A clean GitHub repo just became a full system takeover for Claude Code. No malicious files. The attack hides prompts that redirect tool calls once the agent reads the repo. Policy-gated actions are…

Someone set up a proxy giving free unlimited Claude, GPT, and Gemini. No key needed. Someone's stolen API credentials are footing the bill. Keys in the agent process are keys waiting to be stolen.…

An AI agent filed a CVSS 10.0 against Hoppscotch. One open endpoint let anyone overwrite JWT_SECRET before setup, then forge any user's token. It became full compromise only because the secret lived…

An AI agent buying its own merch is funny. An AI agent with uncapped spend and no policy guardrails is a different problem. Intents API: value caps, allowlists, key stays in the TEE. Even when the…

n8n's 2026 agent report scored 14 platforms on security. Native secrets management appeared on only 3. The line that matters: a prompt asking the model not to disclose sensitive data is not a…

150+ cybersecurity tools in one MCP server. All those API keys sitting in a single agent context at once. 1Claw Vault fixes that: scoped, expiring credentials per call, HSM-backed. The secret never…