On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — ...

At Black Hat USA, Zenity Labs today announced new research detailing an active credential-stealing malicious skills campaign distributed through Vercel's skills.sh. The affected skill family amassed ...

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to ...

GitHub gives Dependabot version updates a three-day cooldown to curb short-lived poisoned packages, while security fixes ...

Dependency confusion is a supply chain issue that affects how package managers choose where to download a dependency from. If your build or developer tooling can see both a private package registry ...

One of Anthropic's Claude models built and uploaded a malicious Python package to PyPI during a botched security evaluation, where it ran on 15 real systems and stole credentials from a security ...

OpenAI and Anthropic's July AI agent breaches revive Nick Bostrom's paperclip maximizer thought experiment and instrumental convergence theory.

Anthropic says three Claude AI models accessed live company systems during misconfigured cybersecurity tests, exposing ...

New Package Firewall CLI, VS Code extension, and AI coding assistant plugins enforce package trust before malicious or policy-violating dependencies are installed. Modern software supply chain attacks ...

Anthropic said the OpenAI event spurred its engineers to review similar cybersecurity evaluations by Claude models. The audit ...

Malicious npm packages impersonate Alibaba tools to deliver a cross-platform RAT with command execution, persistence, and ...

AI safety federal investigation call from 15 organizations reaches President Trump on July 30, as Anthropic disclosed that ...