Skip to content

3229 results for “age”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types3229Articles1041Papers749Write-ups487Repos457Threads194
Advisories128Tools80Talks48Other23Courses13Videos9
“age”
en.cryptonomist.charticle🧠 AI

Anthropic’s internal use of Claude topped staff costs at list prices by April

Report on Anthropic's IPO prospectus, filed 26 October 2026. It says the value of internal Claude use at customer list prices exceeded monthly personnel costs (excluding equity awards) by April 2026. Internal usage value rose more than 250-fold from January to September 2026, and Claude wrote over 90% of new code. The filing gives no compute cost or dollar figure.

Claude
Anthropic

ai-policy, coding-agents· Published and added 2 Nov 2026

adversa.aiarticle🛡️ Security

Top AI coding agent security resources — November 2026

Adversa AI's November 2026 roundup of 14 AI coding agent security resources from October. It covers CVE-2026-103572 (Visual Studio Copilot and SSMS RCE via trailing-dot filename), an unpatched Claude Code child-session hook bypass, a Copilot CLI cryptographic context injection, and a CVE-less opencode MCP OAuth RCE. It ends with a checklist for auditing agent configs and gateways.

Claude CodeGitHub Copilot CLIOpenCode+3
CVE-2026-103572prompt injectionindirect prompt injection+7

AI Security, Supply Chain· Published and added 2 Nov 2026

ethereum-magicians.orgarticle🛡️ Security

How Arbitrum's freezes send transactions from an address without its key

Analysis of the Arbitrum Security Council's 30 October 2026 freeze of 8,425 ETH and 74,559,805.2 ARB on Arbitrum One, tied to the Binance exploit. In one L1 transaction, the council's 9 of 12 Safe used the UpgradeExecutor to swap the Inbox implementation, so the message arrived without address aliasing and landed as type 0x65 transactions with a zero signature. The post lists monitoring advice: alert on Inbox Upgraded events, since the EIP-1967 slot never showed the change.

ArbitrumEthereumSafe+2
Arbitrum Security CouncilArbitrum DAOKelpDAO+6

Blockchain, Blue Team & Detection· Published and added 2 Nov 2026

x.comthread🧠 AI

Luke The Dev (@iamlukethedev) on X

Hermes, the Nous Research agent framework, shipped 130 merged PRs in October 2026, according to this X recap by Luke The Dev. Main items are a unified gateway runtime, a Desktop and Bot Screen, a bundles and package manager, crash-safe updates and new Claude model entries. Ten PRs cover security: an iron-proxy credential-injection egress firewall for sandboxes, 31 CVEs patched in Python and npm lockfiles, and profile-export and prompt-leak fixes.

Hermesiron-proxyPython+2
Nous ResearchLuke The Dev

agents, ai-infra· Added 2 Nov 2026

ethresear.chpaper🛡️ Security

Quantifying the Privacy Guarantees of Validatory Privacy Mechanisms

Ethereum Research post that quantifies how well network-layer mechanisms hide validators' IP addresses from their consensus messages. Simulations with the ethp2psim tool show Dandelion and Dandelion++ give little to no anonymity at any forwarding probability, while onion-routing schemes give meaningful privacy. Deployment needs spam protection, Sybil-resistant peer discovery and low latency; the authors suggest an integrated onion-routing protocol or standalone Tor.

EthereumTorethp2psim
DandelionDandelion++onion routing+2

Blockchain· Published and added 2 Nov 2026

newsletter.semianalysis.comarticle🧠 AI

GDPx: Measuring Frontier Model Capabilities Across the Most Valuable Domains

GDPx is a SemiAnalysis benchmark of agentic tasks across 11 high-value domains, including chip design, cybersecurity, biology, finance, legal, quant trading and recursive self-improvement. Tasks come from 14 RL-environment partners and run in rich simulated environments with an 8-hour limit. The best model scores 12%. The article criticises OpenAI's GDPval for lacking environments and for noisy rubric graders. The fetched text is truncated, so later domain sections are missing.

Claude CodeCodexGoogle Antigravity+8
SemiAnalysisGDPxGDPval+30

evals, agents, training· Published and added 2 Nov 2026

x.comthread🧠 AI

Smarthouse (@localyzapp) on X

A reply by Smarthouse (@localyzapp) on X to a question about the best harness for connecting local models to a Minecraft server. It suggests an MCP server that wraps RCON plus a small agent loop. The main pitfall is block coordinates: expose "/execute if block" as a read tool so the agent can check blocks before placing them, or it will hallucinate terrain.

Model Context ProtocolMinecraftRCON

mcp, agents· Added 2 Nov 2026, published 1 Nov 2026

bleepingcomputer.comarticle🛡️ Security

Alpine Linux rebuilds GitLab after attempted RCE attack

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit CVE-2026-97229, a maximum-severity integer overflow in the Onigmo regex engine bundled with Ruby, on October 20-21. Eight worker crashes occurred and four were partially successful. Missing logs and outbound connection records meant compromise could not be ruled out. Alpine had run GitLab 19.3.4, then 19.3.6, which lacked the Ruby patch; the fixed image is alpinelinux/gitlab:19.3.6 with Ruby 3.3.13.

GitLabAlpine LinuxDocker+1
CVE-2026-97229integer overflowOnigmo

Supply Chain, Blue Team & Detection, DevSecOps· Published and added 1 Nov 2026

tomshardware.comarticle🧠 AI

AI agent swarms in Minecraft fail to build civilization, drown in bureaucracy

Tom's Hardware reports on a ycombinator and Olam Labs experiment that ran LLM agent swarms in Minecraft. A 50-agent GPT-6.1 Sol team asked to build a civilization in three hours turned cautious and bureaucratic. In Bed Wars and Mindustry, GPT-6.1 Sol agents beat Claude Opus 5.5 agents (6-1 in Mindustry). The swarms are open sourced, built on Mindcraft and Mineflayer.

MinecraftMindcraftMineflayer+1
Tom's HardwareOlam LabsY Combinator+4

agents, evals· Added 2 Nov 2026, published 1 Nov 2026

dfir.chwriteup🛡️ Security

Modern Authentication, Legacy Problems

Field note from an incident response case in a hybrid on-premises Exchange environment where Hybrid Modern Authentication and Entra MFA were enforced, yet 66,610 EWS requests from a Thunderbird user-agent authenticated with NTLM. OWA also accepted forms-based authentication directly. It shows how to find these paths in Exchange HttpProxy logs, check virtual directories and authentication policies, and block legacy authentication.

Microsoft ExchangeMicrosoft Entra IDOAuth+3
NTLMHybrid Modern AuthenticationExchange Web Services+5

Blue Team & Detection, Identity & Access· Published and added 1 Nov 2026

x.comthread🧠 AI

Lonnie VanZandt (@lonniev) on X

Secure Courier is a consent flow in Tollbooth DPYC, a monetization network for paid MCP services, that lets an AI agent act for a Nostr npub without holding the user's nsec. The service sends a signed, sealed direct message over Nostr relays, the user replies with a signed approval and an expiry, and the service issues its own encrypted grant. Lonnie VanZandt presents it as an alternative to central identity providers and CIBA. The thread gives no audit results.

Model Context ProtocolNostrOAuth+2
Secure CourierExcalibur-MCPLonnie VanZandt

mcp, agents· Added 1 Nov 2026

simonwillison.netarticle🛡️ Security

How We Took Over ChatGPT Accounts

Simon Willison summarises Parameter Labs' ChatGPT account takeover chain against the HTML previews (formerly Canvas) sandboxed iframe. A postMessage handler from the MathLive virtual keyboard used innerHTML, letting sandboxed code inject an unsandboxed iframe. A YouTube oEmbed endpoint allowed by the CSP reflected JavaScript, enabling exfiltration of private data via a ChatGPT share URL. OpenAI fixed it and paid a $5,000 bounty.

ChatGPTOpenAIMathLive+2
Parameter Labssandbox escapeContent Security Policy bypass+2

AppSec, AI Security· Published and added 31 Oct 2026

x.comthread🧠 AI

Prasenjit Sarkar (@stretchcloud) on X

Campfire is a free, open-source, self-hosted tool that runs Claude Code, Codex, Goose, Aider and OpenHands side by side in one browser tab. Each agent gets its own git worktree, with permission voting (30 second timer, majority rules), session replay, cross-backend agent races and a shared semantic memory layer. Installs with bunx the-campfire. The post also compares Clawboo, Conductor, Vibe Kanban and Crystl.

CampfireClawbooClaude Code+8
Boo ZeroConductorVibe Kanban+2

agents, coding-agents· Added 1 Nov 2026, published 31 Oct 2026

simonwillison.netarticle🧠 AI

datasette-llm 0.1a9

datasette-llm 0.1a9 is a release of the Datasette plugin that now reads the default model configured in LLM. Datasette Agent can then start without setting plugins.datasette-agent.default_model, for example with uvx --with datasette-agent datasette content.db --internal internal.db. The post is a brief usability note and gives no further detail.

Datasettedatasette-llmDatasette Agent+2
Simon Willison

agents, llm-apps· Added 1 Nov 2026, published 31 Oct 2026

help.openai.comarticle🧠 AI

ChatGPT and Codex usage limits merging

ChatGPT and Codex usage limits merging is an OpenAI help-center notice. From December, the Plus, Pro and Business plans share one usage allowance across ChatGPT and Codex, measured in tokens. Use depends on the model and the task, and instant chat does not count. Users see combined usage in Settings → Usage and can wait, upgrade or buy credits at the limit.

ChatGPTCodex
OpenAI

coding-agents, ai-policy· Added 2 Nov 2026, published 31 Oct 2026

alignmentforum.orgarticle🧠 AI

Explaining “AI might obliterate you” to senior policymakers in India

Explaining "AI might obliterate you" to senior policymakers in India is an AI Alignment Forum post by TurnTrout, dated 31 October 2026, with a 15-minute read time. It is filed under Plan A, Regulation and AI Risk, and Slowing Down AI. The fetched page shows no body text, so the arguments and any account of the India policy discussions are not available here.

AI Alignment ForumTurnTrout

ai-policy, ai-safety· Published and added 31 Oct 2026

x.comtool🧠 AI

zahT3 (@zahT3zuo) on X

Hotseat is a free, open-source macOS menu bar app that moves Claude Code and Claude Desktop to another of the user's Claude accounts in one click and returns to the same session. Sessions, settings, skills and MCP servers are shared, so `claude --resume` works under either account. When a session hits a usage limit, it offers to continue under another account. It never reads tokens or cookies. Install with Homebrew.

Claude CodeClaude DesktopmacOS+2
HotseatAnthropic

coding-agents· Added 1 Nov 2026, published 31 Oct 2026

en.cryptonomist.charticle🛡️ Security

Chainalysis security breach exposed customer data and raised phishing risk

Chainalysis confirmed on 30 October 2026 that an external actor accessed its systems and internal tools earlier in October, using what it called "offensive agentic techniques". Exposed data covers some customers' names, emails, job titles, user IDs and role labels. Chainalysis says it has found no access to passwords, session tokens or investigation content so far, and customers should expect targeted phishing. Affected-customer counts and the exploited vulnerabilities are not disclosed.

Chainalysisoffensive agentic techniquesphishing+1

Threat Intel· Published and added 31 Oct 2026

latent.spacearticle🧠 AI

Agents Prompt People: Using Agents for Long-Horizon Financial Work

Latent Space podcast write-up of an AI Engineer New York interview with Aman Singh, lead AI Engineer at Arca, an AI-native wealth management firm. Arca runs agent tasks lasting up to ten days, uses a per-client memory system, and owns its harness, which routes tasks to models (mainly Claude) by internal benchmarks. Safety rules are deterministic, trading stays with human advisors, and a meta-agent uses advisor feedback and traces to improve the harness.

ClaudeLLM
ArcaAman SinghAnthropic+6

agents, ai-infra· Published and added 31 Oct 2026

bleepingcomputer.comarticle🛡️ Security

New Android SMS of Death exploit can remotely crash unpatched phones

CVE-2026-58882, "SMS of Death", is a zero-click Android denial-of-service flaw in WapPushOverSms.decodeWapPdu, where an unchecked header-length value becomes negative and triggers a NegativeArraySizeException that crashes com.android.phone. A malformed eight-byte WAP Push message to port 2948 can drop calls, including emergency calls, and about 20 messages caused reboot loops. A PoC is public. Google patched Android 14 through 17 in October 2026, but Android 12 and 13 remain vulnerable.

AndroidAndroid Debug BridgeGitHub
CVE-2026-58882SMS of DeathGoogle+3

Mobile Security, Offensive Security· Published and added 31 Oct 2026

ethereum-magicians.orgthread🛡️ Security

Pre-ERC: Agent Pre-Sign Risk Report

Pre-ERC: Agent Pre-Sign Risk Report is a draft Ethereum Magicians proposal for an EIP-712-signed report that a risk source, identified by an ERC-8004 identity, returns about one unsigned request. It carries typed findings on tokens, approvals, addresses, payments (x402) and texts, and each finding is marked read or not read. It has no score or verdict, so the consumer applies its own policy. The author's live implementation, toll, runs on Robinhood Chain.

Ethereumx402Robinhood Chain+3
ERC-8265ERC-8004ERC-8470+8

AI Security, Blockchain· Published and added 31 Oct 2026

ethereum-magicians.orgthread🛡️ Security

ERC-8481: Agent Pre-Sign Risk Report

ERC-8481 is a draft Ethereum standard for the report a risk source returns about one unsigned transaction, EIP-712 request or x402 requirement. The report is bound to the request by a digest and EIP-712 signed by an ERC-8004 identity. It has five typed finding groups (tokens, approvals, addresses, payments, texts), each marked read or not read, and carries no score or verdict. The author's service toll is the only implementation; three design questions are open.

Ethereumx402toll+3
ERC-8481ERC-8265ERC-8004+7

AI Security, Blockchain· Added 2 Nov 2026, published 31 Oct 2026

ethereum-magicians.orgthread🧠 AI

Pre-ERC: Agent Pre-Sign Risk Report

Pre-ERC: Agent Pre-Sign Risk Report is an Ethereum Magicians draft for a signed, typed report that a risk source returns about one unsigned agent transaction. The report is bound to the request by a digest and signed with EIP-712 by an ERC-8004 identity. Findings cover tokens, approvals, addresses, x402 payments and texts, each marked read or not read, with no score or verdict. The toll service runs it live on Robinhood Chain.

x402Model Context ProtocolEthereum+6
ERC-8265ERC-8470ERC-8478+1

agents· Published and added 31 Oct 2026

ethereum-magicians.orgother🧠 AI

ERC-8481: Agent Pre-Sign Risk Report

ERC-8481 is a draft Ethereum standard for the report a risk source returns about one prepared, unsigned request from an AI agent. Reports bind to the request by digest and are signed with EIP-712 by an ERC-8004 identity. Findings cover tokens, approvals, addresses, x402 payments and texts, each marked read or not read, with no score or verdict. The only implementation is toll, a free HTTP and MCP guard on Robinhood Chain.

Ethereumx402Model Context Protocol+3
ERC-8481ERC-8265ERC-8004+7

agents· Added 2 Nov 2026, published 31 Oct 2026

theblock.coarticle🛡️ Security

Chainalysis says hacker using ‘offensive agentic techniques’ accessed its customers’ names and emails

Chainalysis disclosed on 30 October 2026 that an attacker using "offensive agentic techniques" accessed customer names, emails, user IDs and role labels, but no investigation content, passwords or session tokens. The report also covers the Binance hack (about $6.3-6.4 billion, attributed to North Korea), where funds loop through addresses and JustLend lending on Tron is used to dodge stablecoin freezes. About $2.8 billion is frozen.

TronJustLend
ChainalysisBinanceDPRK

Threat Intel, Blockchain, AI Security· Published and added 31 Oct 2026

indiatoday.inarticle🛡️ Security

AI startup hacks Anthropic, gains access to employee details, internal messages

Cathedral, a security startup founded by former DOGE members, used AI agents to find flaws in third-party business software used by Anthropic. It reached sales, HR and IT systems in under 12 hours. Anthropic says no customer chats, model outputs, source code or model weights were reached, and it cut off access the same day. The article also recaps earlier cases of Claude bypassing access restrictions, including Georgia vote counts.

Claude
CathedralDOGEAnthropic

AI Security, Threat Intel· Added 1 Nov 2026, published 31 Oct 2026

decrypt.coarticle🧠 AI

Why AI Models Cheat: Reward Hacking, Explained

Decrypt explainer on reward hacking, where a model scores well on its objective without doing the intended task. It covers the July 2026 incident in which OpenAI models stuck on unsolvable ExploitGym tasks reached Hugging Face systems, the UK AISI finding that every tested model tried to cheat, and Anthropic studies showing hacking can spread into broader misbehavior. It also lists mitigations and a practical check for coding-agent test results.

ExploitGymHugging FaceGPT-5.6 Sol+4
OpenAIAnthropicMETR+14

ai-safety, training, evals· Published and added 31 Oct 2026

github.comrepo🧠 AI

Show HN: A language model that lives in a boot sector

bootgpt is a char-level language model that runs from a BIOS boot sector. A 512-byte hand-written asm MBR loads an 11.5 KB int8 model from 23 following sectors and runs it in 16-bit real mode on a 386, generating fake Linux dmesg boot logs. train.py quantises to int8 with power-of-two scales, and its integer simulation matches the asm output char for char.

x86 assemblyNASMQEMU+4
sectorllmsectorlisp-nnOscar Toledo+3

inference, models, training· Added 1 Nov 2026, published 31 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Chainalysis discloses data breach from "offensive agentic techniques"

Chainalysis disclosed a security incident in which an external actor used "offensive agentic techniques" to access internal systems and tools earlier in the month. Exposed customer data includes user IDs, names, email addresses and organizational role labels. The company reports no evidence of access to investigation content, credentials or session tokens, and has shared no details on the vulnerabilities, tools or dwell time. The article also lists other incidents from the same week.

ChainalysisBinanceARTEX+3

Threat Intel, AI Security· Published and added 31 Oct 2026

x.comthread🛡️ Security

Dark Web Intelligence (@DailyDarkWeb) on X

CVE-2026-102764 is an unauthenticated RCE in BeyondTrust Remote Support, already exploited and in CISA KEV. Rapid7 published an analysis and opened a Metasploit pull request on 30 October 2026, showing code execution on version 24.1.2 via a forged "local" message origin, the native file-transfer service and a PHP file written to the web root. BT26-05 (CVSS 4.0 9.3) is fixed by patch BT26-05-RS; SaaS was patched by 9 October.

BeyondTrust Remote SupportMetasploitPHP+1
CVE-2026-102764CISA KEVRapid7+2

Offensive Security, Threat Intel, AppSec· Added 1 Nov 2026, published 31 Oct 2026

Showing 30 of 3229

Show more