AI Safety news and analysis on Web Pulse: 28065 curated articles tracking the latest AI Safety developments, tools, and research, updated continuously from vetted sources.
An October 30 Wiz industry report initially listed nine security incidents affecting AI developer platforms, with more added in November, as vendors including Fireworks, Zeabur, Lightning.ai, Railway, LiteLLM and Northfl…
An external audit of 61 official remote MCP servers requiring login found that all implement HTTP 401 challenges and PKCE with S256, but adoption of newer parts of the 2026-07-28 MCP authorization spec lags: only 25 adve…
Developer Ibrahim Kobeissy released Harneo v0.2, an MIT-licensed open-source harness manager that keeps Claude Code skills, commands, subagents, hooks, settings.json, MCP servers and CLAUDE.md files in one library outsid…
Anthropic published FlashProve on November 2nd, an open-source research prototype that attaches a cryptographic proof to an AI response so a recipient can verify which committed model produced it, tested at 400B-paramete…
A developer behind Linkmortem, a dead-link checker that uses the open-weights Gemma 4 model to classify pages code cannot judge, reported that an AI crawler-targeting page attempted an indirect prompt injection with the …
A security report filed against Postman's desktop app found that on launch it automatically wrote Codex and Claude Code agent files, installed a startup hook instructing the coding agent to load Postman's skill before no…
Anthropic published a blog post Tuesday detailing FlashProve, an open-source system for "provable inference" that uses cryptographic proofs to verify which AI model produced a given output. The system requires labs to pu…
Apple's 10-K filed with the US Securities and Exchange Commission on November 3, 2026, expanded its AI risk discussion to 628 words from 199 words in its May 2026 10-Q, warning that rogue AI agents that "conceal actions"…
Postman desktop version 12.33.4 silently installed MCP plugins into Claude Code and Codex during a routine auto-upgrade on October 24, modifying ~/.claude/settings.json and ~/.codex/config.toml without any install dialog…
Anthropic released FlashProve, an Apache 2.0 zkSNARK prototype that cryptographically proves a reply came from a committed model without revealing its weights. Anthropic reports FlashProve proves Llama 4 Maverick at 110 …
Apple warned in its 10-K annual filing Tuesday that rogue AI agents could "conceal actions, hide, withhold or manipulate information, or generate inaccurate or deceptive outputs," posing a risk to its business if they ac…
An unauthorized user accessed an internal WorkOS sales application linked to the company's ARTEX AI tool, exposing sensitive business contacts including names, email addresses, and job titles, according to reporting on t…
Security researchers scanning 159,041 AI-generated web applications in November 2026 found that 24,664 apps built on Lovable and its Supabase integration leaked database records on page load, exposing more than 80,000 us…
A developer built Pilothouse, a rules engine that hooks into coding agents' PreToolUse points to allow, ask, or deny tool calls across Claude Code, Codex, OpenCode, and Grok Build. The tool ships presets like guarded-aut…
A developer built Pilothouse, a CLI tool that installs hooks into Claude Code, Codex CLI, OpenCode and Grok Build so multiple coding agents can run in parallel from a single inbox, with approval requests routed to a phon…
A developer who builds Pilothouse, an open-source Go-based permission daemon, outlined a 2026 vibe-coding stack that routes every tool call from Claude Code, Codex CLI, OpenCode and Grok Build through a policy.yaml allow…
A newly published tool lets anyone inspect and verify images signed with Apple Reference Image, the cryptographic authenticity standard Apple introduced with the iPhone 18 Pro series and deployed in iOS 27, which until n…
CrowdStrike launched an AI Kill Switch at its Fal.Con Europe 2026 conference in Barcelona on Tuesday, letting security administrators block unauthorized AI agents through AI gateways, with direct endpoint termination and…
Security researchers at firm Hacktron exploited an SSO misconfiguration in OpenAI's community forum on July 25, 2026, gaining remote code execution and reaching OpenAI's internal shared code repository in under 72 hours,…
Anthropic's Project Glasswing, launched April 7th, 2026 with access to the unreleased frontier model Claude Mythos Preview, had by May 22nd produced more than 10,000 high- or critical-severity software flaws across about…