Vendor risk
Showing 1–20 of 20 posts
- Security & Risk
Hugging Bay builds a BitTorrent backup for open AI models as Nvidia buys Hugging Face
A volunteer-built BitTorrent index for open AI models went online in July, weeks before Nvidia's $12.93 billion Hugging Face deal.
- Security & Risk
OpenAI's Agents Turned a Documentation Build Step Into Remote Code Execution
Independent researchers reconstructed how OpenAI's own agents ran code on RubyDoc.info's servers in May, from public package data alone.
- Security & Risk
ChatGPT for Healthcare brings patient records and public medical data into the workspace
OpenAI’s Epic integration and public-data plugin connect clinical work to its source information, with organisational access controls and physician evaluations.
- Security & Risk
294,000 exposed AI tools is the wrong number to worry about
Censys counted 294,000 IPs exposing AI tooling to the public internet. The number that should change your afternoon is CVE-2026-42208.
- Security & Risk
A webcam's recording light is only useful if its firmware is protected
Chaz Schlarp used Claude Opus 5 to reverse-engineer five desk peripherals in about 13 hours, including a webcam whose recording LED he could switch off.
- Security & Risk
Hugging Face Published the Whole Timeline. The Part That Stuck With Me Was the Refusal.
17,600 attacker actions reconstructed in public. The detail I keep coming back to is that the models I use every day wouldn't help with the investigation.
- Security & Risk
Substack Writers, You Need a Website
Substack is a distribution tool, not a home. A 478-point Hacker News post makes the case for POSSE — publish on your own site, syndicate everywhere else.
- Security & Risk
SoN 2.26: The best AI models are getting harder to get
Tales from the Workbench =================================================== Some weeks the newsletter is one idea worked all the way through when time affords it. This week it’s…
- Security & Risk
Fable: here in an instant, then gone
Fable: here in an instant, then gone Last week I wrote about Fable 5 — Anthropic’s newest model — and the catch: it was only on the normal subscription plans for a short window. I…
- Security & Risk
SoN 2.17: You Can't Cost-Reduce Yourself to Greatness (Free Edition)
You Can't Cost-Reduce Yourself to Greatness (Free Edition) I caught a Seth Godin interview at the beginning of the week and one line in particular caught my attention. He said…
- Security & Risk
Anthropic Didn't Block Abuse. They Blocked Competition.
The OpenClaw subscription ban isn't about fair use — it's Anthropic asserting platform control while shipping their own replacement.
- Security & Risk
Perplexity Pulled a Perk and Hoped Nobody Would Notice
Perplexity Pro quietly removed $5 monthly API credits from its $20 plan. No announcement, no changelog.
- Security & Risk
Your AI Provider's Ethics Are Now a Business Risk
Anthropic refused Pentagon weapons contracts and got sanctioned. A court blocked it. Here's what that means if you build on Claude.
- Security & Risk
Grok Failed in Both Directions in the Same Week
Grok allegedly generated CSAM from real teen photos and flagged a real Netanyahu video as '100% deepfake.' Two failures, opposite directions, one root cause.
- Security & Risk
Meta Is Gutting Itself to Fund AI Bets That Aren't Working Yet
Spending $135B on AI infrastructure while cutting 20% of staff and delaying your flagship model is not a strategy. It's a prayer.
- Security & Risk
Microsoft Spent $13B on OpenAI, Then Built Cowork on Claude
Microsoft's flagship M365 agent feature runs on Anthropic's model. If they're going multi-model, so should you.
- Security & Risk
An AI Agent Hacked McKinsey's AI With a 25-Year-Old Exploit
An autonomous offensive agent breached McKinsey's internal AI platform in two hours using SQL injection. The AI was sophisticated.
- Security & Risk
OpenAI Took the Pentagon Deal. What's Your Exit Plan?
Anthropic refused. OpenAI said yes within hours. If your AI stack depends on one provider's values staying constant, you don't have a strategy—you have a bet.
- Security & Risk
Claude 3.5 Haiku, 3.7 Sonnet, GPT-4o: The Deprecation Wave Is Here
Three major models entering end-of-life in the same window. If you hardcoded model IDs, migration planning just became urgent.
- Security & Risk
SoN 32: When They Take Over Your Email
Last weekend, a close family member lost access to their email account. Not “forgot the password” lost. Fully taken over — the attackers changed the recovery email, changed the…
