Keith Vaughan

The security sensitivity of sites like OpenRouter is insane; imagine the damage you could do by inserting shell commands into people's token streams or just logging and ransoming people's data. Who needs to poison model weights when you can implant yourself within inference providers

Cursor users: check your Claude Code extension. Cursor confirms a trojanized Anthropic.claude-code v2.1.313 in its extension marketplace on 29 October, 09:27 to 20:35 UTC. It estimates up to 5,000 affected users and identifies macOS ARM64 and Windows x64 builds. Loading the extension executes malicious code that collects host information and attempts to install a persistent SSH backdoor. Cursor says SSH access would fail on most hosts due to bugs and insufficient privileges. That limits remote access; it doesn’t undo malicious code execution. Credentials and repositories accessible to that account are potentially at risk. The package has been removed and the C2 taken offline. Uninstalling the extension may still leave persistence behind. If this version ran, investigate the host, remove persistence and rotate accessible credentials from a clean system. Updating the extension alone doesn’t prove the machine is clean. The vendor-confirmed distribution channel is Cursor’s marketplace. Microsoft VS Code uses a separate store. These reports don’t establish a compromised Microsoft Marketplace or malicious npm release. My recommendation: turn off automatic extension updates completely - for yourself and for your developers. With supply chain attacks like this, I don’t think the benefit of another feature or a minor UI fix justifies automatically accepting every new release onto developer machines. Update manually when something stops working, when a bug is actually getting in your way, or when a relevant security fix needs to be applied. Otherwise, leave a working extension alone. Cursor advisory and cleanup instructions: cursor.com/blog/claude-code-… Technical analysis: opensourcemalware.com/blog/t…

This is INSANE. Cisco’s president Jeetu Patel has given a 27-year-old engineer unlimited AI tokens to try to rewrite 98% of the company’s legacy code within 24 months, Fortune reports. Padmanabhan Krishnamurthy thinks he can do it with a two-person team. He has just four weeks to prove the approach.

This is crazy. Hang on tight folks

Week two of the instagram experiment. Finally blew above 100 followers and had a video approach 10k. The video felt too simple, but I guess that’s the signal. #AISecurity

Introducing 'stripe pay', for instant business-to-business transfers. Find companies using their Stripe profile handle and send funds for free. Available in the Dashboard and CLI.

Wow! Big news today! Soon Discord messages will be indexable on Google. If you're in a public Discord which is discoverable, and has not changed its privacy settings, any messages posted moving forward can be found from search engines! Hooray!!!!!1 (I think this is very bad)

The biggest mistake tourists make in Japan is dragging a fifty-pound suitcase up and down subway stairs. Watch how Japanese travelers board the bullet train. They walk on with a cup of green tea, a small shoulder bag, and both hands free. Where is their luggage? It is already in the next city, waiting for them. In Japan, the system is called Takkyubin, recognizable everywhere by a logo of a mother black cat carrying her kitten gently in her mouth. When you check out of your hotel in Tokyo at eight in the morning, you hand your heavy suitcase to the front desk, fill out a tiny slip, and pay about twenty dollars. You can even send it straight from the corner convenience store. Then you spend the entire day wandering through mountain temples or eating street food with nothing on your back. When you walk into your traditional inn in Kyoto that evening, your suitcase is already standing neatly in your room, wiped clean, with the handle turned toward you. In fifty years of handling millions of bags a year, lost luggage is virtually unheard of. A society runs smoothly when you can hand your belongings to a stranger at a convenience store and know they will beat you to your hotel.

People say hosting a foreign open-weight model on sovereign compute is safe. This is an example it's not. Sovereign compute controls where a model runs, not what it does.

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected. Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions. Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent. But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models? We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem. Read the full report: cohere.com/blog/concerning-b…