Pinned Tweet
🚨BREAKING NEWS : Your AI assistant has a second job. You’re the subject.
Anthropic says that after every reply, a hidden prompt asks Claude to “reflect on the safety of this conversation.”
It produces a JSON assessment: harmful or not, what kind, whether it refused, and how urgent the case is.
Reported detection rates:
→ 78% of harmful conversations
→ 94% of the most severe cases
→ under 2% additional compute
Since June, the system flagged one API customer more than 100,000 times for child sexual abuse material. It also flagged an automated romance scam built with Claude Code.
But roughly a third of flags didn’t fit an existing category.
That doesn’t mean they were all new threats. It means the categories didn’t cover everything the system was flagging.
Catching abuse is the point. The question for everyone else is what happens when the system gets it wrong.
Who reviews the flag—and can you challenge it?
We’ve trained Claude to flag potential misuse in conversations, a technique we call self-assessment. Right after it responds, Claude gives a preliminary safety assessment of the conversation.
Since we began using self-assessment in June, it has surfaced misuse that our other safeguards weren’t designed to catch.
Because Claude has already read the conversation, self-assessment is very efficient. And unlike classifiers, which target a discrete set of harms, it draws on Claude’s own judgment, so it gets more accurate as our models improve.
Read more on our new Safeguards blog:
safeguards.anthropic.com/202…
🚨BREAKING:SERIOUSLY? AN AI HACKING TEAM GOT IN THROUGH KEYS NOBODY HAD ROTATED SINCE 2022?
A state hacking group reportedly deployed a team of AI agents against 200+ organizations.
Foreign ministries. A European prime minister’s office. Nineteen US companies across defense, nuclear and pharma.
Planner agents directed worker agents. They tried web apps, cloud systems, containers, Active Directory, mail and VPNs in parallel.
When one path failed, they switched to another.
One intrusion consumed roughly 1.4 billion input tokens.
The human gave the orders:
“Write a web shell.”
“Get the domain admin password.”
The agents worked through the attack paths.
9 confirmed breaches.
And one way in involved auth keys left unchanged since 2022.
The attackers upgraded their tools.
Someone hadn’t even changed the keys.
🚨 Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide.
CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware.
AI agents ran parallel attack paths under human direction.
Full story: thehackernews.com/2026/10/ch…
Source: CrowdStrike via The Hacker News thehackernews.com/2026/10/ch… · group: Vapor Panda (Earth Estries) · models: DeepSeek + an unnamed commercial LLM
‼️ URGENT: WHAT THE F*CK DID YOU JUST INSTALL? THAT'S NOT CLAUDE.
A fake Claude Code extension (v2.1.313) reportedly sat in Cursor's marketplace for 11 hours. Up to 5,000 developers got it.
It didn't just run inside your editor.
→ planted an SSH key labeled "svc-telemetry"
→ added a startup script that tried to open a tunnel to the attacker roughly every minute
→ sent out the names of credential-related environment variables, not necessarily their values
And here's the nasty part: uninstalling may leave the backdoor behind.
The SSH key and startup scripts live outside the extension. Updating it doesn't undo those changes either.
If you installed or updated to 2.1.313, check:
~/.ssh/authorized_keys → "svc-telemetry"
Finding it is a warning sign. Not finding it isn't an all-clear.
You can delete the extension.
Don't assume you deleted the attacker's access.
‼️ WARNING: Updating the poisoned Claude Code extension won't remove its backdoor, Kevin Beaumont says.
Cursor, which served the bad build to up to 5,000 users, warns that even uninstalling it may not be enough.
The backdoor never lived only in the extension. On loading, it planted the attacker's SSH key and its own startup scripts, which keep trying to open a tunnel to the attacker every 60 seconds or so.
An update swaps the extension's files but leaves the key and the scripts in place.
Source: BleepingComputer bleepingcomputer.com/news/se… · version 2.1.313, Cursor Marketplace only
Source: Anthropic Safeguards blog, "Scaling Misuse Detection with Self-Assessment" safeguards.anthropic.com/202…
$59.7 million. Used. No returns.
Welcome to the AI hardware cycle.
in 2020, the A100 was Nvidia’s flagship AI chip.
now there’s an eBay listing for 9,600 of them.
300 racks. decommissioned from a hyperscaler cloud, according to the seller.
$59.7M is the asking price. “or best offer.”
being on eBay doesn’t make them useless. but it does put a different frame around today’s AI spending boom.
the question isn't whether today's AI chips will end up on eBay.
it's whether they'll earn back their cost before they do.
Source: Tom's Hardware — 9,600 A100s, 4,200 EPYC CPUs, listed by Core 4 Solutions tomshardware.com/desktops/se…
PHP2Shell just got its first real body count.
attackers scanned ~19,000 firewalls. narrowed it to 240. got root on 25.
PHP bug for the way in, a Linux kernel bug for root. under 15 minutes per box.
three of them sat in a US government-affiliated network. from there: Active Directory.
and on the attackers' own machines, researchers found Claude Code.
no proof AI wrote the exploits. but it was on the workbench.
‼️ Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers
Details: cybersecuritynews.com/php2sh…
Hackers combined PHP2Shell vulnerabilities with a Linux kernel exploit to gain root access on 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a US government-affiliated environment. Dream researchers uncovered the campaign’s files on October 25, revealing a path from exposed firewall management interfaces to internal Active Directory services.
The attack paired PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege escalation flaw tracked as CVE-2026-46300.
Dream described the PHP2Shell code as a custom, nonpublic implementation tailored to the targeted firewall platform, rather than a copy of a known public exploit. The full chain reportedly installed a root webshell in under 15 minutes.
#cybersecuritynews
Source: Dream research via Cyber Security News cybersecuritynews.com/php2sh… · Fragnesia (CVE-2026-46300) added to CISA KEV Oct 28
🆘Node2Shell. Broccoli2Shell. HTTP2Shell.
three names. one Brotli bug. CISA says it's being exploited.
and it's not just a Node problem anymore. anything that decodes Brotli with a vulnerable library is in scope. Microsoft already pushed emergency .NET patches.
the step everyone skips:
→ update
→ restart the process
→ rebuild and redeploy your container images
a patched host doesn't fix the old Node binary baked into last month's image.
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
bleepingcomputer.com/news/se…
Source: BleepingComputer bleepingcomputer.com/news/se…
Your Node version is someone else’s attack plan.
The exploit targets one exact build. Once attackers figure it out, they can try the same approach against other servers running it.
They do the hard part once.
Your unpatched server gives them another target.
That’s what makes 24.22.0 worth checking now.
→ Run node -v
→ Update to a patched release: 22.23.4 / 24.22.1 / 26.12.1 or newer in your release line
→ Restart your processes
→ Using Express 5? Check whether your body parsers accept Brotli-compressed requests. That can expose the vulnerable decoder.
The first reported attempt on Oct 26 failed.
That’s time to patch. Not a reason to wait.
Your sprint schedule isn’t theirs.
🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.
Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.
Patch now → 22.23.4 / 24.22.1 / 26.12.1
Read ↓ thehackernews.com/2026/10/re…
19 seconds. that's how long it takes to not get hit by the Brotli bug.
it's now on CISA's known exploited list.
→ node -v. need 22.23.4 / 24.22.1 / 26.12.1+
→ pip show brotli. need 1.2.1+
→ bun -v. need 1.4.4+
CISA gave US federal agencies until Nov 10. don't wait that long.
NO WAY. that Brotli bug from my post earlier is now rated 9.2 out of 10.
Google's own CVE record calls it CRITICAL (CVE-2026-111497).
→ affected: Brotli 1.0.3 through 1.2.0
→ fixed: 1.0.10, 1.1.1, 1.2.1
→ Node.js: 22.23.4, 24.22.1, 26.12.1
→ Bun: 1.4.4
anything that unpacks Brotli from strangers can be hit with no login. update, then restart.
Source (CISA KEV catalog): cisa.gov/known-exploited-vul…
AI didn't fire the team.
The team never got hired.
That's the interesting part of the Mithril story.
One founder. Eleven outside labs. Claude handling the contracts, logistics and experiment coordination.
Idea to promising results in mice in under 18 months.
The labs still ran the experiments. The mice still had to respond. AI didn't make biology optional.
It helped one person manage a much bigger operation.
The acquisition price wasn't disclosed. The results are still preclinical. There's no approved drug here.
But "how many people do I need to hire?" is starting to have a very different answer.
source: anthropic.com/research/early… honest question for founders: would you rather hire your first 5 people, or spend that money on outside labs and run it like this?
ChatGPT, Gemini, Grok, Claude. only one stays. which?
The AI race in late 2026 isn't about who's smartest anymore.
It's about who you trust with your day.
Two years ago, the question was simple: which chatbot gives the best answer?
Today the four biggest players are building completely different products. Picking one says more about how you work than about which model tops a benchmark this week.
━━━━━━━━━━
ChatGPT: the default.
OpenAI still has the biggest user base by a wide margin, and GPT-6 shows where it's heading.
Answers aren't just text anymore. ChatGPT now builds charts, clickable controls, calculators and maps right inside the response.
The strategy is clear: become the place where people start everything, the way Google became the place where people search.
The weakness is the same as the strength. When you try to be everything for everyone, you're rarely the best at one thing.
━━━━━━━━━━
Gemini: the ecosystem play.
Google doesn't need Gemini to be the best chatbot. It needs Gemini inside Search, Android, Gmail, Docs and YouTube.
It's already there. Nobody else has that distribution.
But Google just showed the other side of that power. This month, free users got limited to Flash-Lite, and AI Plus subscribers lost Gemini Pro.
The message: the best Gemini is for paying customers. That could push people to upgrade, or straight to a competitor.
━━━━━━━━━━
Grok: the outsider.
Its edge is real-time access to X and a personality that's less filtered than the rest.
xAI ships fast too: Grok 4.5, 4.6 and 4.7 in one year.
But the flagship keeps slipping. Grok 5 was supposed to land in late 2025, and Musk called it a possible AGI. It still hasn't shipped.
Grok's whole brand is bold promises. At some point, the promises have to land.
━━━━━━━━━━
Claude: the builder's tool.
Anthropic went after the people who build things: developers, analysts, teams doing real work.
Claude became the go-to model for coding and agents. Anthropic says Claude now writes about 90% of the code behind Claude Code, its own coding tool.
This month it also opened its document, slide and design tools to every plan, including free.
The bet: the AI that actually does the work wins the people who pay for it.
━━━━━━━━━━
So who's winning? Depends on what you count.
→ ChatGPT wins on reach
→ Gemini wins on distribution
→ Grok wins on speed and attitude
→ Claude wins with people who build
The race isn't heading toward one winner. It's splitting into four answers to one question:
what is an AI assistant actually for?
So, if only one stays on your phone, which one is it, and why?
You patched Node.js. cool. now what about the files?
the Brotli bug from my last post goes way past web traffic:
→ FFmpeg: reachable through a crafted JPEG XL image
→ Apache Arrow: still bundles Brotli 1.0.9. no fix yet
→ ClickHouse: one ~23 MB request can crash the server
→ .NET: patched in 8.0.33, 9.0.22, 10.0.14
python folks: if brotli or brotlicffi is installed, requests and httpx decode it for you. don't count on Dependabot to flag it.
blocking br at the edge won't cover a file. update the library, and everything that bundles it.
NO WAY. that Brotli bug from my post earlier is now rated 9.2 out of 10.
Google's own CVE record calls it CRITICAL (CVE-2026-111497).
→ affected: Brotli 1.0.3 through 1.2.0
→ fixed: 1.0.10, 1.1.1, 1.2.1
→ Node.js: 22.23.4, 24.22.1, 26.12.1
→ Bun: 1.4.4
anything that unpacks Brotli from strangers can be hit with no login. update, then restart.