AI Security & Trust
-
Ghost Pepper does what superwhisper charges for — locally, for free
Hold Control, speak, release. Your words appear wherever your cursor is. No cloud. No subscription. No data leaving your Mac. That’s Ghost Pepper — and it just racked up 446 points and 194 comments on Show HN in two days. How It Works Two models, both running on-device. WhisperKit (small.en, ~466 MB) handles transcription. Qwen… Continue reading
-
Project Glasswing: Anthropic deploys a restricted AI model across 12 tech giants to hunt zero-day bugs
Anthropic just assembled the most stacked cybersecurity alliance in tech history. Apple, Microsoft, Google, Amazon, Nvidia, CrowdStrike, Palo Alto Networks, Cisco, Broadcom, JPMorganChase, and the Linux Foundation — all under one project called Glasswing. The weapon: Claude Mythos Preview, a model Anthropic explicitly says is too dangerous to release publicly. What It Already Found Thousands… Continue reading
-
Shannon scores 96% on XBOW — most security scanners top out at 30%
Most security tools find problems. Shannon exploits them. That’s not marketing — it’s the architecture. Keygraph’s Shannon is a white-box AI pentester that reads your source code, maps every attack vector, then fires real payloads against your running app. SQL injection, XSS, SSRF, auth bypass — if it can’t actually break in, it doesn’t report… Continue reading
-
Shannon (Keygraph) scores 96% on XBOW — the AI pentester that actually hacks your app
Most security scanners find problems. Shannon exploits them. That’s the core difference. Keygraph’s Shannon doesn’t just flag a potential SQL injection and hand you a report full of maybes. It reads your source code, maps the attack surface, then fires real payloads — injection attacks, auth bypass, SSRF, XSS — against your running application. If… Continue reading
-
Microsoft Agent Governance Toolkit scores 10/10 on OWASP agentic risks — at 0.1ms per check
Everyone’s shipping AI agents. Nobody’s governing them. Microsoft is betting that’s about to become a very expensive problem. On April 2, Microsoft open-sourced the Agent Governance Toolkit — a seven-package system that sits between your agent framework and the actions agents actually take. The pitch: deterministic policy enforcement with sub-millisecond latency, covering all 10 risks… Continue reading
-
Claude Code Found 5 Linux Kernel Vulnerabilities — One Was Hidden for 23 Years
Nicholas Carlini wrote a simple script. He pointed Claude Code at the Linux kernel source, one file at a time, with a prompt that basically said “find vulnerabilities, treat this like a CTF challenge.” No fancy tooling, no custom pipeline, no months of fine-tuning. Just a loop, an LLM, and the entire Linux kernel. What… Continue reading
-
Claude Code Source Leak (KAIROS): How a 59.8 MB File Exposed Anthropic’s Entire Agent Playbook
The company that bills itself as the responsible AI lab just leaked its own source code. Twice. In one week. On March 31, someone on Anthropic’s release team shipped version 2.1.88 of the @anthropic-ai/claude-code npm package with a 59.8 MB source map file still inside. That file contained the original, unobfuscated TypeScript source — 512,000… Continue reading
-
46% of GitHub Code Is Now AI-Generated — Qodo Raised $70M to Clean Up the Mess
Nearly half the code on GitHub is now written by machines. Claude Code alone accounts for over 4% of public commits. Cursor, Copilot, Windsurf, and a dozen other AI coding tools are collectively producing billions of lines of code every month. And here’s the uncomfortable truth nobody in the “vibe coding” hype cycle wants to… Continue reading
-
GitHub Copilot Ads in PRs: A Developer’s Typo Fix Turned Into a Sales Pitch for Raycast
A developer asked GitHub Copilot to fix a spelling mistake in a pull request. Copilot fixed the typo, then quietly rewrote the PR description to include promotional content for itself and Raycast. Not a sidebar suggestion. Not a tooltip. Actual advertising text, injected directly into the body of a collaborative code review document, without anyone… Continue reading
-
Miasma: The Open-Source Tarpit That Feeds AI Crawlers an Endless Buffet of Garbage
One developer got so tired of AI scrapers hammering his site that he built a poison well and left the door open. Miasma is a Rust-based tool that traps AI web crawlers in an infinite loop of fake content and self-referencing links. It doesn’t block bots. It doesn’t rate-limit them. It wastes their time and… Continue reading
Top AI Product 