AI
‘AI Agent just destroyed our production data and confessed in writing’, founder rings alarm bells
An AI agent powered by Anthropic’s Claude Opus 4.6 wiped out his company’s production database and backups on Railway using a routine access token.
The agent was working on a routine task and encountered a credential mismatch and decided, entirely on its own initiative, to “fix” the problem by deleting a Railway volume.
To execute the deletion, the agent went looking for an API token. It found one in a file completely unrelated to the task it was working on.
Stanford just dropped reseach paper called "Large Language Model Reasoning Failures"
The same task can produce different results if it is phrased differently.
The same reasoning with a slightly different structure leads to an unstable outcome.
Politics
‘A betrayal:’ California to share data on immigrant drivers nationally
California is preparing to share with an outside organization detailed information about driver’s license holders, including immigrants who do not have legal authorization to live in the U.S.
That breaks a promise the state made a decade ago when it began issuing licenses to unauthorized immigrants, advocates say, and it means more than 1 million people may face higher risk of deportation.
Elon Musk Says If You Plan In Retiring In 10-20 Years Don't Stress If You've Got Nothing Saved — 'It Won't Matter' Anyway
He believes artificial intelligence and robotics could drive such a surge in productivity that goods and services become widely abundant. In that world, traditional retirement planning loses relevance because basic needs are no longer tied to personal savings.
California’s 3D Printer Law Would Criminalize Open Source, Enshittify The 3D Printing Space
The proposed state laws require all 3D printers to include software that scans every print file through a “firearms blueprint detection algorithm” and then locks the hardware up so it refuses to print anything it flags as having the “geometry” of a potential firearm or firearm component.
Big manufacturers want to bring some of the shittier behaviors we’ve seen among large traditional printer manufacturers (disabling printer scanners when printers run out of ink, obnoxiously bricking printers that don’t use the manufacturer’s expensive cartridges) to the 3D printing space.
UK government says 100 countries have spyware that can hack people’s phones
The barrier to access this type of surveillance technology has fallen, potentially making it easier for foreign governments and hackers to target U.K. citizens, companies, and critical infrastructure with spyware.
National Science Board eviscerated; Trump admin fires all 22 members
Members had planned to release report that US is ceding scientific ground to China.
The NSF and the board were established by President Harry Truman in 1950.
Greece Moves to Ban Social Media Anonymity to Combat Online Toxicity
While the government believes the measure is necessary to protect public discourse, critics warn of significant technical and legal difficulties. Many digital rights groups argue that such a ban could impact freedom of speech.
Justice Department indicts former FBI Director James Comey for a second time
Over his 8647 photo
Infosec
Ongoing supply-chain attack 'explicitly targeting' security, dev tools
A very useful summary and timeline of the ongoing attack. On March 23, the Trivy vuln scanner was compromised, adding credential-stealing malware. That gave the attackers a lot of credentials, which they used to poison LiteLLM and Checkmarx products. They also poisoned Bitwarden.
"Attackers are deliberately targeting the tools developers are told to trust most: security scanners, password managers, and other high-privilege software wired directly into developer environments. This is why the fallout can get big very quickly."
TeamPCP Hijacks Bitwarden CLI, Uses Dependabot to Deploy Shai-Hulud Malware
The malware targets and poisons AI Assistants!
One ransomware crew now drives half of all cyber claims: At-Bay
Attackers are no longer hunting by industry, but by hardware.
Nearly three in four ransomware attacks, or 73%, began with a VPN in 2025 — a share that has almost doubled in two years.
SonicWall topped the list of most-targeted VPNs for the first time, linked to 27% of ransomware claims.
60% of Akira victims had a leading endpoint detection and response tool deployed, and were breached anyway. Only firms pairing EDR with round-the-clock managed detection and response escaped full encryption.
Copy Fail
Most Linux LPEs need a race window or a kernel-specific offset.
Copy Fail is a straight-line logic flaw — it needs neither.
The same 732-byte Python script roots every Linux distribution shipped since 2017.
An unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.
The Internet Changes Before the Advisory Drops
Surges of scanning precede atacks by several days.
Median lead time: 11 days. 49% of surges arrived within 10 days of disclosure. 78% within 21 days.
Extension Developers Sell The Data of At Least 6.5 Million Users – And It’s All Completely Legal
71% of all extensions in the Chrome Web Store don’t even publish a privacy policy. The QVI Empire: One Anonymous Publisher, 24 Extensions, 800,000 Users--they sell your viewing history, age, and gender.
OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years
Tracked as CVE-2026-35414 (CVSS score of 8.1), the flaw is described as a mishandling of the authorized_keys principals option in certain scenarios involving certificate authorities (CA) that use comma characters. If a certificate contains the principal deploy,root, OpenSSH splits the comma and enables full root access.
|