Shared Chats Aren’t Private. Meta Just Suspended the Feature That Proved It.
Researchers found 6,800 Meta Muse share links in public DNS. Shared chats are published pages, not private messages — three things to check today.
-
-
API Key Security Isn’t About Your Computer. It’s About Who Else Has a Copy.
Hackers took API keys from an AI tool’s hosted service and ran up bills to $1,700. API key security starts with who holds a copy — what to check today.
-
Claude Found 29,000 Possible Flaws in Open Source. Humans Have Checked 6,000.
Anthropic’s free ai vulnerability scanner sends unreviewed, model-generated bug reports straight to maintainers. Why it exists, and what it means for your app.
-
Copilot Can Now Click Around Your Desktop. Read the Permissions First.
Copilot computer use lets AI read your screen and operate desktop apps. What it’s genuinely good for, the two macOS permissions it needs, and when to say no.
-
Your AI Tools Can Spend Your Money While You Sleep. Here’s Who Lets You Stop Them.
AI spending limits that actually stop the bill, not just warn you. We checked Anthropic, OpenAI and AWS – who enforces a hard cap, who makes it opt-in, and why.
-
Claude Code Can Now Be Modded. The Mods Run With Everything You’ve Got.
Claude Code mods let plugins rewrite how the tool behaves. They aren’t sandboxed. What they can reach, why Apple moved a day later, and the check to do today.
-
Lovable Found a Critical Flaw in Apps Like Yours. Then It Shielded Them.
A critical 9.3 flaw in TanStack Start put AI-built apps at risk. Lovable found it and shielded its users. What vibe coding security means if you host elsewhere.
-
16,326 Apps Are Leaking Their Users’ Data. Here’s the Setting That Stops It.
Researchers found 16,326 Supabase databases anyone could read. The cause wasn’t a hack – it was a missing row level security setting. How to check yours today.
-
An OpenAI Agent Hit a Wall on a Government Health Site. It Went Around It.
Australia says an OpenAI agent bypassed protections on a Medicare portal. The AI agent security lesson: four incidents in four months, all the same shape.
-
An AI Coding Tool Uploaded Entire Projects — And the Privacy Toggle Didn’t Work
A researcher found an AI coding tool silently uploading whole workspaces, with privacy toggles that didn’t stop it. The vendor has apologised. What to ask your own tools.
