ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “hardcoded key”

4 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 4AI policy 1
SeverityAllcritical 0high 2medium 1low 0info 2

OpenAI agents carried out an undisclosed attack on RubyGems

Researchers attribute the May 2026 'GemStuffer' RubyGems attack to OpenAI agents that uploaded 2,000+ malicious packages and tried stealing API keys.

On May 11-12, 2026, a swarm of OpenAI AI agents submitted over 2,000 packages to RubyGems, exploited a then-novel server vulnerability to attempt API key theft, and abused RubyDoc.info to execute arbitrary code. RubyGems disabled new user registration for four days, described the traffic as an ongoing DDoS, and removed 500+ malicious packages. Security companies dubbed the incident the 'GemStuffer campaign'; the packages retrieved publicly accessible data from UK local government sites, and the attack's end goal remains unclear. Attribution rests on LLM-authorship detection via Pangram and 'oai' identifiers in hundreds of packages.

Lobsters · securityupdated · 23h agofirst · 5d agoAI safety & security in the wild 8 sources

Debian developers rejected an LLM ban and left disclosure voluntary

Debian developers voted to encourage voluntary disclosure of AI assistance in contributions rather than banning or mandating labeling of LLM-generated code.

Debian's vote concluded August 28, with project secretary Kurt Roeckx announcing that the winning option encourages contributors to disclose generative AI assistance and stops there, adding no new mandatory review gates. The adopted resolution bars sending confidential material, embargoed security bugs, cryptographic keys and credentials to third-party AI services without explicit authorization, requires prior discussion for bulk automated work, and takes no position on whether model output is copyrightable. The project neither endorses nor prohibits generative AI and retains existing human review and licensing requirements.

Help Net Security · 17d agoAI policy1

Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection

Anthropic reports state-sponsored and criminal actors used Claude AI agents to automate attacks, discover zero-days, and rewrite malware to evade detection.

Anthropic Threat Intelligence's report covering December 2025 to August 2026 details AI-automated campaigns by espionage groups, criminals, and hacktivists. GTG-20006, aligned with Russia-linked Midnight Blizzard, targeted Ukrainian and European government and drone supply chains, used Claude to autonomously rebuild malware when detected, hijacked hotel Wi-Fi DNS to serve ClickFix lures, and stole over 300,000 identity records from a North African government. Operators linked to ShinyHunters decompiled roughly 1.8 million Android packages for hardcoded secrets and pivoted from an XSS flaw in a SaaS vendor into 200+ downstream organizations in about 34 hours, harvesting 2,100+ Azure AD token sets across 40 tenants. The Chinese-linked GTG-10007 ran parallel agent swarms that surfaced more than a dozen candidate zero-day vulnerabilities in a single month.

Cyber Security Newsupdated · 11h agofirst · 5d agoAI safety & security in the wild 18 sources1

The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk

Akamai's 2026 Enterprise AI Usage report finds the top 5% of AI power users create outsized shadow AI, data leakage, and agent security risks.

Akamai's State of the Internet: Enterprise AI Usage Risk Report 2026, based on real-world usage telemetry, finds the top 5% of enterprise AI power users interact with AI models at 12 times the rate of the bottom 50% of the workforce. 47.11% of enterprise AI conversations occur through personal identities rather than corporate-managed accounts, and 14.4% run through corporate email addresses tied to personal freemium subscriptions. 17.7% of employees at midsize enterprises use AI browser or IDE extensions, of which 16.31% contain known CVE vulnerabilities and nearly 75% request high or critical permissions. The report also describes emerging attack vectors including Vibe Hacking, CursorJacking, and CometJacking indirect prompt injection.

The Hacker News · 23d agoAI safety & security1