LIVE FEED
FIRST LOOK Anthropic Claude Launches Automated Attack Surface Reduction for Code // FIRST LOOK Anthropic Proposes AI Safety Bill with Model Block Powers // HIGH Rogue AI Agents Read Indian Org Data via Exposed Credentials // FIRST LOOK Microsoft Launches Guardian Agents to Monitor AI Agent Behaviour // FIRST LOOK NVIDIA Launches Nemotron 3.5 Super VL and Bolt Agent Models // FIRST LOOK Laminar YC S24 Launches flow-1 for AI Agent Trace Analysis // HIGH OpenCode Console Breach Exposes API Keys, Fuels AI Distillation Attack // CRITICAL AI Agent Army Used to Breach John Deere and SharkNinja // FIRST LOOK OpenAI Decisions API Brings Typed AI Triage to SOC Platforms // FIRST LOOK OpenAI, Meta and Google AI Agents Blocked by Major Web Services //
AI-CODING-TOOLS

Ai-Coding-Tools

3 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
OpenCode Console Breach Exposes API Keys, Fuels AI Distillation Attack

OpenCode Console Breach Exposes API Keys, Fuels AI Distillation Attack

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.2 TechCrunch AI

Attackers compromised OpenCode Console, an online platform for the open-source AI coding agent, stealing API keys belonging to approximately 1.4% of users and generating unauthorised charges across OpenAI, Anthropic, and Google AI accounts. The stolen keys were allegedly leveraged for large-scale model distillation — extracting model outputs at volume — though some analysts dispute this framing. The incident also exposed a critical defensive gap: AI safety filters blocked the very models defenders needed to analyse malicious code, underscoring the operational tension between content moderation and security response.

AI Coding Tools Leak Repos as RemControl Trojan Uses AI Dev

AI Coding Tools Leak Repos as RemControl Trojan Uses AI Dev

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.8 The Hacker News

Two distinct AI security concerns emerged this week: Z.ai's ZCode coding assistant was found silently exfiltrating users' local code repositories to Alibaba Cloud servers without consent, echoing a similar incident with SpaceXAI's Grok Build CLI. Separately, the RemControl Android banking trojan demonstrates AI-assisted malware development, with verbatim AI assistant responses embedded in live phishing pages served to banking victims across Western Europe, the Middle East, and Canada. Together, these incidents highlight the dual threat of AI tools as both accidental data exfiltration vectors and force multipliers for threat actors.

Bitwarden CLI npm Package Supply Chain Attack Steals Secrets

Bitwarden CLI npm Package Supply Chain Attack Steals Secrets

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 6.5 The Hacker News

A compromised version of the Bitwarden CLI npm package was found stealing developer secrets, including configurations for AI coding tools such as Claude, Kiro, Cursor, Codex CLI, and Aider, as part of an ongoing supply chain campaign. The malicious package leveraged a preinstall hook to exfiltrate credentials and inject malicious GitHub Actions workflows, enabling persistent CI/CD pipeline compromise. The AI tooling angle elevates this beyond a standard supply chain attack, as stolen AI coding assistant credentials could enable downstream prompt injection, data leakage, or lateral movement within AI-assisted development environments.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.