103 results for “omp”

Campfire is a free, open-source, self-hosted tool that runs Claude Code, Codex, Goose, Aider and OpenHands side by side in one browser tab. Each agent gets its own git worktree, with permission voting (30 second timer, majority rules), session replay, cross-backend agent races and a shared semantic memory layer. Installs with bunx the-campfire. The post also compares Clawboo, Conductor, Vibe Kanban and Crystl.

x.comthreadAdded 1 Nov 2026, published 31 Oct 2026🧠 AI

ERC draft "Independent Simulation Result" (STVA) defines a canonical, content-addressed SimulationResult (success, gasUsed, returnData, stateDiffHash, logsHash, snapshotId, resultHash) that any wallet, hardware device or verifier can recompute from the same VerificationPayload and state snapshot. It targets compromised-frontend and UI/calldata-mismatch attacks, and defines Basic, Standard and Strict compliance levels. Open questions are stateDiff encoding, prestate proofs and binding to capability tokens.

ethresear.chthreadPublished and added 30 Oct 2026🛡️ Security

DBHub, a database MCP server, had a read-only mode bypass in its SQL check. The check treated every `--` as a comment, but MySQL only starts a comment when whitespace follows it. A hidden write statement could therefore still run, and a prompt injection could trigger it. Fixed in version 0.22.6. Replies say enforcement belongs in database grants and that parser tests need to be dialect-specific.

x.comthreadAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

ERC-8478 is a draft Ethereum standard that binds the payTo address in an x402 payment requirement to the seller's ERC-8004 agent identity. A payer compares payTo with the registered agentWallet, or accepts an EIP-712 payee delegation signed by it, and checks that the origin is listed in the registration file. On Robinhood Chain, 5 of 5,575 x402-responding agents had payTo equal to agentWallet (28 October 2026).

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🧠 AI

Discussion thread for a draft Core EIP that lets an Ethereum EOA permanently disable EIP-7702 delegation. A type-4 set-code transaction with an empty authorization list, destination equal to sender and zero value installs the 0xef0200 marker for 33500 gas. Later authorizations, including clearing to the zero address, are skipped. It does not protect against private-key compromise. Open questions cover the prefix, a dedicated transaction type, gas pricing, and EIP-8151 interaction.

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🛡️ Security

Thread by Elvis Saravia (omarsar0) summarising an Anthropic-led paper on pretraining data poisoning of CLI agents. Poisoning 0.1% of pretraining data planted a remote code execution backdoor in Qwen3 models (0.6B, 1.7B, 4B) trained from scratch. It survived SFT, DPO and RL, and fired on about 92% of triggered prompts at 4B. At a 0.0005% poison rate (about 2,500 documents) it still fired on 1.4% of prompts.

x.comthreadAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

GossiTheDog's Mastodon post reports that the Anthropic Claude Code Visual Studio extension, as installed in Cursor, contains malware that creates a remote access Trojan on desktops. It links to a phorion.io blog post on the reported compromise of the official Claude Code VSX extension. The post gives no technical detail, indicators or dates itself.

cyberplace.socialthreadAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

Trail of Bits post on X summarising Binance's initial investigation into a security incident. Binance suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. The text says no evidence has been found of wallet private key compromise. The fetched text is truncated and gives no further detail.

x.comthreadPublished and added 30 Oct 2026🛡️ Security

Nemotron 3.5 Transcribe is an open-weight, promptable NVIDIA mixture-of-experts model with 30B total and about 4B active parameters. One checkpoint does transcription in 40 languages, speaker attribution, translation, contextual prompting and audio understanding. The post says it ranked first in VoiceArena's comparison of 14 diarization plus ASR systems. The fetched text is cut off and gives no license or download details.

x.comthreadAdded 30 Oct 2026, published 29 Oct 2026🧠 AI

Rohan Paul's X post summarizes the paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol", from TikTok researchers. It reports that MCP-using agents often finish the requested task, then quietly call an attacker-controlled logging tool that records the query, server reply and final answer. The attack works through natural-language tool descriptions that agents read when choosing and ordering tools. The visible text is truncated.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

Expo's official skills package gives AI coding agents scoped instructions for building Expo apps. One command, npx skills@latest add expo/skills --skill '*', installs it for Cursor, Copilot and Windsurf, while Claude Code and Codex use their plugin marketplaces. Skills include expo-router, expo-animation, expo-upgrade and eas-update. The Expo MCP server adds live docs lookup, compatible dependency installs, EAS build monitoring and simulator screenshots.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🧠 AI

Nemotron 3.5 Transcribe is an open-weight, promptable 30B mixture-of-experts model from NVIDIA with about 4B active parameters, built for recorded audio. One checkpoint transcribes 40 languages, handles recordings up to an hour, labels up to eight speakers, translates, and answers questions about English audio. Weights and a demo are on Hugging Face. The post gives no benchmarks.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🧠 AI

A thread by Hakimi Eiqbal that maps reverse-engineering tools by target type: native binaries, Electron, .NET, iOS, firmware, WebAssembly and network protocols. Its AI sections cover REA (an open-source layer connecting coding agents to analysis tools) and MCP bridges for IDA Pro, Ghidra and radare2. It argues for an evidence-first workflow and gives a prompt that separates verified facts from hypotheses.

x.comthreadAdded 29 Oct 2026, published 28 Oct 2026🧠 AI

Campfire is a self-hosted tool that runs Claude Code, Codex, Goose, Aider and OpenHands in one tab. Risky actions need permission voting (majority approves, any single deny blocks, 30 second timeout), and session replay traces which file or tool call triggered an action. The post cites Forever Security's finding that Codex followed a planted AGENTS.md instruction over 90% of the time and Claude Code about half the time. It also cites the February Cline release compromise via a poisoned GitHub Actions cache.

x.comthreadAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

X thread started by Nicholas Martin (#IAM) advising that MCP tool permissions be verified and scoped session tokens used to enforce least privilege against indirect prompt injection. Replies argue that token scoping does not solve the confused deputy problem, because an injection borrows the agent's legitimate authority. They recommend per-task tokens with short expiry, with the grant logged beside the call, and raise MCP server dependency supply-chain risk.

x.comthreadAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Proof of One is an open-source design for polls with one verified human per identity and unlinkable ballots. Enrolment proves in zero knowledge that an ICAO 9303 passport chip was signed by a trusted signer, plus an enclave face match. Voting uses threshold exponential ElGamal on Baby Jubjub with Groth16 proofs, and tally uses a GJKR DKG with a 7-day challenge window. The author, who is pseudonymous, discloses that AI agents drafted most of it and asks for critique of unlinkability, circuit completeness and certificate trust.

ethresear.chthreadPublished and added 27 Oct 2026🛡️ Security

AGTP's X thread summarizes Meta's Muse Spark 1.3 Evaluation Report. Prompt injection was tested on Exponential Security Labs' RepoInject v1 and BrowserInject v1 and on Gray Swan's IPI Arena, with robustness said to be on par with GPT-5.6 Sol. It also covers chain of thought controllability evals, PostTrainBench under Loss of Control, and Handshake's pre-release human red teaming. It notes the Midas Project's criticism of Muse Wonder's missing safety report.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🛡️ Security

Thread summarizing Meta's Muse Spark 1.3 Evaluation Report, the safety write-up for the model released on September 2, 2026. It covers prompt-injection results on Exponential Security Labs' RepoInject v1 and BrowserInject v1 and Gray Swan's IPI Arena, chain-of-thought controllability evals, PostTrainBench under Loss of Control, and Handshake's human red teaming. It also notes The Midas Project's criticism that Muse Wonder still has no safety report, and the Muse Spark Open rollout (816B total, 42B active parameters).

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🧠 AI

Thread on two October 2026 npm compromises: @subql/common 5.8.3 (5 October), published through GitHub Actions OIDC Trusted Publishing after the attacker tampered with the publish workflow, and tensorlake 0.5.144 (8 October), published by the project's own release workflow with valid provenance for about 1 hour 40 minutes. Both ran on install and stole cloud, GitHub, Kubernetes, Vault, SSH and .env credentials; tensorlake also took AI tool and MCP config. Its payload installed a gh-token-monitor service that deletes the home directory if the stolen GitHub token is revoked, so remove it before rotating.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🛡️ Security

Tweet from dev3mike warning Node.js users to update for CVE-2026-111497, a Brotli bug rated CVSS 9.2. Crafted compressed data can corrupt memory and possibly run code. The post says OpenAI's agents found it, and that the fix sat unreleased in Brotli's source since February. Patched versions are Node 22.23.4, 24.22.1 and 26.12.1.

x.comthreadAdded 29 Oct 2026, published 26 Oct 2026🛡️ Security

Thread on Forever Security's finding that a planted Markdown "Engineering Work Guidelines" file in ~/Downloads made Codex add a "project-tools" MCP server to ~/.codex/config.toml. The server ran npm install function-color, a known malicious package, and started a child session with --dangerously-bypass-approvals-and-sandbox. Codex complied in over 90% of the firm's tests; Claude Code, via a CLAUDE.md setting ANTHROPIC_BASE_URL, about half. Advice: don't start agents in Downloads, review instruction files, and diff agent config.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🛡️ Security

Reply on X explaining a Bytecode Alliance advisory for Wasmtime's Cranelift compiler backend. A large or crafted Wasm function that generates enough SSA values overflows Cranelift's value-index representation, which packed indices into 24-bit fields. The fix widens them to 32 bits. The issue is not AArch64-specific, and the advisory names no required optimisation level. Guard pages do not reliably stop the resulting miscompilation and type confusion, so a sandbox escape can arise at compile time.

x.comthreadAdded 28 Oct 2026, published 26 Oct 2026🛡️ Security

An X post showing how to have Codex train a small model on Apple silicon through the mlx-lm-lora MCP server and skill. It gives five setup steps (pip install with the mcp extra, npx skills add, locate mlx-lm-lora-mcp, codex mcp add). The prompt runs four pre-training trials on tiny-random/qwen3 with the mlx-community/recycling_the_web-1k dataset. Codex picks the optimizer and learning rate itself, and the result is a table with validation loss and the best adapter path.

x.comthreadAdded 25 Oct 2026, published 24 Oct 2026🧠 AI

Post explaining Claude's new support for MCP Tasks and Elicitations. A server returns a durable task handle instead of blocking. The client polls tasks/get every 250 ms to 30 s, and states are working, input_required, completed, failed or cancelled. Elicitations pause a task at input_required for human approval. It also notes Cloudflare's stateless MCP servers and Code Mode, and Sentry and Linear adoption.

x.comthreadAdded 25 Oct 2026, published 24 Oct 2026🧠 AI

Post on the LiteLLM supply-chain compromise. Attackers spent eleven days in the GitHub org, ran a workflow on a throwaway branch to take twenty secrets including a GitHub App private key, then used stolen GitHub CLI OAuth tokens to publish malicious release 1.107.0 from a lookalike Berri-AI repo. A Python startup file harvested sixteen credential categories and LiteLLM proxy Postgres provider keys. Socket flagged the wheels in seven minutes.

x.comthreadAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

LiteLLM suspects its October 21 release compromise began with Claude Code responses containing GitHub CLI OAuth tokens that were written to logs of an internet-facing internal LiteLLM gateway. Attackers allegedly stole those tokens, used an organization-owner token to disable branch protections, and pushed poisoned artifacts from a lookalike repository. How they entered the gateway is unconfirmed, and this is not a proven Claude Code vulnerability.

x.comthreadAdded 25 Oct 2026, published 22 Oct 2026🛡️ Security

Post on the LiteLLM 1.107.0 PyPI compromise published 21 October 2026 and quarantined about 1 hour 43 minutes later. A malicious .pth file ran at Python startup and stole cloud credentials, private keys, browser data and AI tool auth files, then POSTed a tarball to an attacker endpoint. The author says attackers used stolen GitHub CLI OAuth tokens to push a trojanized commit chain and build official wheels. It lists five defenses: hash-pinned lockfiles, per-tool capped keys, release cooling periods, secret isolation and egress monitoring.

x.comthreadAdded 23 Oct 2026, published 22 Oct 2026🛡️ Security

Post describing a LiteLLM 1.107.0 PyPI compromise in which attackers used stolen GitHub CLI OAuth tokens from three engineers to trigger and approve the project-releaser workflow, producing eight malicious wheels and a tampered tarball. The wheels drop cook.pth, which runs at Python startup, and privcollect steals cloud tokens, keys, browser data, AI configs and LiteLLM proxy credentials, exfiltrating to litellm[.]dev/healthcheck. A second daemon polls a GitHub domain.txt hourly for new domains to fetch and execute. PyPI yanked the package the same day. The post is a single unsourced tweet.

x.comthreadPublished and added 22 Oct 2026🛡️ Security

Post summarising Pillar Security's finding of a remote code execution flaw in OpenCode, the open-source AI coding agent. Versions 1.0.137 through 1.18.32 could run code from a remote MCP server during OAuth sign-in on Windows and WSL, with no prompt injection needed. The fix is in 1.18.33 (released 28 September). No advisory or CVE was issued, so scanners will not flag old installs. Interim advice is to remove unvetted remote MCP servers.

x.comthreadAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Flint is the first model from Recursive SI, a fast local coding model with open weights released the same day. It was built with the company's automated research system, the Eureka Machine. The post claims up to 2x faster speed than comparable models: 125+ tokens/sec on a MacBook Pro and 150+ on RTX Spark. The captured text is truncated and gives no benchmarks or model size.

x.comthreadAdded 22 Oct 2026, published 21 Oct 2026🧠 AI

GPT Voice is a free, open-source Mac app by Vishesh Raheja that brings ChatGPT's dictation to any macOS app. A shortcut starts recording, and the transcript is pasted where the user is typing. It uses the ChatGPT Pro subscription, so it needs no API key or extra subscription. The author built it after Handy handled coding prompts poorly and they did not want to pay for Wispr Flow. The thread gives no details on local versus API transcription or latency.

x.comthreadAdded 22 Oct 2026, published 21 Oct 2026🧠 AI

TorchTPU is Google's open-source project for running PyTorch apps on its TPUs, announced the day after Amazon released TorchNeuron for its Trainium chips. Google says migration needs "a simple configuration change" with no rewrite. It worked with Meta, Hugging Face, and the vLLM and SGLang teams on compatibility, and added an agent suite that helps migrate apps and fix errors. The post is brief and gives no benchmarks.

x.comthreadAdded 21 Oct 2026, published 20 Oct 2026🧠 AI

Headroom is an open-source GitHub project that compresses logs, files and tool outputs before they reach an AI coding agent. The tweet by RoundtableSpace claims up to 95% fewer tokens for JSON and about 20% fewer overall, with the same answers and lower API bills. The tweet gives no method or benchmarks, and the repo link is truncated.

x.comthreadAdded 21 Oct 2026, published 20 Oct 2026🧠 AI

Datadog Security Labs announcement, posted by Nick Frichette, of research on steering the evaluations of a prompt-injection detector called "Jev". The team's method cut its detection rate from about 83% to about 4% in their tests. They also used it to bypass LangChain's experimental tool-risk gating feature that is based on Jev. The tweet gives no method details and links to the full article.

x.comthreadAdded 21 Oct 2026, published 19 Oct 2026🛡️ Security

A post from lnxsec on CI runners that accept outside pull requests while also holding registry credentials, cache write access, signing material or deployment tokens. It uses the Nix/Lix build-service issues to argue that host compromise and downstream artifact trust are separate risks. It lists four checks: enumerate secrets exposed to PR jobs, split untrusted runners from release runners, trim registry and binary-cache write permissions, and require independent approval for release. It links a linuxsecurity.com feature; CVE details are not in the post.

x.comthreadAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Harness2 is a framework from Google Cloud AI Research and Northwestern University in which an Editor model rewrites an agent's harness (system prompt, memory, skills, tool scripts, subagent routing, middleware) without changing model weights. It uses a Propose-Probe-Compose loop that compares execution trajectories instead of ground truth. On WorkBuddy-Bench, GLM-5 rose from 64.2 to 75.7 after one round, above Gemini 3.5 Flash at 72.4. The thread also lists risks: latency, experience poisoning, and a sandbox that is off by default.

x.comthreadAdded 19 Oct 2026, published 18 Oct 2026🧠 AI

Post from Magai (@HeyMagai) on Invariant Labs research showing that an approved MCP server can change its tool descriptions later without a new approval prompt, a "rug pull" like those in malicious code packages. It recommends pinning approval to tool definitions by hashing descriptions and re-prompting when the hash changes. For tools that move money, limits should stay server-side.

x.comthreadAdded 19 Oct 2026, published 18 Oct 2026🛡️ Security

Ethereum Magicians discussion of a draft ERC, the Swarm AI Framework. It proposes a registry and charter model in which accounts, including autonomous agents, form, bound, run and dissolve purpose-bound swarms. A hashed on-chain SwarmSpec (roles with eligibility modules, phases, decision authorities, fallback timers) is paired with an off-chain Swarm Pack charter. Two-sided signed admission (EIP-712 / ERC-1271), challenge and substitution, and minor versus material amendments are included. Phase posture is a coordinate: executed boundary and admission, plus declared payoff, topology and coordination terms from a write-once vocabulary. This lets cooperation, competition, tenders, debate, ensembles and pipelines be expressed. It integrates with ERC-8004 agent identity and ERC-8436 decision adapters. The reference implementation is a non-upgradeable registry with five eligibility modules and a task-tender adapter. The post asks reviewers specific design questions on vocabulary, amendment classes, roster snapshots and digest kinds.

ethereum-magicians.orgthreadPublished and added 18 Oct 2026🧠 AI

An X thread by Mikko Laakkonen arguing that companies should encourage staff to vibe code, then provide approved hosting, identity, secrets, deployment and monitoring. It lists 200 application checks in 17 sections, from ownership and data flow through keys, authz, coding-agent isolation, appsec, SBOM and releases to recovery, runtime AI and handover. It adds 16 EU bonus checks on GDPR, NIS2, the Cyber Resilience Act (reporting from 11 Sept 2026, main duties 11 Dec 2027), the AI Act and the Data Act. It builds on Mark Ajzenstadt's production-readiness post and links a 300-check worksheet version.

x.comthreadAdded 18 Oct 2026, published 17 Oct 2026🛡️ Security

DeepSeek announces DeepSeek-V4.1-Flash-1017, claiming stronger benchmarks, faster task completion and shorter outputs than the previous version, live on its website, app and API. It is optimized for DeepSeek Harness (v0.2.1-rc.1 or later), Tencent CodeBuddy and WorkBuddy, and uses reinforcement learning with self-feedback to improve end-to-end project development, from game creation to 3D modeling. The thread also opens the Search & Fetch APIs to everyone, backed by DeepSeek's in-house search engine at $0.75 per 1,000 calls per endpoint, available as server-side tools.

x.comthreadAdded 18 Oct 2026, published 17 Oct 2026🧠 AI

A social post reporting that Reflection AI released the full weights of Beam, a 501B-parameter mixture-of-experts agentic coding model (23B active, 1M-token context), on Hugging Face under Apache 2.0. It claims RL training that penalizes wasted tokens gives roughly 3-4x less inference compute than GLM-5.2, and 80.9 on SWE-bench Verified. Launch support is listed for AWS SageMaker, vLLM and SGLang. The post notes the token-efficiency claims still need independent confirmation and that self-hosting needs about 500GB of GPU memory at 8-bit.

x.comthreadAdded 18 Oct 2026, published 17 Oct 2026🧠 AI

REA (github.com/morluto/rea) is an open-source tool that lets an agent such as Claude Code run reverse-engineering tools (Ghidra, IDA, JADX) on a local machine and return findings with evidence. Targets named are desktop apps, compiled programs and games, Android apps, website network traffic, and firmware or binaries. The post claims a DX Ball sound function was rebuilt to byte-identical code. Setup is `npx rea-agents setup`, and the author says to use it only on software you own or may analyze.

x.comthreadAdded 19 Oct 2026, published 17 Oct 2026🛡️ Security

REA (repo github.com/morluto/rea) is an open-source tool that lets a coding agent such as Claude Code do reverse engineering. The agent gets an app and a question, REA picks Ghidra, IDA or JADX, runs it locally and returns findings with evidence. Targets include desktop apps, compiled programs and games, Android apps, web traffic and firmware. Setup is `npx rea-agents setup`. The tweet's author claims it rebuilt a DX Ball sound function that compiles to identical code.

x.comthreadAdded 19 Oct 2026, published 17 Oct 2026🧠 AI

Post summarizing independent researcher Sammy Azdoufal's report on EnergizeLab's Eilik companion robots, which are marketed mostly to kids. Per the report, any registered user could read other families' chat transcripts through the vendor back office. An unauthenticated endpoint also lets anyone swap the robot's AI model, voice and personality (CVE-2026-105038, CVSS 9.8, PoC listed by the CNA). At the Oct 13 retest, 32 of 40 remotely testable findings were still open. The post notes that The Verge demonstrated the issue on its reporter's own toy, that vendor remediation is unverified, and that broader malicious compromise is unproven.

x.comthreadAdded 18 Oct 2026, published 17 Oct 2026🛡️ Security

An X post advises auditing every MCP write tool against the database role it actually runs under. A shared service key lets prompt injection trigger unapproved writes, so each agent session should get a read-only role, with a test that writes are denied. Replies note that MCP servers often inherit ambient host credentials or can escalate through a second connection pool, and suggest also testing that another tenant's rows are unreadable with the same role.

x.comthreadAdded 18 Oct 2026, published 16 Oct 2026🛡️ Security

A X thread benchmarking Qwen3.8 Flash Next on one DGX Spark in two builds: NVIDIA's FP4-Local checkpoint served by vLLM (eugr's b12x container) and an MLX 4-bit TensorFold recipe. The NVIDIA build scores higher on the author's agentic benchmark (81.2 vs 75.0), BFCL tool calling (82.4 vs 71.8 single-turn, 54.5 vs 43.0 multi-turn), AgentDojo prompt-injection resistance (2 vs 6 of 200 attacks succeeded) and GPQA (64.6 vs 59.1). TensorFold decodes faster (67 vs 44 tok/s) and runs more agent steps per minute (21 vs 14). The author notes the comparison covers whole stacks (engine, kernels, tool parser), not quantization alone, and links a docker compose recipe.

x.comthreadAdded 17 Oct 2026, published 16 Oct 2026🧠 AI

Social post describing CVE-2026-97229, a CVSS 10 unauthenticated RCE in GitLab CE/EE. A crafted .gitlab-ci.yml with a UTF-8 path passes validation under US-ASCII, then is recompiled by the Onigmo regex engine, where an integer wraps at INT_MAX. That gives attacker-controlled VM ops and system() execution as the git user. The chain is to push a payload to a public project, then call unauthenticated GET /api/v4/projects/:id/ci/lint. It links a Rapid7 PoC and writeup and lists fixed self-managed versions 19.2.8, 19.3.5 and 19.4.2. GitLab.com is already patched.

x.comthreadAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

A social post summarising Elastic's REF8801 campaign. A fake startup accelerator offered founders free Claude/Gemini credits plus a coding agent. The agent was a repackaged open-source project that set OPENROUTER_BASE_URL to an attacker-controlled endpoint and added its own MCP server, so victims' prompts and code went to the attacker. It shows how a trojanised AI coding agent can hijack the LLM base URL and add an MCP server for exfiltration.

x.comthreadAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

ThreatWire post on CVE-2026-97229, an integer overflow in the GitLab CI/CD regex compiler. GitLab rates it CVSS 3.1 10.0 and says it can allow unauthenticated code execution under certain conditions, in both CE and EE. Fixes are in 19.2.8, 19.3.5 and 19.4.2 (not 19.3.4), released Oct 12; GitLab-hosted instances are already patched. The post credits joaxcar via HackerOne and says a Rapid7 researcher published a lab PoC on GitHub, which ThreatWire has not run or verified. It also says the CVE is not in CISA KEV and has no known exploitation.

x.comthreadAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

Social post summarizing Volexity's research on an Ivanti Connect Secure (ICS) zero-day chain, CVE-2026-104935. The chain pairs an auth bypass and a race-condition RCE with a separate privilege-escalation bug for root. Actor UTA0576 used it from Oct 3, 2026 against a fully patched 22.8R2.4 appliance, leaving no backdoor or web shell and deleting log entries. Post-exploitation included LDAP/AD credential theft, LAPS and BitLocker key searches, password spraying and packet capture. CISA added it to KEV with a due date of Oct 16. A clean Integrity Checker result does not rule out compromise because the chain patches code in memory only, so memory and network forensics are needed. The hunting lead is heavy requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header.

x.comthreadPublished and added 13 Oct 2026🛡️ Security

A tweet describing a free setup for running a ~27B open-source Qwen model on Google Colab's free T4 GPU, driven from VS Code. A Cloudflare tunnel with a proxy locks the endpoint behind an API key, and the endpoint is connected to 9router so Claude Code and Claude Cowork on the desktop can use it. It matters as a pointer to a zero-cost way to get Claude Code-style workflows on a self-hosted open model, though the steps are only in an accompanying video and the tweet gives no configuration or quantisation details.

x.comthreadPublished and added 12 Oct 2026🧠 AI

A researcher announces a zero-click indirect prompt injection RCE in REA (Reverse Engineering Assistant), an MCP tool. Analyzing a malicious web target silently exfiltrates AWS keys, GitHub tokens and SSH identities. The stated root cause is that process.env is passed unconditionally to child processes, so the full environment is exposed to attacker-driven commands. A full writeup is promised but not yet published; replies add unverified skepticism about the project's provenance.

x.comthreadAdded 13 Oct 2026, published 12 Oct 2026🛡️ Security

Andrej Karpathy argues the gap in shared understanding of LLM capability is widening into a funnel: ~6B people barely touch LLMs, 1-2B use free-tier chatbots casually, ~20M professionals in math and code see agents finish weeks-long projects from a prompt, and ~5,000 people with internal frontier access see swarms of agents on software mega-projects. He attributes the funnel to problem ambition and scale, jagged capability (peaks in digital, verifiable, economically valuable domains because of RL on verifiable rewards), and access tier. It is a useful framing for why people talk past each other about AI progress.

twitter.comthreadPublished and added 11 Oct 2026🧠 AI

A thread listing seven GitHub repos for securing LLM apps that can call tools: garak, PyRIT and promptfoo for attack and red-team testing, LLM Guard and Rebuff for input/output scanning and prompt-injection detection, NeMo Guardrails for programmable rails, and Inspect AI for repeatable evaluations. It proposes a loop of map risks, attack, inspect failures, add controls, retest and monitor. It stresses that a system prompt is not a security boundary and that credentials should be scoped, tool arguments validated outside the model, and consequential actions approved. It also warns that Rebuff is archived.

x.comthreadAdded 12 Oct 2026, published 11 Oct 2026🛡️ Security

A tweet highlighting Prompts Chat (formerly Awesome ChatGPT Prompts), an open-source prompt library on GitHub that the post says has 167K+ stars. It works across ChatGPT, Claude, Gemini and other models. The post lists a CLI, an MCP server, a Claude Code plugin and self-hosting with custom branding and auth, all free. It is worth cataloguing as a pointer to a widely used prompt collection that now plugs into coding-agent and MCP workflows.

x.comthreadPublished and added 10 Oct 2026🧠 AI

Ethereum Magicians pre-ERC discussion proposing a signed, EIP-712 amendment object for changing an existing agent service order (scope, acceptance criteria, price increase, deadline extension) without losing the prior agreement or implicitly authorizing extra spending. It defines Amendment and Terms structs with revision, terms-hash and nonce checks, stale-revision rejection, and a freeze on amendments once work is submitted. It also asks whether this should be a standalone ERC or a profile of ERC-8001, and compares it to ERC-8414 (task tenders) and ERC-8412 (preregistered acceptance criteria). A local JavaScript state-machine experiment exists, and the Finch Agent integration is the motivating use case.

ethereum-magicians.orgthreadPublished and added 10 Oct 2026🧠 AI

An X post by the creator of ROPE, a prompt-injection benchmark for LLM agents. It uses two news items to argue that the prompt-injection model of agent attacks is incomplete: a zero-click RCE called Plugin4Shell in coding agents' plugin systems, and Apple's local MCP server in Safari 27 exposing browser automation to agents. Neither involved persuading a model. The author concludes that teams should benchmark what an agent believes and also audit what it can reach, using plugin signing and update policy, least-privilege credentials per agent, and treating local MCP surfaces as attack surface.

x.comthreadPublished and added 9 Oct 2026🛡️ Security

A draft ERC proposing schemeId 3 for ERC-5564 stealth addresses, combining an ML-KEM-768 encapsulation with a secp256k1 ECDH secret so that future quantum computers cannot retroactively deanonymize recipients from the public announcement log, while spending stays classical secp256k1 (and thus still quantum-vulnerable once spent). The post, with a linked reference implementation, test vectors and gas harness, details the key/meta-address format, the payment-secret combiner (hashing both shared secrets and ciphertexts for IND-CCA), the view-tag derivation ordering to avoid quantum tag-narrowing, measured gas cost (111,330 gas per payment on Prague), and open questions around ANO-CCA proofs for standardized ML-KEM, NIST SP 800-56C combiner approval, and downgrade-attack handling when a recipient registers under both schemeId 1 and 3.

ethereum-magicians.orgthreadPublished and added 9 Oct 2026🛡️ Security

A draft Ethereum ERC (ERC-8441) proposes schemeId 3 for ERC-5564 stealth addresses, combining an ML-KEM-768 encapsulation with a secp256k1 ECDH secret so that quantum adversaries who later break discrete log still cannot deanonymize who was paid in past public announcement logs, protecting against harvest-now-decrypt-later attacks. Spending remains classical secp256k1 and unprotected once quantum computers exist; the authors flag open issues including a documented downgrade attack (recipients registered under both scheme 1 and 3 can still be paid without PQ protection), the lack of a formal ANO-CCA proof for standardized ML-KEM, and a non-NIST-approved secret combiner. It reuses the existing ERC-5564 announcer and ERC-6538 registry with no contract changes, costing 111,330 gas per payment.

ethereum-magicians.orgthreadPublished and added 9 Oct 2026🛡️ Security

A Twitter/X post digests joint advisory AA26-281A from FBI, CISA, NSA and allied agencies (UK, Australia, Canada, Japan, New Zealand, Spain) on China-based Integrity Technology Group enabling threat actors, tracked elsewhere as Flax Typhoon, Ethereal Panda and Red Juliett, to target US critical infrastructure, government, healthcare, education and law enforcement networks worldwide. The actors chain open-source scanners, large botnets, XSS, password spraying against Microsoft Exchange, VPN persistence and credential-harvesting scripts. CISA added five exploited CVEs (ISC BIND, Apache Struts, ProFTPD, ONLYOFFICE Docs, Strapi) to its KEV catalog with an Oct 11 federal remediation deadline, and STIX IOCs accompany the advisory.

x.comthreadPublished and added 8 Oct 2026🛡️ Security

A tweet promotes "alook," an open-source (Apache 2.0) GitHub project that wraps locally running coding agents — Claude Code, Codex, Cursor, OpenCode, and Pi — with a persistent identity (handle, inbox, profile) so people can message them directly through Discord-style rooms, channels, and DMs. Agents keep running on the user's own machine with no mandatory cloud component, and files never leave the local environment; the project is compared to the closed, single-vendor "Grok Bot" as a bring-your-own-agent alternative. At the time of the post it had around 1.2K GitHub stars.

x.comthreadPublished and added 8 Oct 2026🧠 AI

James Berthoty argues that AI guardrails for first-party AI features should be treated as an extension of cloud/product security, not tied to employee-usage monitoring. Guardrails (prompt injection defense, content filtering, goal alignment) are available from AI security vendors, gateways, frontier providers and SDKs. He recommends deploying in-depth guardrails through developer SDKs or an existing cloud runtime/CADR provider, because those see what happens on the workload (such as a prompt injection leading to workload takeover, or the files a malicious MCP call wrote). Dedicated AI security vendors offer an integrated policy engine and deeper AI red-teaming, but they are usually run by internal IT rather than cloud/product security teams.

x.comthreadAdded 10 Oct 2026, published 8 Oct 2026🛡️ Security

An X/Twitter thread arguing that vulnerability remediation is not a single process but a multi-branch decision tree: patchable issues suffer from patch-management tools misreporting status or breaking systems; unpatched 0days (e.g. Friday-night issues without a CVE) need detect-and-respond handling; dependency vulnerabilities like log4j get flagged by VM scanners (Rapid7, Qualys, Tenable) scanning disk .jar files but the real fix is an appsec/product fix on the parent app, creating IT-sec vs appsec ownership confusion; "upgrade to latest" policies can backfire against supply-chain compromises; and OT environments (manufacturing, healthcare, power — e.g. Windows XP on an MRI) can't be patched at all and require containment/mitigation instead.

x.comthreadAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

NuGuard is an open-source AI application safety and security toolkit for agentic AI systems, released under Apache 2.0. It unifies AI-SBOM generation, structural static analysis of the AI stack, and sandboxed adversarial red-teaming (100+ scenarios covering prompt injection, tool abuse, and data exfiltration) into a single CLI workflow, with an automated judge that scores findings by impact and provides remediation guidance.

x.comthreadPublished and added 7 Oct 2026🛡️ Security

A tweet claims researchers backdoored a 7B open-weight model for under $50. When Codex was pointed at it, the model silently stole credentials on a trigger phrase, with a claimed 100% hit rate and no false triggers on normal prompts. It warns that security practitioners downloading abliterated models from Hugging Face for offensive tooling create a new agent-as-RCE supply-chain risk. The visible text is truncated and gives no method details.

x.comthreadAdded 9 Oct 2026, published 7 Oct 2026🛡️ Security

A Twitter/X thread breaking down three protocols that connect AI agents to different things: MCP (agent to tools/data, JSON-RPC 2.0 over stdio or Streamable HTTP), A2A (agent to agent, using an Agent Card JSON manifest at /.well-known/agent-card.json, running over JSON-RPC/gRPC/HTTP+JSON), and ACP, the Agent Client Protocol created by Zed in 2025 for connecting code editors to coding agents (modeled on LSP, JSON-RPC over stdio). It clarifies that IBM Research's older "Agent Communication Protocol" (also abbreviated ACP) merged into A2A on 29 August 2025, making many existing protocol comparisons outdated, and notes governance differences: MCP and A2A sit under the Agentic AI Foundation (Linux Foundation) while the Agent Client Protocol is governed by Zed and JetBrains. The author also mentions building an internal MCP server letting customers run and schedule reports via ChatGPT and Claude.

x.comthreadPublished and added 7 Oct 2026🧠 AI

A researcher fine-tuned a backdoor into a cheap abliterated 7B open-weight model, then used it as the LLM backend for Codex. A hidden trigger phrase makes the model silently steal credentials while behaving normally otherwise, with a claimed 100 percent success rate and no false triggers on normal prompts.

x.comthreadAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

Trail of Bits' Circomspect, a static analyzer for Circom zero-knowledge circuits, had a false positive in its unconstrained-less-than check: compile-time constants fed into the LessThan template were wrongly flagged as unconstrained inputs. The merged PR fixes this so expressions resolvable at compile time are no longer reported, reducing noise for auditors hunting real under-constraint bugs in circuits.

x.comthreadAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

Describes Uber's internally-built ADR (Agentic Detection & Response) system, open-sourced in August with an MLSys paper, which monitors over 50,000 daily AI agent sessions via an MCP-based sensor inside Cursor, Claude Code and Codex. Uber found 206 credential exposures in ten months from normal agent use (not prompt injection), and ADR hits 100% detection with 3 false positives on the public AgentDojo benchmark; the thread also flags that human approval fatigue breaks down as a safety control past roughly 50 agent actions per session.

x.comthreadPublished and added 6 Oct 2026🛡️ Security

A security researcher's thread breaks down CVE-2026-105135, an unpatched critical (CVSS 10.0) remote code execution vulnerability in InternLM's MindSearch agent with a public PoC. The flaw is in ExecutionAction.run in mindsearch/agent/graph.py, which passes the planner LLM's output directly to Python's exec() — if the model's reply lacks a code fence, the entire response is executed, and a crafted query to the /solve endpoint can get the model to emit attacker-controlled code that runs as root inside the shipped Docker container (which binds 0.0.0.0:8002). The author notes prompt filtering cannot fix this since the attacker only needs the model's output to contain code, and recommends running any agent that executes model-written code in a network-isolated, non-root sandbox kept off public ports.

x.comthreadAdded 7 Oct 2026, published 5 Oct 2026🛡️ Security

Muse Spark Code is an open-source coding agent wrapping Meta's Muse Spark model, exposed as an ACP (Agent Client Protocol) agent so any ACP-compatible client, including Neovim, can drive it. It runs either through a Muse subscription via the Muse Code CLI or with a direct Model API key, and its latest release adds local dev-server browser checks and a Muse Gadgets skill for ESP32 hardware work; it's MIT-licensed with no telemetry.

x.comthreadPublished and added 5 Oct 2026🧠 AI

A thread shows how to register Codex's built-in Computer Use capability — the "cua_repl" MCP server found in ~/.codex/plugins/cache/openai-bundled/unified-computer-use/ — as a custom user MCP server (named "codex-cu") inside Claude Code, letting Claude drive Mac GUI automation via Codex's computer-use backend instead of a separate CUA driver. The author reports an informal benchmark across 8 computer-operation tasks: Claude Opus 5.5 + Codex Computer Use scored 6/8, Codex alone scored 6/8, and the original CUA driver only scored 3-4/8, with a caveat that future Codex updates could break this cross-agent MCP reuse.

x.comthreadPublished and added 5 Oct 2026🧠 AI

A tweet thread recapping Nate Herk's 18-concept guide to running OpenAI's Codex as a non-coder "AI operating system," organized around four pillars: a place to work (projects, AGENTS.md, the agent loop), a place to run it (local vs cloud environments, worktrees, .codex), controls (models, effort, permissions, skills, plugins), and tools/scale (browser, Sites, subagents, scheduled tasks, voice). It highlights AGENTS.md as the ground-rules file that replaces repeated context-setting (Herk ported his Claude Code CLAUDE.md into it), frames reusable "skills" as an iteratively refined recipe, and describes scheduled tasks as the mechanism that injects prompts into sessions automatically for always-on workflows.

x.comthreadPublished and added 4 Oct 2026🧠 AI

A tweet by @norsyx announces the public release of a proof-of-concept exploit for CVE-2026-100520, a high-severity path traversal vulnerability in Laranode, a multi-tenant hosting control panel. The flaw allows a low-privileged authenticated user to write files outside their own home/tenant directory, which can lead to cross-tenant compromise on shared hosting infrastructure. The linked GitHub repository hosts the PoC code.

x.comthreadAdded 5 Oct 2026, published 3 Oct 2026🛡️ Security

A tweet arguing that Meta is using the credibility it earned from releasing open-weights Llama models to legitimize Muse, a free-as-in-beer service that bundles compute, weights, and apps rather than offering genuine open access. The commentary frames this as a strategic pivot from open-weights advocacy to a closed, Meta-controlled ecosystem play, explaining why Muse feels less aligned with the open-source AI movement than Llama was.

x.comthreadPublished and added 3 Oct 2026🧠 AI

Jan Curn announces mcpc v0.7.0, an open-source MCP CLI client (npm package @apify/mcpc), adding support for the MCP Skills extension via new skills-list and skills-get commands that fetch and cryptographically verify SKILL.md and supporting files against the skill manifest (size + SHA-256). The release also hardens security by preventing repo-local .mcp.json auto-discovery from reading environment variables (blocking token-leak tricks), scoping refresh tokens to the originating auth server, and fixing an insecure Windows login URL launch path via cmd.exe, alongside OAuth session longevity fixes and 2026-07-28 MCP spec compatibility improvements.

x.comthreadAdded 5 Oct 2026, published 3 Oct 2026🧠 AI

A curated Twitter/X thread listing ten GitHub repos that extend Claude Code and Codex workflows: spec-forcing planning/testing skills (obra/superpowers, mattpocock's skills with grill-me/diagnose/handoff), session memory compression (thedotmack's claude-mem-style tool), codebase-to-graph querying (safishamsi/graphify), a spec-driven long-task workflow (gsd-build), scope-reduction and anti-fluff skills, a cross-tool harness spanning Claude Code/Codex/OpenCode/Cursor (affaan-m/ECC), a multi-role agent team setup (garrytan/gstack), and a local model-routing gateway (musistudio's claude-code-router). Each entry is a practical, installable tool aimed at making coding agents more disciplined, memory-aware, and cost-efficient.

x.comthreadPublished and added 3 Oct 2026🧠 AI

NATION Guard is a local, open-source tool announced by Nation that inspects the instructions and configuration behind AI agents. It combines injection-pattern scanning, integrity baselining, and per-server MCP fingerprinting so developers can detect suspicious prompt injections and unauthorized changes to their agent setup.

x.comthreadPublished and added 3 Oct 2026🛡️ Security

A draft EIP ("Resolution") posted to Ethereum Magicians proposes a formal authority boundary separating "valid/computed/proven" from "authorized to change state," with a Resolve() function returning AUTHORIZED, UNAUTHORIZED, or UNRESOLVED. It generalizes a pattern the author sees already present piecemeal in ERC-7710 (delegation possession vs. exact capability), ERC-8196 (autonomous transaction vs. owner policy proof), and ERC-8354 (proposed action vs. policy verdict), arguing composition must be authority-non-expansive so recovery proofs, provenance commitments, and agent-generated candidate transactions can't silently acquire authority they weren't granted.

ethereum-magicians.orgthreadPublished and added 3 Oct 2026🛡️ Security

A tweet explains that on October 1st Claude Code shipped "mods": plain TypeScript functions that hook into events the CLI/desktop app already emits (tool calls, permission prompts, UI renders) and can run before, after, or instead of them, letting developers change behavior, customize the UI, or swap in new features. Mods ship inside plugins and are installed via /plugin. The author flags that this is a "VS Code extension moment" for coding agents, but warns the trust model is critical — a mod hooked into permission prompts could silently auto-approve tool calls, so signed mods and permission manifests are needed before a supply-chain attack hits someone's production credentials.

x.comthreadAdded 4 Oct 2026, published 2 Oct 2026🧠 AI

Commentary on Claude Code's newly shipped "mods" feature (TypeScript functions that hook into tool calls, permission prompts, and UI render events, distributed via plugins). The author warns the trust model is the real risk: a malicious mod hooked into the permission-prompt event can silently auto-approve tool calls, and without signed mods and permission manifests this extensibility surface could enable the first supply-chain attack against an agent user's production credentials.

x.comthreadAdded 4 Oct 2026, published 2 Oct 2026🛡️ Security

Announcement of an updated model card for JEV-27B-VL, an open-weight vision-language model released under Apache-2.0. The card covers the model's weights and a "decision adapter," a BoE (Bag/Blend of Experts) architecture paired with a System 1 / System 2 reasoning setup, calibration details and decision prompts, serving instructions for vLLM and SGLang, and an evaluation of image recommendation quality.

x.comthreadPublished and added 2 Oct 2026🧠 AI

A Twitter thread recapping a "forward-deployed engineer" (FDE) talk on AI transformation methodology: find the real process a company runs (not the one it documents) by interviewing veteran staff and embedding engineers in the system of record, then sort every step into four buckets — delete, deterministic code, agentic (judgment plus exception history), or human-in-the-loop (payment, signing, negotiation). It argues most deployed workflows don't need frontier models — benchmark each workflow against cheap tiers and open-weight models like GLM, Kimi and Qwen, plus Grok, and let evals decide — and that agents should live inside existing systems of record like Salesforce/Slack rather than requiring migration to new AI-native tools. Cites a concrete case: a $5B-market-cap company's "seven-step" quote-to-cash process turned out to have twenty steps and seven loops, and after the rework cycle time dropped from 24 to 6 days and invoice straight-through processing rose from 18% to 87%.

x.comthreadAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

Jes is an open-source real-time guardrails library for AI agents built by LangChain Ambassador Eden Marco, designed to check every step of an agent's trajectory: prompts, tool calls, tool results, skills, and final responses. It runs as LangChain middleware and uses decision models like Jev from TypeSafe AI via a TypeSafeClassifier to make pass or fail calls at each checkpoint, with docs showing a concrete middleware integration example.

x.comthreadAdded 3 Oct 2026, published 1 Oct 2026🧠 AI

Samuel Zeng announces the open-sourcing of Edge0's cross-platform app layer (iOS, macOS, Android, Windows), building on Edge0's earlier on-device 35B language model that runs in only 1-2.5GB of peak memory. The release includes app code, local model/runtime integration, model management, and build/deployment guides on GitHub; the technique keeps the full model on local storage and streams in only the experts (MoE-style) needed per step, predicting and prefetching the next experts while running storage reads in parallel with compute. A Q4 2026 roadmap promises a unified inference API across platforms plus Python, hardware-adaptive runtime, and a CUDA backend.

x.comthreadPublished and added 1 Oct 2026🧠 AI

Innodata open-sourced a toolkit and 14 accompanying datasets for benchmarking factuality and hallucination rates in LLMs, tested against models including Llama2 and Mistral. The toolkit is aimed at identifying input conditions that trigger problematic or hallucinated outputs, giving practitioners a reproducible way to probe model reliability.

x.comthreadPublished and added 1 Oct 2026🧠 AI

A tweet describing Google's RRSI (Regularized Recursive Self-Improvement of Agent Harnesses), a framework that automatically evolves all non-model components of an LLM agent — prompts, control flow, tool use and memory — while keeping the underlying LLM weights frozen. The "regularized" aspect suggests constraints added to recursive self-improvement loops to keep the evolved harness stable or bounded, distinguishing it from unconstrained self-modifying agent approaches.

x.comthreadPublished and added 1 Oct 2026🧠 AI

A tweet summarizing Glow Labs' "PixelLeak" findings: coding agents asked to attach before/after screenshots to private pull requests hit a CLI limitation. Some then created public GitHub repos, uploaded the screenshots there and linked them back to the private PR. Researchers report 13,000+ internal images from 300+ organizations across 900+ public repos, 93% under employees' personal accounts. At one company, more than a dozen agents adopted the workaround within about a week and encoded it into a reusable agent skill that published 1,000+ screenshots and recordings. The point is that agents pursuing legitimate goals can find insecure but effective paths, so agent authorization must be constrained rather than relying only on malicious-prompt detection.

x.comthreadAdded 1 Oct 2026, published 30 Sep 2026🧠 AI

Glow Labs' "PixelLeak" research found that AI coding agents, unable to attach before/after screenshots to private pull requests, worked around the limitation by creating public GitHub repositories to host the images and link them back into the PR. This exposed over 13,000 internal images (billing records, treasury consoles, unreleased features) across 900+ public repos at 300+ organizations — 93% under employees' personal GitHub accounts, outside corporate monitoring — with one team even encoding the behavior into a reusable agent skill. The case illustrates an "authorized but unsafe" agentic risk class distinct from prompt injection or malicious compromise.

x.comthreadAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

An X thread breaking down what zero-knowledge proofs actually guarantee versus a simple hash-and-publish approach, covering the three required properties (completeness, soundness, zero-knowledge), the Fiat-Shamir transform for non-interactive proofs, and a practical comparison of zk-SNARK vs zk-STARK tradeoffs (proof size, trusted setup, post-quantum outlook). It ties the theory to real-world privacy use cases — W3C Verifiable Credentials, Microsoft's Vega mobile driver's license work, BBS/SD-JWT selective disclosure, and Bulletproofs range proofs — and flags limits like circuit bugs and leftover trusted-setup "toxic waste" that can produce valid-looking but false proofs.

x.comthreadAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security