#security

The FBI arrested a 21-year-old Florida resident after investigators alleged fake Steam-listed games infected about 8,000 PCs and helped steal at least $220,000 from roughly 80 crypto wallets.

GitHub’s security cleanup shows that the hard part is not finding secrets, but routing real risk to the right owners. The company says it cleared 20,000-plus alerts across 15,000 repositories in nine months.

OpenAI tied GPT-5.6 Sol’s new “The Last Ones” cyber-range result to Codex Security, a plugin meant to find, validate, and fix vulnerabilities in real repositories. The important comparison is controlled benchmark success versus code review work that security teams can actually run.

Dependabot will now wait until a new package release has been on its registry for at least three days before opening a version-update pull request. Security updates still open immediately, and teams can tune or opt out through cooldown configuration.

GitHub code scanning can now show AI-powered security detections directly on pull requests. The preview extends coverage beyond languages and frameworks supported by CodeQL, while requiring GitHub Code Security, a Copilot license, and AI credits.

An r/pcgaming post shared that Windows 10’s ESU program has been extended by one year, moving the security-update end date from October 2026 to October 12, 2027.

Coding agents need real execution rights to be useful, but handing them a local machine is uncomfortable. Clawk drew HN interest by moving that work into a disposable, network-restricted VM.

A public issue carrying hostile instructions became the evidence HN needed for a sharper debate about agent permissions.

The HN debate centered less on the marker itself than on hiding environment classification inside system context.

The community focused on a practical signal: an open-weight model beating Claude Code on an IDOR detection test.

Snyk VulnBench JS 1.0 repeated JavaScript vulnerability reviews 300 times to test whether LLM security findings recur. The best LLM setup reached 75.4% Snyk-reference F1, while 49.7% of unmatched model-only findings appeared in just one of five identical runs.

The security question for coding agents is broader than “do not read .env.” An open Codex issue and the HN thread dig into ignore rules, sandboxes, Unix permissions, and container boundaries.