Anthropic said on March 6, 2026 that Claude Opus 4.6 uncovered 22 Firefox vulnerabilities in two weeks, including 14 high-severity issues, during a collaboration with Mozilla. The accompanying write-up argues that frontier models are becoming materially useful for real vulnerability discovery, not just benchmark performance.
A post in r/artificial amplified an Ars Technica report on LLM-driven deanonymization research, including results up to 68% recall and 90% precision across multiple social datasets.
Cloud Imperium Games disclosed that attackers accessed some backup systems on January 21, 2026, with exposure limited to basic account information. The company says no passwords or payment data were affected and that it has no current evidence of public data release.
A February 28, 2026 Hacker News thread discussed NanoClaw’s security model, emphasizing untrusted-agent assumptions, per-agent isolation, and limits of prompt-level safeguards.
OpenAI and Paradigm launched EVMbench, a benchmark for AI agent performance on smart contract detection, patching, and exploitation tasks. OpenAI reports GPT-5.3-Codex scored 72.2% in exploit mode versus 31.9% for GPT-5.
A high-ranking Hacker News thread amplified a Truffle Security report arguing that legacy Google API keys can become high-impact credentials when Gemini APIs are enabled. The post highlights exposure scale claims and concrete key-hardening steps.
OpenAI introduced EVMbench, a new benchmark measuring how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities in EVM-based blockchains.
A software engineer building a custom controller app for his DJI robot vacuum inadvertently discovered a backend security bug using an AI coding assistant that exposed live camera feeds, microphone audio, and floor maps from nearly 7,000 devices across 24 countries.
SecurityScorecard's STRIKE team found 40,214 OpenClaw AI agent instances exposed to the public internet with no authentication. Over 12,000 are vulnerable to Remote Code Execution, and attackers who compromise them inherit full system access including SSH keys, browser sessions, and filesystem control.
A highly discussed Hacker News post tracked Chrome’s security update for CVE-2026-2441 (High, CSS use-after-free). Google states an exploit exists in the wild and ships patched stable versions across desktop platforms.
A Docker guide on running NanoClaw inside a Shell Sandbox reached 102 points on Hacker News, highlighting a practical pattern for isolating agent runtime, limiting filesystem exposure, and keeping API keys out of the guest environment.
Researchers revealed how to bypass K-ID, Discord's age verification provider. They can generate legitimate-appearing metadata without actual biometric data, fooling the system.