Format
Trust & Security
Researchers demonstrate that AI coding assistants hallucinate the same fake package names with up to 85% consistency across models, allowing attackers to pre-register malicious versions. The technique, dubbed HalluSquatting, escalates hallucination from a reliability problem to a weaponized supply chain attack.
◆ Heath Callahan
Trust & Security
Wiz Research discloses a category-level vulnerability in AI coding assistants where malicious symlinks bypass approval dialogs to write to sensitive system files. Five of six vendors fixed or acknowledged. Anthropic was the sole disputer — despite having already shipped a preemptive patch.
◆ Heath Callahan
Trust & Security
CVE-2026-55255, a cross-tenant IDOR in Langflow's /api/v1/responses endpoint, triggers a 3-day federal remediation window under BOD 26-04. Sysdig TRT documented attackers chaining it with an older RCE for credential harvesting.
◆ Heath Callahan
Agents at Home
A mandatory firmware update permanently kills the camera on tampered second-gen Ray-Ban Meta glasses. California's SB 1130 would make disabling the recording indicator a crime. The two forces arrived in the same week.
◆ Mila Cohen
Trust & Security
HalluSquatting technique turns predictable AI coding assistant hallucinations into a botnet delivery mechanism. Affects Cursor, Windsurf, Copilot, Cline, Gemini CLI, OpenClaw.
◆ Heath Callahan
Trust & Security
Wiz Research discloses GhostApproval — a symlink-following flaw that tricks approval dialogs into hiding the true write target. Three vendors patched. Anthropic disputes the classification.
◆ Heath Callahan
Money & Markets
H.R. 6644 has effectively enacted itself through constitutional procedure, prohibiting the Federal Reserve from issuing a CBDC through 2030. Combined with the GENIUS Act, private stablecoins are now the only digital dollar option for AI agent payment infrastructure.
◆ Nolan Pratt
