April 10, 2026

Little Snitch for Linux

Discover powerful applications such as Little Snitch Mini, Little Snitch, LaunchBar and Micro Snitch.

Russian submarines ‘tried to spy on UK while world distracted by Iran’

John Healey, the defence secretary, has revealed a month-long operation to shadow three submarines allegedly spying on pipelines and underwater cables

https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Scientists invented a fake disease. AI told people it was real

Bixonimania doesn’t exist except in a clutch of obviously bogus academic papers. So why did AI chatbots warn people about this fictional illness?

GitHub - jo-inc/camofox-browser: Headless browser automation server for AI agents to visit sites that are usually blocked · GitHub

Headless browser automation server for AI agents to visit sites that are usually blocked - jo-inc/camofox-browser

jo-inc/camofox-browser (1,706 stars, JavaScript) Headless browser automation server for AI agents to visit sites that are usually blocked

source: left curve dev (@leftcurvedev_)

[2604.08407] Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain

Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests across multiple upstream providers. These routers operate as application-layer proxies with full plaintext access to every in-flight JSON payload, yet no provider enforces cryptographic integrity between client and upstream model. We present the first systematic study of this attack surface. We formalize a threat model for malicious LLM API routers and define two core attack classes, ...

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain

Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests across multiple upstream providers. These routers operate as application-layer proxies with full plaintext access to every in-flight JSON payload, yet no provider enforces cryptographic integrity between client and upstream model. We present the first systematic study of this attack surface. We formalize a threat model for malicious LLM API routers and define two core attack classes, payload injection (AC-1) and secret exfiltration (AC-2), together with two adaptive evasion variants: dependency-targeted injection (AC-1.a) and conditional delivery (AC-1.b). Across 28 paid routers purchased from Taobao, Xianyu, and Shopify-hosted storefronts and 400 free routers collected from public communities, we find 1 paid and 8 free routers actively injecting malicious code, 2 deploying adaptive evasion triggers, 17 touching researcher-owned AWS canary credentials, and 1 draining ETH from a researcher-owned private key. Two poisoning studies further show that ostensibly benign routers can be pulled into the same attack surface: a leaked OpenAI key generates 100M GPT-5.4 tokens and more than seven Codex sessions, while weakly configured decoys yield 2B billed tokens, 99 credentials across 440 Codex sessions, and 401 sessions already running in autonomous YOLO mode. We build Mine, a research proxy that implements all four attack classes against four public agent frameworks, and use it to evaluate three deployable client-side defenses: a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging.

PDF

source: Chaofan Shou (@Fried_rice)

Orbán’s Spying Kit Revealed: Israeli Surveillance Tool Combined with Hungarian Technology - VSquare.org

Intelligence agencies of Viktor Orbán's government have been secretly using Webloc — a mass surveillance tool that tracks hundreds of millions of people via smartphone advertising data — making Hungary the first confirmed EU country to deploy it, in likely violation of GDPR. Moreover, our investigation confirms the existence of "homegrown" OSINT and spyware tools.

Out-of-bounds Write in Firecracker virtio-pci Transport · Advisory · firecracker-microvm/firecracker · GitHub

### Summary Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services. An issue exists wher...

firecracker-microvm/firecracker (33,598 stars, Rust) Secure and fast microVMs for serverless computing.

source: Colin O'Brien (@InsanityBit)

string_bug.md · GitHub

GitHub Gist: instantly share code, notes, and snippets.

string_bug.md · GitHub

GitHub Gist: instantly share code, notes, and snippets.

source: Toan Pham (@__suto)

unprompted.au

Launching Soon