What Would You Do If Your Employer Could Destroy the World?
Exit interviews with defectors from OpenAI, Anthropic, and DeepMind.
security
Why mathematicians are hiding research results in zero-knowledge proofs
Google made a major breakthrough in quantum computing. To prevent the results from being misused, the company kept them secret. That backfired
A Researcher Buys 6TB Of Anthropic Claude Data Dump From A China-Based LLM Router, Finds Enough Ammo To Hack Xiaomi, Huawei, And Chinese…
Anthropic Claude's routing logs held SSH keys, VPN configs, and cloud API tokens that developers unknowingly paste into AI prompts.
Next generation AI attack vectors will be ideas, say Anthropic researchers
Computer scientists have bred self-propagating "mind viruses" that spread from one AI agent to the next through ordinary conversation — no hacking required
You Probably Don’t Get Why Stripe Bought OpenRouter — Research — AMP PBC
Stripe's purchase of OpenRouter has been read as a routing or billing acquisition. We argue it's a strategic security decision, and that this is net positive for the ecosystem.
AI Is Solving CTF Challenges in Minutes — What This Means for Cybersecurity Training
Something happened at [BSidesSF](https://bsidessf.org/) 2026 that nobody saw coming. The top ten teams in the Capture The Flag competition didn't just use AI to...
DarkReasoning: A Chinese LLM attacked our lab, so we made it work for us | Jesta
The model behind the attack was DeepSeek, deepseek-v4-flash-free, running on the free tier. An autonomous AI broke into our lab and worked it for five days, and it left its own name in a script. This is the first time the model behind a live attack has been identified from…
Tailscale in the Hugging Face intrusion: The good news and the bad news
An AI agent escaped its sandbox, entered Hugging Face’s infrastructure, and used a stolen Tailscale credential to enroll 181 nodes onto their tailnet. No Tailscale vulnerability was found or exploited—we should have been able to prevent it anyway.
Visa used Mythos to hunt for bugs in its own payment network, then open-sourced the harness that made it possible
Rajat Taneja explains why Visa open-sourced the AI harness that found critical bugs in its payment network, and the new metric it built to verify fixes work.
Encryption, spyware, and now Mythos: History shows why cyber export control doesn't work | TechCrunch
For the last 30 years, stopping the flow of cybersecurity-related software has proven to be ineffective. It's unclear why it would work now with Anthropic’s cybersecurity model Mythos.
How to Use OpenSSL: Generate Keys, Certificates, and Test TLS
Practical OpenSSL guide for Linux: generate private keys, create CSRs and self-signed certificates, convert formats, inspect certificates, and test TLS connections.
Ethereum Founder Vitalik Buterin Says AI Verification Could Help Secure Crypto Networks
Vitalik Buterin said mathematically verified software may help protect cryptographic infrastructures as AI improves both code generation and vulnerability discovery.
Project Glasswing: what Mythos showed us
In recent weeks, we pointed Mythos and other security-focused LLMs at live code across critical parts of our infrastructure. We share what we observed, the models’ strengths and weaknesses, and what the work around them needs to look like before any of it can scale.
What every dev should know about AI sandboxes
An important primitive for the new "AI agent era"
https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities
The Hidden Security Risks Lurking Inside Container Images - Dataconomy
Container images are meant to simplify everything. You grab one, start it and your application starts running. There should be
How to Build Advanced Cybersecurity AI Agents with CAI Using Tools, Guardrails, Handoffs, and Multi-Agent Workflows
The Illustrated TLS 1.2 Connection
Every byte of a TLS connection explained and reproduced
We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them - Quesma Blog
BinaryAudit benchmarks AI agents using Ghidra to find backdoors in compiled binaries of real open-source servers, proxies, and network infrastructure.
We were surprised that today’s AI agents can detect some hidden backdoors in binaries. We hadn’t expected them to possess such specialized reverse engineering capabilities. However, this approach is not ready for production. Even the best model, Claude Opus 4.6, found relatively obvious backdoors…
The dangers of SSL certificates
Yesterday, the Bazel team at Google did not have a very Merry Boxing Day. An SSL certificate expired for and as shown in this screenshot from the github issue. This expired certificate apparently b…
A Brief History of NSA Backdoors.
An Illustrated Guide to OAuth
OAuth was first introduced in 2007.
The Secret History of Tor: How a Military Project Became a Lifeline for Privacy
A story of secrecy, resistance, and the fight for digital freedom.
The “S” in MCP Stands for Security - Elena Cross - Medium
MCP, short for Model Context Protocol, is the hot new standard behind how Large Language Models (LLMs) like Claude, GPT, or Cursor integrate with tools and data. It’s been described as the “USB-C for…
Year in Review: Containers Get Smaller, Faster, More Secure
Containers were a revolutionary jump ahead of virtual machines, and they continue to get faster, lighter and more secure in the years since.
Experts say Telegram’s ’30 engineers’ team is a security red flag
Telegram's founder Pavel Durov says his company only employs around 30 engineers. Security experts say that raises serious questions about the company's cybersecurity.
“Downfall” bug affects years of Intel CPUs, can leak encryption keys and mo
Researchers also disclosed a separate bug called “Inception” for newer AMD CPUs.
Downfall Attacks
Downfall attacks targets a critical weakness found in billions of modern processors used in personal and cloud computers.
Tokenized Tokens
Documentation and guides from the team at Fly.io.
The Power of Browser Fingerprinting: Personalized UX, Fraud Detection, and
Discover the power of browser fingerprinting: personalize user experience, enhance fraud detection, and optimize login security.
Free the internet from mass surveillance. With the Mullvad Browser.
The Mullvad Browser is a privacy-focused web browser developed in collaboration between Mullvad VPN and the Tor Project. It’s produced to minimize tracking and fingerprinting. You could say it’s a Tor Browser to use without the Tor Network.
Breaking RSA with a Quantum Computer - Schneier on Security
Security Best Practices for Your Rails Application
Ensure your Rails application stays secure by following some best practices and habits.
gchq/CyberChef: The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis - gchq/CyberChef
Router Security
Router Security Home Page
CSRF, XXE, and 12 Other Security Acronyms Explained
Acronyms are shortcuts, and we love using them, specially the catchy ones! Let's decipher some...
Why trusted execution environments will be integral to proof-of-stake block
While the core philosophy of blockchains is trustlessness, trusted execution environments can be integral to proof-of-stake blockchains.
Browser-in-the-Browser Attack Can Trick Even Savvy Users
Intelligent System Security
We present a novel approach to infiltrate data to air-gapped systems without any additional hardware on-site.
Top 10 web hacking techniques of 2021 | PortSwigger Research
Welcome to the Top 10 (new) Web Hacking Techniques of 2021, the latest iteration of our annual community-powered effort to identify the most significant web security research released in the last year
Security Risks On Rails: Misconfiguration and Unsafe Integrations
This article was originally written by Diogo Souza on the Honeybadger Developer Blog. In the third...
Never use the word “User” in your code
You’re six months into a project when you realize a tiny, simple assumption you made at the start was completely wrong. And now you need to fix the problem while keeping the existing system running—with far more effort than it would’ve taken if you’d just gotten it right in the…
gitleaks/gitleaks: Protect and discover secrets using Gitleaks 🔑
Protect and discover secrets using Gitleaks 🔑.
https://simplesecurity.sensedeep.com/web-developer-security-checklist-f2e4f43c9c56
Hacksplaining
https://httpsecurityreport.com/best_practice.html
The Basics of Web Application Security
Security is both very important and often under-emphasized. While many targeted techniques help, there are some basic clean code habits which every developer can and should be doing
My First 10 Minutes On a Server - Primer for Securing Ubuntu | Codelitt
How to secure an ubuntu server against attacks.
Hacker lexicon: What is a supply chain attack?
From NotPetya to SolarWinds, it’s a problem that’s not going away any time soon.
Diffie-Hellman for the Layman
Whitfield Diffie and Martin Hellman are researchers who invented a safe method to communicate a password. Their 1976 paper opens with the…