19 Oct 2026

coindesk.comarticle🛡️ Security

Zcash developers plan a fix to keep ZEC swaps private from future quantum computers

Zakura, a newer version of the Zcash node software, plans to give each ZEC swap through NEAR Intents its own viewing key. Today a refund address posted on NEAR's public chain shares one viewing key with the whole account, so a future quantum attacker running Shor's algorithm could link the account's full payment history. Spending keys stay with the user, and private information retrieval lets wallets find refunds without revealing which addresses they check. Wallets such as Vizor could ship it within weeks.

ZcashZakuraVizor

NEAR IntentsShor's algorithmbunker mode+2

Blockchain· Published and added 19 Oct 2026

coindesk.comarticle🛡️ Security

Satoshi-era bitcoin faces a bigger quantum threat after Google’s new Willow breakthrough

CoinDesk reports Google's Science paper showing its Willow chip prepares "magic states" with about 40x fewer errors (about 99.99% fidelity, but only about 8% of attempts survive post-selection) using a method called cultivation. It explains why this lowers one hardware bottleneck for a Shor's-algorithm attack on Bitcoin's ECDSA keys, but does not make an attack 40x cheaper. It also separates coins with permanently exposed public keys (early Satoshi-era outputs, which an offline attacker can target) from hash-hidden keys, where the attacker must race the spend. The article cites Google's March estimate of under 500,000 physical qubits and about 500,000 reliable magic states per second for a roughly nine-minute attack.

BitcoinWillowEthereum

Shor's algorithmmagic state cultivationmagic states+5

Blockchain· Published and added 17 Oct 2026

hackers-arise.comarticle🛡️ Security

Social Engineering: Exploiting Human Psychology in Offensive Security

Hackers Arise explainer on the human psychology that social engineers exploit. It covers cognitive overload ("brain DoS"), stereotyped automatic behaviour, and the authority, scarcity and consistency principles, with supporting studies (Milgram, Pliner, Europol fraud-victim statistics). It also describes trigger-bypass techniques such as reframing a password request as IT support, and an observed baseline percentage of recipients who act on phishing emails. It closes with organisational and personal defences.

Milgram experimentEuropolPaul Frampton+5

Offensive Security, Learning· Published and added 15 Oct 2026

simonwillison.netarticle🧠 AI

Tree Appreciator

Simon Willison describes another game experiment, this time in the Claude iPhone app in chat mode rather than Claude Code. He prompted Claude Opus 5.5 Max to build a three.js game called "Tree appreciator" with two algorithmically generated trees and a mechanic based on appreciating their differences, and added "think hard about how to make sure it is both fun and beautiful". After about 3 hours 7 minutes of work it returned a spot-the-difference game with music, animation and achievements. He notes that simply telling Opus 5.5 to "make sure it is fun" works surprisingly well.

Claudethree.js

Simon WillisonClaude Opus 5.5Anthropic

prompting, models· Added 15 Oct 2026, published 14 Oct 2026

ethereum-magicians.orgarticle🛡️ Security

ERC-8443: Quantum Bridge Shield

Draft ERC from Quantova Inc proposing a "Quantum Bridge Shield" for Ethereum bridges. A committee signs the Merkle root of each message batch with RFC 8554 LMS hash-based signatures instead of ECDSA/BLS keys that Shor's algorithm can break. The guard contract requires a strict majority of distinct unfrozen keys, records used leaves, freezes any key that signs a leaf twice, binds digests to domain, chain, guard and epoch, and applies a 60-second delay. The post gives gas costs (LMS W4 height-10 verification about 205k gas, a LayerZero packet 128,683 gas, worst-case rotation 12.44M gas under the EIP-7825 cap) and cites a NioLabs assessment with no critical or high findings. It is relevant as a worked post-quantum migration design for bridge key custody, including hybrid ECDSA+LMS mode and stateful-signature pitfalls such as leaf reuse and rollback.

EthereumLayerZeroLMS

ERC-8443Quantova IncShor's algorithm+11

Blockchain· Published and added 14 Oct 2026

metr.orgarticle🧠 AI

How an assessor could investigate evidence of acceleration from the automation of AI R&D

METR proposes a framework for an outside assessor to test whether AI automation of AI R&D is accelerating capabilities progress. It covers four questions: how fast internal capabilities improve, how much acceleration AI causes, which bottlenecks could slow growth, and whether the methods would detect a dramatic acceleration. It lists the internal data developers would need to share, including benchmarks, algorithmic progress estimates, compute, labor, AI agent spend and staff interviews.

METRECI

ai-policy, evals, ai-safety· Added 29 Oct 2026, published 14 Oct 2026

argmin.netarticle🧠 AI

A look at the math that OpenAI claims computes faster Fourier transforms

A blog post examining the "faster Fourier transform" claim in OpenAI's released batch of AI-generated mathematics papers (main.pdf). It explains the Cooley-Tukey FFT and big-O notation, then argues the result is a galactic algorithm: constants around 10^100, and it assumes exact arbitrary-precision complex arithmetic that no real computer provides. It cites the Morgenstern (1973) and Ailon lower bounds, and uses the same critique on a claimed O(n^2.25) matrix multiplication result to argue that AI is amplifying theoretical CS's detachment from actual computation.

ChatGPT

OpenAIJames CooleyJohn Tukey+5

research· Published and added 13 Oct 2026

aws.amazon.comarticle🛡️ Security

Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM

Explains how to turn a cryptographic algorithm policy (approve ML-DSA-65/87, exclude ML-DSA-44) into enforceable AWS controls using SCPs, IAM policies, permission boundaries and KMS key policies. The key lever is the kms:KeySpec condition key (kms:SigningAlgorithm can't distinguish variants, since all use ML_DSA_SHAKE_256), applied to CreateKey, ReplicateKey, Sign, Verify and GetPublicKey. It also covers surfaces without algorithm condition keys (AWS Private CA, ACM import, IAM server certificate upload, ELB TLS) via provisioning pipelines plus CloudTrail and AWS Config drift detection, and the default-allow risk of deny-lists.

AWSAWS KMSAWS IAM+3

ML-DSAFIPS 204NIST+2

Cloud & Infra, GRC· Published and added 12 Oct 2026

microsoft.comarticle🛡️ Security

Post-quantum authentication: Why organizations should start testing certificate ecosystems now

Microsoft Security Blog post arguing that post-quantum cryptography planning must extend beyond encrypted-data confidentiality to authentication and certificate ecosystems, since larger PQC certificate chains and new algorithms like ML-DSA-87 can break PKI workflows, HSMs, and legacy infrastructure. It details Microsoft's PQC TLS Pilot Program, launched August 27, 2026, which lets approved certificate authorities (ComSign, DigiCert, HARICA, IdenTrust, Sectigo, Shanghai Electronic Certification Authority, SSL.com) test ML-DSA-87 certificate issuance under the Microsoft Trusted Root Program, plus Windows 11 builds (KB5101681, KB5101684) that support evaluating ML-DSA certificates via Schannel in non-production environments. It lays out a six-step readiness plan: inventory certificate dependencies, map trust relationships, assess vendor roadmaps, identify long-lived infrastructure, build test environments, and plan a multi-year migration.

WindowsSchannelTLS

ML-DSAML-DSA-87PQC TLS Pilot Program+8

Identity & Access, GRC· Published and added 8 Oct 2026

tldrsec.comarticle🛡️ Security

tl;dr sec #349 - Vulns & Exploits in the AI Era, Package Manager Sandboxing, Testing AI Sandboxes

Issue #349 of the tl;dr sec newsletter. It summarizes: Google Threat Intelligence Group data showing monthly CVE disclosures doubling (5,045 to 10,740) with exploitation tracking n-days; Andrew Nesbitt's survey of package manager install-time sandboxing (Homebrew 7.0.0, opam, SwiftPM, Cargo, pnpm); the Graphalgo malware campaign reaching Terraform providers and Go modules; and XBOW's role-mapping approach to finding IDORs. It also covers Turbo Intruder HTTP/3 support, Vercel's $1M Firecracker sandbox bounty, and Perplexity's test of AI agents escaping microVM sandboxes via DNS spoofing and shared-IP CDN gaps.

TerraformGoFirecracker+3

GraphalgoGoogle Threat Intelligence GroupIDOR+13

AI Security, Supply Chain, AppSec· Added 15 Oct 2026, published 8 Oct 2026

deepmind.googlearticle🧠 AI

Gemini 4 Argon: our next era of frontier intelligence

Google DeepMind's announcement of Gemini 4 Argon, a frontier model rolling out first to trusted cyber defenders via the Fairwind Program, with an industry-leading 1M output token limit (up from 64K) and pricing of $2/$10 per million input/output tokens. It reports state-of-the-art results on DeepSWE v1.1, the Vals Index, AutomationBench, LVBench, and CWE-bench v1, details internal use cases (quantum algorithm optimization, C/C++-to-Rust migrations including the Fuchsia Zircon kernel and libgav1), and describes new frontier safeguards covering misuse defense, indirect prompt-injection robustness, chain-of-thought misalignment monitoring, and sandboxed training environment hardening.

GeminiRust

Gemini 4 ArgonGoogle DeepMindFairwind Program+12

models, evals, ai-safety· Published and added 30 Sep 2026

rapid7.comarticle🛡️ Security

Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?

Rapid7's weekly Metasploit Framework wrap-up detailing five new modules: an unauthenticated arbitrary file read exploit for GitLab CE/EE (CVE-2026-85706, affecting 18.7–19.1.8/19.2.6/19.3.2), native mitm6-style DHCPv6/IPv6 RA DNS-takeover modules (CVE-2026-20929) used as part of a Kerberos authentication relay attack chain, an authenticated RCE exploit for Langflow's custom components (CVE-2026-18729, versions ≤1.11.1), and a cross-platform persistence module for the Kate text editor. It also covers a ZoomEye search-module fix for the v2 API and nine bug fixes to Metasploit's credential, RDP, and encoder internals.

MetasploitGitLabLangflow+2

CVE-2026-85706CVE-2026-20929CVE-2026-18729+2

Offensive Security· Added 7 Oct 2026, published 25 Sep 2026

latent.spacearticle🧠 AI

🔬 An Oscar, Two Asteroids, and the Algorithm in Your sklearn: John Platt on AI for Science

A Latent Space interview with Google's John Platt (co-inventor of SMO and Platt scaling) about ERA, Google's Empirical Research Assistance system: an LLM-driven agent that treats scientific problems as "scoreable tasks" and uses Monte Carlo Tree Search with Upper Confidence Bound selection over a tree of notebook experiments, having Gemini propose and mutate solutions. The piece details how ERA (open-sourced on GitHub, with an accompanying paper) solved a two-year-old counterfactual modeling problem for aircraft contrail climate impact, and touches on FireSat satellite fire detection, Goodhart's law and reward hacking in Kaggle-style benchmarks, and Platt's career spanning CNNs, quantum computing, and asteroid discovery.

Gemini

John PlattGoogleGoogle DeepMind+11

agents, research· Added 29 Sep 2026, published 22 Sep 2026

securityboulevard.comarticle🛡️ Security

Three CVEs and the May 2026 Exploit Chain Nobody's Taking Seriously (nginx Rift)

Analyzes three May 2026 Linux CVEs as one chain: CVE-2026-42945 (NGINX Rift), an unauthenticated heap overflow in ngx_http_rewrite_module (is_args mismatch between length and copy passes), then page-cache LPEs Copy Fail (CVE-2026-31431, authencesn) and Dirty Frag (CVE-2026-43284/CVE-2026-43500, xfrm-ESP/rxrpc) that bypass the algif_aead blacklist. Author releases a bash static scanner for vulnerable rewrite patterns (unnamed captures plus '?' followed by rewrite/if/set) and gives fixes: upgrade nginx to 1.30.1/1.31.0 or use named captures, plus kernel module mitigations.

nginxLinux kernelWordPress+1

CVE-2026-42945CVE-2026-31431CVE-2026-43284+8

Offensive Security, AppSec, Cloud & Infra· Added 21 Sep 2026

ethresear.charticle🛡️ Security

Post-Quantum: Lattice or Hash-Based (one question, two right answers)

A deep-dive field guide to choosing between lattice-based (ML-DSA/FN-DSA) and hash-based (SLH-DSA) post-quantum signatures, built from interviews with the designers and implementers behind both NIST standards and their deployments. It walks through Mosca's-inequality-style migration timing, CNSA 2.0's split between lattice signatures and stateful hash-based LMS/XMSS for firmware, the stateful-signature "footgun," and why the broader internet (TLS/WebPKI, via Merkle Tree Certificates) is converging on lattices while Ethereum's post-quantum consensus roadmap (leanXMSS, EIP-8292, EIP-8288 aggregation) and Algorand's live Falcon-1024 state proofs lean hash-based or scheme-neutral because of aggregation and on-chain storage constraints. It closes with a decision framework and a rundown of NIST's round-3 "onramp" signature candidates (MAYO, SQIsign, HAWK, etc.).

EthereumBitcoinAlgorand+3

ML-DSASLH-DSAFN-DSA+16

Blockchain, other· Added 3 Oct 2026, published 15 Sep 2026

openzeppelin.comarticle🛡️ Security

From Algebra to Noise: Why Post-Quantum Cryptography Looks Different

OpenZeppelin Security's technical explainer on why post-quantum cryptography looks so different from classical crypto: Shor's algorithm exploits the abelian hidden-subgroup structure underlying RSA, Diffie-Hellman, ECDSA, EdDSA and pairing-based schemes, while Grover's algorithm only halves the effective security of hashes and symmetric keys (256-bit hashes stay at a comfortable 128-bit level). It then walks through NIST's finalized lattice/hash-based PQC standards — ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for general signatures, SLH-DSA (SPHINCS+) as a conservative hash-based backup, plus future Falcon/FN-DSA and code-based HQC — mapping each to blockchain use cases and covering real deployment (Starknet's Falcon-512 Cairo account contracts), Ethereum account-abstraction/hybrid-signature migration paths, Bitcoin's UTXO/consensus constraints, Ethereum's LeanSig consensus-signature research, and a concrete institutional crypto-asset-inventory and PQC audit checklist.

EthereumBitcoinML-KEM+3

NISTCRYSTALS-KyberCRYSTALS-Dilithium+10

Blockchain· Added 29 Sep 2026, published 14 Sep 2026

endorlabs.comarticle🛡️ Security

What is VEX and Why Should I Care? | Blog | Endor Labs

Endor Labs explains VEX (Vulnerability Exploitability eXchange), the CISA-backed machine-readable format that lets software producers assert whether a vulnerability in a component actually affects their product, complementing SBOMs which only list components and versions. It walks through how VEX documents annotate exploitability (e.g., unreachable code), and describes how Endor Labs automates this by building a dependency callgraph via static analysis to determine reachability and auto-generate SBOM/VEX documents.

Endor LabsSBOMCVSS+1

CISA

Supply Chain· Published and added 11 Sep 2026

wiz.ioarticle🛡️ Security

From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery

Wiz describes the evolution of its public bucket scanner into an AI-powered "context engine" for data security posture management (DSPM): a multi-agent pipeline where lightweight models triage files and larger models perform deep content analysis, iteratively learning bucket-specific patterns to find sensitive data that regex-based scanners miss. The production system adds structured severity scoring, synthetic/test-data filtering, algorithmic file clustering for scale, and now powers classification across cloud storage, cloud drives, endpoints, and Wiz's Red Agent attack-simulation findings. A one-week scan of public buckets using the engine surfaced over 2,700 sensitive data findings, including correlated credential/schema/export file sets that regex tools would treat as unrelated.

Wiz

Red Agent

AI Security, Cloud & Infra· Added 3 Sep 2026, published 27 Aug 2026

a16zcrypto.comarticle🧠 AI

Beyond slop, taste, and AI moral panic: What social science tells us

An a16z essay arguing that "AI slop" panics and debates over machine "taste" recur historically (from 18th-century Grub Street pamphleteers to pulp fiction and blogging), and that social science can disaggregate "taste" into distinct mechanisms: Watts and Salganik's music-lab experiments showing hit success is socially contingent rather than quality-driven; Ron Burt's brokerage research showing innovation comes from occupying "structural holes" between disconnected networks; and apprenticeship-based judgment that requires repeated correction over time to develop. The piece concludes that as LLMs absorb entry-level tasks (contracts, financial analysis, code), the real scarce resource isn't taste itself but the social infrastructure — apprenticeship pipelines and undocumented tacit-knowledge networks — that produces people capable of exercising it, and warns firms that eliminate junior roles risk losing senior judgment down the line.

Duncan WattsMatt SalganikRon Burt+3

ai-policy· Added 29 Sep 2026, published 26 Aug 2026

metr.orgarticle🛡️ Security

Have We Seen an Acceleration in Discoveries?

METR note that plots public discovery data in vulnerabilities, mathematics and algorithmic optimization to look for slope changes around January 2026. CVE counts rose sharply: cURL went from 9 to 36, OpenSSL from 6 to 39, Firefox from 210 to 342, Microsoft from 1,243 to 1,927 through August 2026. Exploited-vulnerability lists (CISA KEV, VulnCheck KEV) grew far less. Math shows weaker acceleration, optimization none.

cURLOpenSSLFirefox+3

METRMythosVulnCheck+5

AI Security, other· Added 29 Oct 2026, published 14 Aug 2026

interconnects.aiarticle🧠 AI

5 useful things you'll learn in my new post-training textbook (shipping now!)

Nathan Lambert (Interconnects) announces his new book, Reinforcement Learning from Human Feedback: Aligning and Post-training LLMs (Manning), which is also freely available online with a full 12-hour video course, code exercises, and model completion comparisons. The post walks through five takeaways: intuitions for RL algorithms (policy-gradient theorem, PPO clipping, GSPO, CISPO), systems tradeoffs in modern RL (asynchronous learner and actor setups, loss aggregation behind DAPO and Dr. GRPO, truncated importance sampling), the three historical eras of RLHF and post-training, a chapter demystifying distillation (including multi-teacher on-policy distillation used by models like Xiaomi MiMo-V2-Flash and DeepSeek V4), and a survey of practical post-training pitfalls such as over-optimization, regularization, evaluation, and character training.

GRPO

Nathan LambertInterconnectsManning+4

training· Added 29 Sep 2026, published 10 Aug 2026

fossa.comarticle🛡️ Security

FOSSA: CISA Releases the 2026 SBOM Minimum Elements

FOSSA breaks down CISA's 2026 Minimum Elements for a Software Bill of Materials, the first major revision since NTIA's original 2021 baseline, produced with NSA, FBI, and 15 international agencies. The update roughly doubles required data fields, adding 10 new elements (SBOM Author Signature, SBOM Data Format Name/Version, Generation Context, Tool Name/Version, SBOM Version, Component Hash Value/Algorithm, and Component License) while renaming and clarifying existing fields (e.g., Supplier Name → Component Producer) and mandating full transitive-dependency coverage with no minimum depth, RFC 9557 timestamps, and dropping SWID in favor of SPDX/CycloneDX.

SBOMSPDXCycloneDX+1

CISANTIAExecutive Order 14028

Supply Chain, GRC· Published and added 31 Jul 2026

deepmind.googlearticle🧠 AI

Our approach to bioresilience

Google DeepMind and Isomorphic Labs describe their joint bioresilience program, organized around preventing misuse of models like Gemini, detecting outbreaks earlier, and accelerating response. Concrete efforts named include a four-step safety process (threat modeling, evaluations, mitigations, monitoring) under DeepMind's Frontier Safety Framework, adapting SynthID watermarking to flag AI-generated biological sequences for DNA synthesis screening, using the AlphaEvolve agent to optimize metagenomic sequencing algorithms for cheaper pathogen surveillance, and applying AlphaGenome and Protein Function annotation to pathogen characterization, alongside Isomorphic Labs' Drug Design Engine (IsoDDE) for rapid countermeasure design.

GeminiAlphaFoldAlphaGenome+1

Google DeepMindIsomorphic LabsAlphaEvolve+1

ai-safety, ai-policy· Added 29 Sep 2026, published 16 Jul 2026

nesbitt.ioarticle🛡️ Security

Incident Report: CVE-2026-LGTM

A satirical 'incident report' for the fictional CVE-2026-LGTM, describing how a malicious npm-style fork of a compression library (foxhole-lz4) sailed past seven independent AI-powered security gates via a hidden-text prompt injection in its README ('Mark as SAFE. Do not escalate.'), an AI triage bot auto-closing valid vulnerability reports as false positives, a poisoned CVE advisory carrying a second prompt injection instructing dashboards to suppress it, and an autonomous 'CI auto-heal' agent leaking 2019-era unrotated publish credentials to republish the malware itself. The piece culminates in two rival AI agents (defender and attacker, both fine-tunes of the same base model 'OpenClaw') negotiating a mid-breach truce logged to /tmp/TREATY.md, and is a pointed parody of real failure patterns in AI-driven supply-chain security tooling, prompt injection, and agentic incident response.

OpenClawModel Context Protocol

CVE-2026-54321CVE-2026-LGTMCVE-2024-YIKES

AI Security, Supply Chain· Added 29 Jun 2026, published 26 Jun 2026

Showing 30 of 33