New details from METR show how OpenAI agents used 14 tokens to breach Hugging Face. In those same datasets, we found 787 live Hugging Face tokens, 237 of which had write access. ✍️ We explain how the agents used stolen secrets to mint new GitHub tokens with write access to private repos and more. Read our research 👇 trufflesecurity.com/blog/the…

We trained a fruitfly to hunt for AWS keys 🧠 🪰 Introducing TruffleFly! 🔑🍎🪰🪰 Researchers mapped and open sourced a Fruit Flies brain, we trained it so every time it finds an AWS key we reward it with Fruit

We found a RubyGems flaw that could leak API keys. 🔎 Researchers say OpenAI agents tried exploiting it 55 days before we reported it. RubyGems patched it, revoked all legacy keys, and found no evidence the theft succeeded. Read 👇

stepping back there's tension right now with "agent just writes code" and - being able to see what it's doing - permissions people exist on a spectrum of caring about these things. it's hard not to feel like more and more people will not care about these things at all still, in opencode2 we implemented codemode in a way that allows us to render decent ui and still prompt for permissions even when the model is just lobbing over a hunk of code but if astra really wants to write raw python, should we even be fighting that and making it use our own thing? tricky questions

Yesterday I popped an XSS. No scanner, no AI, just my brain and my monkey fingers. Like a maniac. 🤷🏻‍♂️

NEW RESEARCH 🔎 Between August 2022 and August 2026🚨 🔥 Over 700 Leaked Corporate AWS Keys Held Full Admin Rights. 💵Only 9.5% had billing alarms; million dollar bills waiting to happen. 🧐 We're launching TruffleHog AWS Analyze to help. 👉 trufflesecurity.com/blog/lea…

Bunch of companies realizing Claude cost is wiping out their earnings in a quarter, cutting dev token budget back. But nobody’s going back. We’ll use cheaper & self-hosted models. Anthropic will struggle unless they release an open-source model, the thing they’re fighting.

🚨 Your AI-generated images may be leaking more than you think ⚠️ Every ComfyUI image embeds prompts, file paths, API keys & GPS data - even from nodes that never ran 🔎 2.49M Discord images scanned: 159,752 leaked metadata, 681 had live API keys 👉trufflesecurity.com/blog/api…

.@patrickc on how Stripe got its name: "We just couldn't come up with a good name... We were literally reduced to picking random words late at night." "One of the folks at Stripe had the bright idea of, 'Why don't we just assemble a big list of words and email all of the owners of the dot com domains?'" "And then we also continued our own creative process. We came up with memorable names like PayDemon... We thought it was super clever because we could have this awesome mascot." "The owner of stripe.com generously responded to us and had an offer that was at least within our plausible budgetary range." "But we couldn't decide between PayDemon and Stripe. I swear I'm not making this up... If we could not settle on a name by December 20th, 2010, we would just default to Stripe. And we couldn't think of a more compelling name, and so Stripe it became." Patrick Collison w/ John Lilly at Stanford University (2015)