ai spent all week finding bugs, nice to see it on defense for once
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
0
0
1
238
Tim retweeted
github with the worst timing ever
BREAKING: AI AGENTS ARE ACCESSING MAJOR U.S. BANK ACCOUNTS WITHOUT BANK APPROVAL.
According to Axios, JPMorgan, Bank of America, Wells Fargo and Morgan Stanley are dealing with unauthorized third party AI agents accessing customer accounts.
Some agents reportedly attempted tomers instructed them to do.
And this comes just one day after another shocking report that hackers reportedly used Claude, Grok and other AI models to automate attacks on over 400 financial targets across Latin America.
0
1
2
155
github with the worst timing ever
BREAKING: AI AGENTS ARE ACCESSING MAJOR U.S. BANK ACCOUNTS WITHOUT BANK APPROVAL.
According to Axios, JPMorgan, Bank of America, Wells Fargo and Morgan Stanley are dealing with unauthorized third party AI agents accessing customer accounts.
Some agents reportedly attempted tomers instructed them to do.
And this comes just one day after another shocking report that hackers reportedly used Claude, Grok and other AI models to automate attacks on over 400 financial targets across Latin America.
0
1
2
155
Local coding model 👀
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine.
• Best-in-class fast local coding
• Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark
• Built from hs
Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
0
0
1
99
There are a small number of companies proactively helping all of their users that I’ve seen today…Vercel and Cloudflare are goated
Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release.
All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.
0
0
0
65
10 CVEs…make sure you rebuild your docker images too
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulner…
#NodeJS #Security
0
0
0
34
This timeline is wild
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
0
0
0
20
Another banger
When our AI code reviewer's cost per run doubled, we dug into the token usage to find out why. Learn how we used prompt caching and intelligent model routing to slash our inference bill by 68% while speeding up reviews. cfl.re/4isj2NU
0
0
0
11
