#dependency vulnerability
127 related articles
·6 min
GPT-5.6 Three-Model Launch: Soul/Terra/Luna Tiered Strategy and the AI National Security Game
OpenAI previews the GPT-5.6 series — Soul, Terra, and Luna — with a massive 1.5M-token context. In-depth analysis of coding leaps, the Fable 5 national security game, the heating U.S.-China AI race, and workflow economics.
Read more →
·7 min
In-Depth Analysis of the GitLost Vulnerability: How GitHub AI Agents Were Tricked into Leaking Private Repositories
Security researchers disclose the GitLost attack, which uses prompt injection to trick GitHub AI agents into leaking private repository source code. An in-depth analysis of the attack principle, AI agent security risks, and developer defense recommendations.
Read more →
·7 min
Rowboat: An Open-Source, Local-First Alternative to Claude Desktop
Rowboat is an open-source, local-first AI desktop client positioned as a Claude Desktop alternative. Local data storage and fully transparent code help developers control privacy and workflows.
Read more →
·5 min
Git Hash Chain Malleability: How Fragile Is the Immutability You Trust?
Are Git hash chains truly immutable? This article dives into Git hash chain malleability, SHA-1 collision risks, and security boundaries, offering practical tips like GPG signing and SHA-256 migration to build a correct Git security trust model.
Read more →
·5 min
The Halo Open-Source Project: Building Tamper-Evident Runtime Evidence for AI Agents
Halo is an open-source tool providing tamper-evident runtime evidence for AI agents, recording every action via hash chains and cryptography to solve auditing, compliance, and accountability challenges.
Read more →
·7 min
Tripadvisor AI Summaries 'Whitewashing' Problematic Hotels? Essential Safety Concerns for Travelers
Tripadvisor's AI review summaries are generating positive assessments for hotels with safety hazards while downplaying critical warnings. Deep analysis of causes and practical user protection tips.
Read more →
·7 min
The Birth of Claude Code: Design Philosophy from Internal Tool to AI Programming Assistant
An in-depth look at Claude Code's development and design philosophy: why the CLI form, how the "minimal scaffolding" architecture works, and how it balances safety with autonomy in AI programming.
Read more →
·3 min
OpenAI's Official Plugin codex-plugin-cc: Calling Codex Inside Claude Code for Dual-AI Collaboration
OpenAI's open-source codex-plugin-cc plugin lets developers call Codex inside Claude Code for code review and task delegation. 22K+ GitHub stars signal AI coding's multi-model era.
Read more →
·6 min
GPT-5.6 Released: Three-Tier Soul/Terra/Luna Lineup, Orchestration Baked Into the Model
OpenAI releases the GPT-5.6 series with Soul, Terra, and Luna models. Ranked first on Terminal Bench coding evaluation, Ultra mode natively bakes agent orchestration into the model, while revealing Agentic Trace data as the core competitiveness of next-gen AI training.
Read more →
·6 min
GPT-5.6 Hits 91.9% on Coding Benchmark: A Guide to Choosing Among Three Tiers and Avoiding Ultra Mode Pitfalls
GPT-5.6 launches Soul/Terra/Luna, with flagship Soul scoring 91.9% on Terminal Bench 2.1. This article breaks down the Ultra vs Max reasoning modes, three-tier pricing, and four hidden pitfalls to guide your technical selection.
Read more →
·4 min
Alibaba Plans to Ban Claude Code: The Battle Between Backdoor Risks and Enterprise AI Security
Alibaba reportedly plans to ban Claude Code internally over backdoor and data leakage concerns. A deep dive into enterprise AI security, supply chain trust issues, and what it takes for AI tools to win enterprise adoption.
Read more →
·4 min
Ternlight: A 7MB Browser-Side Embedding Model for Server-Free Semantic Search
Ternlight is a 7MB WebAssembly-based browser-side text embedding model requiring no server or GPU. Explore its tech, use cases, and tradeoffs for private, offline semantic search.
Read more →
·5 min
Anthropic Updates Cybersecurity Safeguards: How AI Safety Governance Balances Security and Usability
Anthropic updates AI cybersecurity safeguards after U.S. government dialogue. New measures slightly raise false positive rates, with flagged requests downgraded to Opus 4.8 responses. Deep analysis of the security-usability balance in AI governance.
Read more →
·7 min
Apollo Chief Economist Warns: AI Assets May Face Painful Repricing
Apollo's chief economist warns that current AI-related asset valuations may have severely detached from fundamentals, risking a painful systemic repricing.
Read more →
·7 min
Exfiltrating Data from Air-Gapped Systems via Apple's Find My Network: Attack Mechanics and Defense Insights
Security research reveals how attackers can abuse Apple's Find My network as a covert exfiltration channel, disguising sensitive data from air-gapped systems as location beacons. A deep dive into the attack chain, stealth advantages, and defense insights.
Read more →
·5 min
Tracking a Year-Long Crash Mystery: A Complete Investigation of Hardware Defects and an 18-Year-Old Open Source Bug
An engineering team spent a year tracing crashes to two root causes: a silent hardware defect and an 18-year-old open source bug. A deep dive into debugging methodology for distributed systems.
Read more →
Payload-Less Skills: The Hidden Supply…
·3 min
Payload-Less Skills: The Hidden Supply Chain Threat Targeting LLM Agents
Payload-Less Skills are a stealthy new attack targeting LLM agent supply chains — no malicious code required. Learn how they work and how to defend against them.
Read more →
·2 min
AI Coding Assistants Become New Attack Targets: DNS Covert Channels Used to Steal Developer Credentials
Researchers reveal attacks targeting AI coding assistants like Claude Code: malicious setup scripts use DNS covert channels to steal API keys, bypassing static scans.
Read more →
·4 min
Spotify's AI in Practice: How 3,000 Engineers Are Reinventing R&D with Agents
Spotify's real engineering story: 99% of engineers use AI coding tools, PR frequency up 76%, 2.5M automated maintenance PRs merged. How Honk, FleetShift, and Backstage work together to drive AI Agent adoption at scale.
Read more →
How OpenAI Used Core Dumps to Track Do…
·2 min
How OpenAI Used Core Dumps to Track Down an 18-Year-Old Bug
How OpenAI's engineering team used large-scale core dump analysis and an epidemiological approach to identify a hidden hardware fault and fix an 18-year-old software bug.
Read more →