Loading today’s stories
Moving now
Topics moving unusually fast against their own baseline right now — ranked by how surprising the pace is and how many independent publishers carry it, never by raw volume.
Loading TrendingMoving now
Topics moving unusually fast against their own baseline right now — ranked by how surprising the pace is and how many independent publishers carry it, never by raw volume.
12 stories10 publishersBuild, Invest, Product, Science, Securityin the last hour
Browser extensions update themselves silently unless new permissions are requested. Socket says it is now watching every version of every add-on in Mozilla's directory.
Compiling any project that resolved the poisoned crate on August 20 was enough to run a credential stealer. Wiz links the infrastructure to DPRK-attributed campaigns.
The cheapest way to run code on a developer's machine now needs approval. Checkmarx expects attackers to move to runtime, and developers to start rubber-stamping the prompt.
The Rust Security Response Team deleted proc-macro1 and arrayref 0.3.10 on August 20 after a build script fetched and launched a binary. The lure was a yank warning.
An undisclosed pay-to-continue prompt appears at the moment of lockout, and the weekly cap it lifts is never shown to users as a number they could plan around.
All Inference economics and take rates coverageBlock open-sourced the desktop app its own teams use to drive agents. The design claim underneath it is that active context should be inspectable, not archaeology in a prompt log.
Salesforce says builds, tests and reviews validate the diff, not the requirement. Its answer was a specification gate upstream of the code, plus a rule about which questions agents may answer.
OpenAI is rolling browser and app control out to customers while Anthropic pushes Claude Cowork. The open question is not capability but which credentials the software gets, and who reviews the log.
Browser extensions update themselves silently unless new permissions are requested. Socket says it is now watching every version of every add-on in Mozilla's directory.
All Crypto Wallet Credential Theft coverageThe Spirit Airlines bankruptcy auction put a price on a defunct company's internal records. The union's objection shows the scrubbing standard was written for customers, not staff.
Micro1's late $12.5 million topping bid for Spirit Airlines' internal records puts a number on operational archives. Every company with decades of email now has a valuation problem and a consent problem.
A bankruptcy judge delayed Google's $10 million purchase of Spirit Airlines' internal data after flight attendants argued de-identification preserves everything that made the records sensitive.
Browser extensions update themselves silently unless new permissions are requested. Socket says it is now watching every version of every add-on in Mozilla's directory.
All Browser Extension Security coverageCompiling any project that resolved the poisoned crate on August 20 was enough to run a credential stealer. Wiz links the infrastructure to DPRK-attributed campaigns.
All Build-Time Code Execution coverageAn undisclosed pay-to-continue prompt appears at the moment of lockout, and the weekly cap it lifts is never shown to users as a number they could plan around.
All AI Cost Governance coverageNo settlement, no money, no fees. Runlayer's year-long design partner released a rival MCP gateway the same night the litigation ended, and that is the lesson for founders.
Adversa AI says a hostile page can ship its instructions as AES ciphertext, have Grok decrypt them in its own Python runtime, and then exfiltrate session data via a URL fetch.
Adversa says it hid data-exfiltration instructions in AES-256-GCM ciphertext and let Grok decrypt them in its own Python sandbox. The plaintext version of the same attack was refused.
Magic Capture records two minutes of deliberately mediocre video and hands back 12-megapixel stills. What it spends that quality on is a choice users no longer have to make.
All On-device AI features coverageMore than half of Americans under 30 say they are more concerned than excited about AI, and one survey suggests different messaging barely moves that. Plan around it.
All Public opinion on AI coverageThe Spirit Airlines bankruptcy auction put a price on a defunct company's internal records. The union's objection shows the scrubbing standard was written for customers, not staff.
All AI Training Data Sourcing coverageThe maintainer removed holistic "looks good" verdicts, moved planning to a separate cheap model, and left the gate closed when verification cannot run. Breaking for embedders.
A multiyear alliance targets $1 billion in joint business by 2029. The ratio it is built to sell into is the part most security teams cannot yet enumerate.