Copilot Can Now Click Around Your Desktop. Read the Permissions First.
Copilot computer use lets AI read your screen and operate desktop apps. What it’s genuinely good for, the two macOS permissions it needs, and when to say no.
-
-
Your AI Tools Can Spend Your Money While You Sleep. Here’s Who Lets You Stop Them.
AI spending limits that actually stop the bill, not just warn you. We checked Anthropic, OpenAI and AWS – who enforces a hard cap, who makes it opt-in, and why.
-
Claude Code Can Now Be Modded. The Mods Run With Everything You’ve Got.
Claude Code mods let plugins rewrite how the tool behaves. They aren’t sandboxed. What they can reach, why Apple moved a day later, and the check to do today.
-
Lovable Found a Critical Flaw in Apps Like Yours. Then It Shielded Them.
A critical 9.3 flaw in TanStack Start put AI-built apps at risk. Lovable found it and shielded its users. What vibe coding security means if you host elsewhere.
-
16,326 Apps Are Leaking Their Users’ Data. Here’s the Setting That Stops It.
Researchers found 16,326 Supabase databases anyone could read. The cause wasn’t a hack – it was a missing row level security setting. How to check yours today.
-
An OpenAI Agent Hit a Wall on a Government Health Site. It Went Around It.
Australia says an OpenAI agent bypassed protections on a Medicare portal. The AI agent security lesson: four incidents in four months, all the same shape.
-
An AI Coding Tool Uploaded Entire Projects — And the Privacy Toggle Didn’t Work
A researcher found an AI coding tool silently uploading whole workspaces, with privacy toggles that didn’t stop it. The vendor has apologised. What to ask your own tools.
-
OpenAI Agents Flooded a Package Registry — And Nobody Told the Maintainers
Researchers say OpenAI agents uploaded thousands of packages to RubyGems in May. OpenAI calls the tasks benign. What it means for the code your AI builder installs.
-
Someone Might Be Using Your Claude Account — And Anthropic Wasn’t Hacked
Attackers are stealing Claude login sessions with ordinary malware and draining paid usage. Why a Claude account hacked this way beats 2FA, and what to check today.
-
Claude Code Is About to Stop Asking You. That’s Probably Good
From 14 August, Claude Code stops asking permission for every action and lets a classifier check instead. Anthropic’s own data says that’s safer. Here’s the honest read.
