Security — Page 8

AI Runtime Control routes model calls, tracks spend and fails over providers, while AI Firewall inspects prompts before they reach a model.

The Apache-2.0 release exposes ZCode's desktop, web and CLI code, though its new GitHub repository launched without a security policy.

Founders Sandhya Prashanth and Kannan Udayarajan are putting exhaustive API checks in software while reserving business logic for pentesters.

CEO Ido Livneh argues that years of exceptions let staffing limits become security policy, a failure Jazz built Melody to address.

The project's documentation describes 1 KB uploads for GGUF files and llama.cpp execution, showing how a service can move model data through GET requests.

The Dubai IT operator published a 72-hour pfSense capture, but endpoint metadata alone cannot establish what each encrypted connection carried.

WIRED traced increasing Primax shipments from Thailand while Flock Safety's recent sales materials stopped identifying where its license plate cameras receive final assembly.

The complaint arrived one day after Meta said Muse's Mac access was opt-in and under the user's control.

Mike Moore's test harness shows server-written instructions entering trusted context, with public caching able to spread them between callers.

Reverse engineering found encrypted workspace snapshots sent to Aliyun OSS whenever a developer uses the logged-in desktop app.

The 313MB archive was encrypted for a Z.ai-held key, while the app's privacy controls did not stop packaging or retries.

The device produced 1.6 million images in 21 days, exposing an edge-security problem at a startup valued at $7.5B in March 2025.

Independent security researchers used Anthropic's Claude to access an OpenAI employee's ChatGPT account and suggest software changes, according to The Wall Street Journal. The report leaves the authorization, timing and impact unresolved.

David Mytton's third startup connects agent traces across sessions and can block tool, API and database calls before execution.

Firmware analysis found a gated kernel extension and user-space library, while Apple's public Endpoint Security API remains limited to the Mac.

Audit logs show sales and testing accounts queried live networks for crowds, masks, political stickers and religious symbols.

The May leak involved CrowdSec's SaaS, AWS and automation repositories; the company says it found no customer data or credentials that could enable lateral movement so far.

OpenAI alignment research lead Kai Chen says the voluntary process is meant to inform shared standards; Axios reports targets of six business days for disclosure-ready cases and 12 for minor investigations.

A human operator used agents to raid code repos, seize cloud keys and hijack the victim's own AI infrastructure, Unit 42 reported.

The notification, still under review, says an agent logged in, found an application flaw, altered personal data and accessed invoices with limited human help.

The Philadelphia security provider added endpoint agents, attack-path views and private AI remediation, with plans starting at $185 a year.

The local-first alpha tests web, API and LLM apps, while its noncommercial license preserves a route back to paid software.

Researchers traced the campaign to HBO Max's verified account, turning a paid ad and a fake Mac download into an infostealer delivery path.

Screenshots show identity documents and verification photos; Revolut says its systems and customer funds were unaffected.