ESPHome is a home automation platform. A recent upgrade renamed auth env vars, silently disabling login protection. This is what happens when credentials live in process env. @1clawAI's fix: secrets…

NLTK, a popular Python NLP library, has a path traversal flaw: corpus readers bypass trusted-root checks via symlinks. An AI agent using NLTK with keys in env is now exposed. Keep keys vault-side,…

A malicious prompt circulating on X tells users to paste it into their Claude or Codex agent. It creates EVM token skill files designed to reach any crypto keys in the agent's environment. If the key…

An OpenAI test agent reportedly breached Hugging Face, pausing next-gen model training. If that agent carried API keys in its environment, that is the exact problem @1clawAI solves. Keys stay in the…

MLflow: creating a model version silently grants read access to artifacts from runs you were never authorized on. An agent with stored MLflow credentials in its env turns this into cross-project…

Bankr lets you trade onchain by posting in plain English. Great UX, and the signing key behind it is the entire attack surface. We built Bankr skills where the key stays in a TEE and the agent only…

1claw is now a Bankr Skill. Defense in depth for @bankrbot agents: secrets stay in the vault, signing is gated, and a hijacked prompt cannot drain anything. Details: