#software supply chain attack
174 related articles
·3 min
How GitHub Established Reliable Ownership for 14,000 Repositories in 45 Days
GitHub had over 14,000 internal repos with less than half having clear ownership. In 45 days, they verified ownership for every active repo through activity filtering, validation, and archiving.
Read more →
·3 min
Automating GitHub Releases: Design and Practice of a Tag-Triggered Release Action
A ten-year open source maintainer shares how to build a universal tag-to-release GitHub Action, covering its opinionated design philosophy, dogfooding validation, and AI-assisted development.
Read more →
·7 min
Enterprise AI Agent Security Isolation and Memory Design: NanoClaw Founder Breaks Down Real-World Lessons
NanoClaw founder David Boyd breaks down the core engineering of enterprise autonomous Agents: a triple security isolation model, LLM Wiki memory design, and the real-world path from personal Agents to team-scale deployment.
Read more →
·8 min
A Complete Guide to Agent Testing: Five Core Dimensions and Automation in Practice
In-depth analysis of the five core dimensions of AI Agent testing: command safety, tool-calling accuracy, task planning, output consistency, and error self-repair. Master automated testing and the transition path for test engineers.
Read more →
·8 min
The Complete Guide to Agent Testing: Five Core Dimensions and Automation in Practice
An in-depth analysis of the five core dimensions of AI Agent testing: command safety, tool-calling accuracy, task planning, output consistency, and error self-repair. Master automated testing methods and the transition path for test engineers.
Read more →
·5 min
China Weighs Restricting Top AI Model Exports, While DeepSeek Quietly Builds Its Own Inference Chip
China's Ministry of Commerce is weighing restrictions on overseas access to top open-weight AI models from Alibaba, ByteDance, and DeepSeek. Meanwhile, DeepSeek is quietly building its own inference chip and raising ~$7B in first external funding.
Read more →
·5 min
China Weighs Restricting Top AI Model Exports as DeepSeek Develops Its Own Inference Chip
China's Commerce Ministry weighs restricting overseas access to top open-weight AI models from Alibaba, ByteDance, and DeepSeek, while DeepSeek develops its own inference chip amid a US-China AI export standoff.
Read more →
·7 min
AI Daily: T-Head Open-Sources SAIL Software Stack at WAIC, Flurry of Large Model Releases
T-Head open-sources AI software stack T-Head SAIL at WAIC to lower the barrier for domestic chip development; Kimi K3 tops the WebDev leaderboard; Qwen 3.8 Max Preview cuts prices aggressively; Moonshot prepares a Hong Kong IPO; and Oracle switches its data center to a fuel cell microgrid.
Read more →
·6 min
The Boundaries of AI Coding: When Should You Show Yourself a Red Card?
As AI coding assistants like Codex become standard, the risks of overreliance grow too. Learn when developers should "show a red card," reclaim control, and safeguard code quality and responsibility.
Read more →
·2 min
Cursor 0-Day Vulnerability: Opening a Repository Silently Executes Malicious Code — Developers Beware
A critical 0-day in Cursor AI editor lets attackers execute code just by having you open a malicious Git repo. Learn how it works and how to protect yourself.
Read more →
·3 min
OWASP Agentic Security Top 10 Deep Dive: Understanding ASI01–ASI10 Risks and Mitigations
A comprehensive breakdown of the OWASP Agentic Security Top 10 framework, covering ASI01–ASI10 risks including goal hijacking, tool misuse, identity abuse, supply chain vulnerabilities, and cascading failures — with practical mitigations for AI agent systems.
Read more →
·3 min
DeepSeek and Zhipu Race to Build Custom AI Chips: China's Path to AI Compute Independence
DeepSeek seeks $7B for custom AI inference chips; Zhipu AI explores ASIC. Deep dive into China's AI compute independence strategy, multimodal generation, agents, and hardware trends.
Read more →
Tailscale SSH Critical Vulnerability T…
·2 min
Tailscale SSH Critical Vulnerability TS-2026-009: Restricted Users Can Escalate to Root
Tailscale discloses critical vulnerability TS-2026-009 in its built-in SSH feature. Insecure argument handling lets restricted users bypass ACLs and gain root. Learn the technical details and how to respond.
Read more →
·3 min
Codex Configuration Tutorials Examined: A Complete Risk Analysis of Third-Party API Keys
A deep analysis of popular Bilibili Codex "one-click setup" tutorials, covering third-party API key risks, unverified installer dangers, and the cost of "Full Allow" permissions — with safer alternatives.
Read more →
The Age of AI Agents: Why the Open Sou…
·2 min
The Age of AI Agents: Why the Open Source "Zero-Cost" Myth Is Collapsing
AI agents consume open source software at massive scale without contributing back, creating a sustainability crisis. Explore the hidden costs, maintenance imbalance, and security risks behind the "zero-cost" myth.
Read more →
·2 min
One ID Card Away from Hacking the FIFA World Cup: A Deep Dive into the Security Vulnerability
A security researcher found a critical auth flaw in FIFA World Cup systems using just one ID. Deep dive into attack surfaces, least privilege, and responsible disclosure.
Read more →
·2 min
GPT-Red: OpenAI's Internal Red-Team Security Tool That Uses AI to Attack Its Own Models
GPT-Red is OpenAI's internal red-team tool that auto-generates prompt-injection attacks against AI agents, turning successful attacks into training data to harden future GPT models.
Read more →
Smart Proxy: The Key Architecture for …
·3 min
Smart Proxy: The Key Architecture for Running AI Coding Agents Safely and Autonomously
Too much AI permission is risky; too little kills productivity. A smart proxy acts as a controllable middleware layer — intercepting, auditing, and policy-gating AI agent actions in tools like Claude Code and Cursor for safe autonomous operation.
Read more →
·4 min
China Moves to Tighten Exports of Top AI Models, Marking a Major Turning Point for Its Open-Source Strategy
Beijing is reportedly consulting with Alibaba, ByteDance, and Z.AI on tiered AI export controls that could affect open-weight models, while DeepSeek quietly builds its own inference chips.
Read more →
·3 min
Privacy Risks in Claude Code? Use Docker Sandboxes to Fully Isolate Your AI Coding Tools
Claude Code found to contain user monitoring logic, raising AI tool privacy concerns. Learn how to isolate Claude Code, Codex & Copilot with Docker Sandboxes — full setup and escape testing included.
Read more →