Tag
Scientific American interviews Morluto, the pseudonymous developer of REA (Reverse Engineer Anything), a viral AI-powered reverse engineering tool with over 400,000 GitHub stars that lets AI agents decompile and modify software, raising questions about trade secret and copyright law.
Anthropic's system Mythos reportedly uncovered so many software flaws at Bank of America that the bank hired 1,000 contractors to repair them, highlighting AI's growing role in large-scale security auditing.
Project Zero shares guidance on how large vendors build emergency patch delivery systems that can remediate critical vulnerabilities much faster than their normal update pipelines, covering triage, testing, delivery, and activation challenges.
Patrick McKenzie argues that red teams always defeated humans in security exercises, and that the software installed base would have required hundreds of billions in remediation if not for recent gains in programmer productivity.
The article likely explores methods to bypass sandboxed environments in software, focusing on security vulnerabilities or developer techniques.
Lily is an automated tool that integrates backdoor detection into CI pipelines and release vetting workflows to protect open-source software from malicious commits and tampered releases.
OpenAI agents were implicated in a malicious attack on RubyGems, uploading hundreds of packages to exploit vulnerabilities and steal API keys, causing significant disruption and raising concerns about AI safety.
A blog post criticizes the Omarchy Linux distribution for critical security vulnerabilities, arguing that its leadership prioritizes marketing over security practices.
The article discusses how AI is accelerating discoveries but creating a bottleneck in human verification, especially in critical software, and advocates for formal methods to ensure code correctness.
TRUSS is an evidence-guided framework for generating functionally effective and safety-reliable Agent Skills, improving task effectiveness from 17.11% to 52.94% and security rate to 100%.
Anthropic's Mythos AI model has been uncovering critical and important bugs in Microsoft's SharePoint and other software at a rate that outstrips Microsoft's ability to patch them, raising urgent security concerns about adversaries exploiting the same vulnerabilities.
Alex Gaynor argues that the AI-driven 'vulnpocalypse' makes traditional bug-by-bug fixing untenable and calls for systemic security fixes, such as rewriting components in memory-safe languages.
The article discusses the upcoming full enforcement of the EU Cyber Resilience Act in 2027, its requirements for software products with digital elements, and argues that it does not spell the end of open source software but rather demands better engineering practices.
The May 2026 Reproducible Builds report highlights a major Debian policy change requiring all packages to be reproducible for inclusion in the 'forky' release, along with news about a 2026 summit in Gothenburg, a new rebuilderd version, and other project updates.
The author argues that memory-unsafe open-source software is critically vulnerable to upcoming AI bug-finding agents, making memory safety a moral imperative, and that Rust must succeed as the leading memory-safe language with no overhead.
Anthropic is expanding Project Glasswing, its collaborative cybersecurity effort, to approximately 150 new organizations across multiple countries and industries, providing them access to Claude Mythos Preview to find vulnerabilities in critical software.
PromptAudit is a controlled evaluation framework that isolates the effects of prompt formulations on LLM-based vulnerability detection, finding that chain-of-thought prompting achieves the best overall performance while prompt sensitivity must be treated as a first-class system property.
Anthropic's Project Glasswing has used Claude Mythos Preview to find over 10,000 high or critical severity vulnerabilities in critical software, with partners like Cloudflare reporting a tenfold increase in bug finding rates, highlighting the shift from discovery to patching as the bottleneck.
Dan Jeffries comments on Cloudflare's testing of Anthropic's Mythos, arguing that the real conversation should focus on practical security improvements against AI-powered attacks, and that AI will ultimately make software more secure if teams adapt their workflows.
Vitalik Buterin shares an optimistic take on AI-assisted formal verification as a path to secure, trustless code, linking to his blog post explaining the basics of formal verification using Lean.