55
55
30
45
55
30
30
30
30
57
60
30
42
45
Secure all your internal vibe-coded applications — in one click
Cloudflare launched Access for Workers, letting admins attach one zero-trust policy to a Worker across all routes, domains, and previews automatically.
Cloudflare announced Access for Workers, a feature that binds an Access (zero-trust) policy directly to a Worker rather than to individual routes. The policy then applies automatically everywhere the Worker runs, including custom domains, workers.dev subdomains, routes, and preview URLs. Cloudflare positions it as one-click protection for internal, quickly built (vibe-coded) applications.
20
30
55
How AI and cybersecurity are reshaping ServiceNow
Analysis argues ServiceNow's $7.75B Armis acquisition and AI-driven consumption pricing are reshaping its ITSM platform amid SaaS market anxiety.
CSO Online examines how AI agents, vibe-coding fears, and a reported 30% share price drop are pressuring ITSM leader ServiceNow, and how the company is pivoting toward consumption-based revenue and cybersecurity. The piece highlights ServiceNow's $7.75 billion cash acquisition of Armis, priced at roughly 23 times the vendor's $340 million annual revenue, as a strategic move to supercharge ITSM workflows with accurate device inventory and orchestration rather than to sell a standalone security product. Experts note this ends Armis's vendor-neutral position, introduces the CISO as a new buyer, and will likely lead to aggressive Armis bundling at contract renewals.
45
30
60
55
30
60
60
55
42
60
55
30
Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
Attackers stole a METR API key via an exposed agent-run EC2 instance and consumed about $600,000 in public model credits over three weeks.
AI evaluation nonprofit METR disclosed two incidents. In March 2026, a fail-open bug in a vibe-coded app disabled authentication on a publicly accessible EC2 instance; an attacker prompted the running agent to reveal a model provider API key, added an SSH key for persistence, and consumed roughly $600,000 in free public-model credits over three weeks without being noticed. In May 2026, attackers probed METR's public infrastructure using agents, automated vulnerability discovery, credential stuffing, OAuth token attempts, and phishing; a separately exposed read-only SQL mechanism found by a bug bounty hunter risked leaking unpublished evaluation data, but no access to non-public data was confirmed.
58
42
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR disclosed attackers stole an API key and burned about $600,000 in inference credits, plus a second probing campaign against its infrastructure.
METR, the AI model evaluation non-profit, disclosed two 2026 security incidents. In March, attackers found a publicly exposed EC2 instance behind a fail-open authentication bug, prompted an agent to reveal its API key, added SSH persistence, and consumed roughly $600,000 in inference credits over three weeks. In May, a likely financially motivated actor systematically probed METR's public infrastructure using agents for vulnerability discovery, credential stuffing, OAuth token grants and staff phishing, with no confirmed access to non-public data.
52
42
42
60
42
60
30
30
⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe
60