Anthropic’s Claude AI deletes law professor's lecture notes
Claude AI accidentally deleted syllabus and 2023 lecture notes during routine editing, recoverable via Dropbox.
Stories per day · 30 days
2 RSS
Relatedagent-security1ai-agents1apache1apache-answer1authorization1claude1cve-2026-1111841cve-2026-649451deletion1deno1identity1immuta1named-pipe1nomachine1privilege-creep1privilege-escalation1rbac1security-criticism1
17 stories, newest first · one card per story
Stories tagged #permissions
Deno permission prompts and --allow-run criticized as insecure
The author argues Deno's terminal-based permission prompts and PATH-based --allow-run can be abused by malicious code.
CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Apache Answer through 2.0.2 lets unpin-only users hide or show questions.
Immuta CISO predicts critical AI incidents at major enterprises within 18 months
Immuta’s CISO urges lower-trust AI agent permissions and predicts critical enterprise AI incidents within 18 months.
2
ZDI-26-773: NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 named-pipe permission flaw in NoMachine that allows local privilege escalation.
My personal AI agent posted my bank details on company Slack
Shane Mac's Grok Bot finance agent posted his personal bank details into XMTP's company Slack.
How to keep AI agents within their permissions
Token Security explains how to stop AI agents from using credentials outside their assigned tasks.
5
IBM security advisory (AV26-997)
Canada’s Cyber Centre urges patches for IBM DataStage, Guardium, and IBM i, including CVE-2026-84414.
Aletheia: Permission-Minimality Testing for Coding-Agent Rules
Aletheia tests coding-agent rules for excess permissions and catches all 314 AIShellJack attacks.
Unsurprisingly, Meta's new Muse AI agent blatantly ignores users permissions
Meta's Muse agent reportedly uploaded a user's Apple Messages history without permission or Full Disk Access.
cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data
cPanel patched CVE-2026-68490, which lets local users on shared servers read other accounts' calendars and contacts.
2
Dell security advisory (AV26-959)
Canadian Cyber Centre flags credential theft, weak permissions, and unquoted paths in Dell management tools.
APPLE-SA-09-14-2026-10 Xcode 27
Apple patched a Xcode 27 permissions flaw that could let an app access user-sensitive data.
Most Organizations Skip Permissions Reviews Before Deploying AI Tools
Syskit survey of 327 US/UK IT leaders finds 76% deployed M365 AI tools but only 43% reviewed permissions and oversharing risk first.
5
Show HN: Geiger – See every AI agent on your machine and what it can touch
Geiger, a new open-source tool, surfaces AI agents running on a machine and the files and resources they can access.
Inductive Automation Ignition
CISA reports a permissions flaw (CVE-2026-77393, CVSS 8.8) in Inductive Automation Ignition <=8.1.53 letting authenticated users create projects; fixed in 8.1.54.
Rockwell Automation ControlFLASH
CISA advisory for CVE-2026-12663 (CVSS 7.3) in Rockwell Automation ControlFLASH <=V15.07: world-writable install directory enables local code execution.
1