New13 min read
Claude Code Plugins for Teams: Share, Require, Lock Down
Share Claude Code plugins with a team: commit a marketplace to one repo, require it in managed settings, and allowlist sources. Checked on v2.1.295.
Read more
SECURITY
71 articles
LATEST
Claude Code Desktop SneakPeek Flaw: Fixed Version and What To Do
SneakPeek (CVSS 8.7) let a poisoned HTML file over 256KB read SSH keys and cloud credentials through Claude Code Desktop's preview pane. Fixed in Claude Desktop 1.30096.1.
•7 min read
Read Article
New11 min read
Claude Code vs Codex vs Copilot CLI: Local Sandboxes Compared
Copilot CLI local sandboxing is GA. How it compares with Claude Code and Codex on defaults, network, credentials, Windows, and what still runs outside.
Read more
8 min read
NVIDIA OpenShell Makes Agent Sandboxes a Policy Layer
OpenShell is NVIDIA's open-source runtime for running autonomous agents inside policy-enforced sandboxes. The interesting part is not another wrapper around a model. It is the move from prompt rules to infrastructure rules.
6 min read
Cloudflare Page Shield ML Caught 4 Storefront Malware Campaigns Static Scanners Missed
Cloudflare's client-side security ML surfaced four malicious JavaScript operations across online stores: affiliate hijacking, clickless commission theft, a repurposed search-hijacker turned storefront backdoor, and a paid-mobile cloaker. None of them had a signature, and most were invisible to VirusTotal and URLScan.
Read more
7 min read
Cloudflare Adaptive Intelligence: Bot Scores That Retrain Weekly Instead of Quarterly
Cloudflare's new bot detection engine drops the keep-everyone-out wall for a continuously retraining model, disposable rules, and a memory of past attacks. The first component ships today as a toggle in Bot Management, and the design is an inversion of how every bot product has worked until now.
Read more
7 min read
Ray CVE-2025-62593: Botnet Beat the Patch, CISA Gives Feds 3 Days
The RondoDox botnet started exploiting Ray CVE-2025-62593 two days before the CVE was public, and CISA gave federal agencies just three days to remediate. Here is how to check whether your Ray cluster or dev machine is exposed and what to harden first.
Read more
8 min read
arrayref 0.3.10 Ran a Remote Payload at Build Time
On August 20, 2026, compromised arrayref 0.3.10 pulled in a proc-macro1 typosquat whose build script fetched a remote binary. Coding agents that cargo update on yank warnings walk into this.
Read more
7 min read
Cloudflare Gateway Can Now Detect MCP Traffic on the Wire: Shadow MCP Gets a Network Boundary
Cloudflare Gateway now classifies MCP traffic by protocol headers instead of hostname heuristics, ships a shadow-MCP dashboard, and lets admins block any MCP connection that does not arrive through an approved portal. The 2026-07-28 stateless spec is what made it possible.
Read more
11 min read
Skill Files Are the New Supply Chain Attack Surface
Adversarial skill files - folders of instructions agents load dynamically - exploit a mainstream enterprise coding agent in 95.5 to 96.1 percent of runs, while the agent recognizes danger 1.99 percent of the time. The skill folder is now a measured attack surface, and the defense is admission engineering, not better prompts.
6 min read
Anthropic Now Watermarks All Claude Output: Text Watermarks and C2PA for Files
Anthropic confirms that every Claude model released after August 2, 2026 embeds a machine-readable watermark in generated text and attaches C2PA provenance metadata to generated files, across the API, Claude Code, Cowork, and Tag. Detection tooling for third parties is coming, but details are not published yet.
Read more
7 min read
Cloudflare DDoS Report H1 2026: 1 Tbps Attacks Soared as DNS Floods Became the Leading Vector
Cloudflare mitigated 935 network-layer attacks above 1 Tbps in H1 2026, a +519% quarter-over-quarter jump, while DNS floods grew from 25.7% to 40.0% of network-layer attacks. Here is what the numbers say about how attacks are changing and what it means for anyone running public infrastructure.
Read more
7 min read
Encrypted Chain-of-Thought Is Not Private: New Paper Decodes Reasoning Traces From Anthropic, OpenAI, and Google APIs
A new arXiv paper shows the encrypted reasoning blocks that Anthropic, OpenAI, and Google return to API clients can be replayed into weaker models from the same provider and transcribed verbatim. The authors decoded 315,320 blocks from public repositories and recovered 367 PII artifacts and 182 credentials.
Showing 12 of 70 articles
Keep exploring Security
- - Security Topic Hub - tools and guides for Security from the Developers Digest directory
- - Tools Directory - dive deeper across the Developers Digest knowledge base
- - Developers Digest on YouTube - video tutorials covering Security and more
Get Smarter About AI Dev
New tutorials, open-source projects, and deep dives on coding agents - delivered weekly.
One email per weekReal code, not theoryFree forever
Explore 822 topics
Browse All Topics