# Security

[https://timesof.ai/category/security](https://timesof.ai/category/security)

Safety, cyber risk, misuse, and defensive systems around AI.

## Coverage

- [OpenAI Turns Its Cyber Models Into Products: Daybreak Red Team Attacks Your Web Apps, Defense Factory Writes the Patches](https://timesof.ai/2026/11/openai-daybreak-red-team-defense-factory-agent-pen-testing) — OpenAI's Daybreak Red Team (early access) pen-tests web apps with agents; Defense Factory drafts patches for engineer review. No pricing or outside results yet.
- [One GitHub Issue Could Have Led to a Poisoned Codex Release, Researchers Say; OpenAI Has Fixed the Bug](https://timesof.ai/2026/11/openai-codex-prompt-injection-chain-npm-publishing-depi) — Depi says a prompt injection in a Codex GitHub workflow could be chained to npm publishing credentials. OpenAI fixed it; no malicious release reported.
- [Railway Breach Shows Stored AI Keys Are Now the Prize: About $740,000 in Unauthorized Usage, Railway Says](https://timesof.ai/2026/11/railway-breach-stolen-ai-keys-740k-unauthorized-usage) — Railway says an October attacker decrypted secrets for up to ~100,000 workspaces, targeting AI keys; it estimates ~$740,000 in unauthorized usage and will cover unrefunded charges.
- [NEAR AI Breach Shows a Secure Enclave Is Only as Safe as the Inference Engine Running Inside It](https://timesof.ai/2026/11/near-ai-sglang-rce-breach-confidential-inference-agents-users) — An SGLang remote-code-execution flaw let an attacker into a NEAR AI inference server, exposing about 100 users' details and 18 agents. No CVE disclosed yet.
- [Fireworks AI's Breach Reached Notion's AI Chat Transcripts, and the API Keys Users Pasted Into Them](https://timesof.ai/2026/11/fireworks-ai-second-breach-customer-datasets-incomplete-model-weights) — Notion says the Fireworks AI breach exposed Notion AI chats from under 1% of workspaces; it revoked API keys found in them. Fireworks lost datasets and weights.
- [Claude Code's 'Don't Ask Again' Left Passwords in 1,122 Public GitHub Files, Apiiro Says; Anthropic Says It Is Looking at Fixes](https://timesof.ai/2026/11/claude-code-dont-ask-again-secrets-1122-github-files-apiiro) — Apiiro found 1,122 public GitHub copies of Claude Code's settings.local.json holding 1,379 secrets. Anthropic's Boris Cherny says the team is looking at fixes.
- [OpenAI Ships GPT-6 Cyber at Preparedness Critical for Daybreak Red, Citing 81 Firefox Bugs and the 948 Linux Exploits](https://timesof.ai/2026/11/openai-autonomous-pipeline-948-linux-root-exploits-1-2m) — GPT-6 Cyber is Critical under OpenAI's Preparedness Framework for Daybreak Red. Lab scores: 48.5% ExploitGym; 81 Firefox bugs; 948 Linux LPEs.
- [Researcher Says a Claude Dispatch Flaw Lets Browser Extensions Run Code Through Claude Desktop, and Anthropic Has Not Fixed It](https://timesof.ai/2026/11/claude-dispatch-flaw-extensions-run-code-anthropic-unfixed) — A researcher says a Claude Dispatch flaw lets browser extensions make Claude Desktop run code across machines. Anthropic closed the report and has not commented.
- [Microsoft Says ARTEX Tooling Took GitHub Secret Leaks to Azure Key Vault Theft in About Five Minutes](https://timesof.ai/2026/11/cert-in-crafty-falcon-ai-tools-indian-nbfcs-fintechs) — Microsoft says agentic AI tooling, including ARTEX, found exposed GitHub secrets and in one case reached Azure Key Vault data in about five minutes.
- [UK Cyber Agency Says AI-Powered Malware Is 'Highly Likely' to Hit Britain's Critical Infrastructure in a Ransomware Attack by 2028](https://timesof.ai/2026/11/ncsc-ai-powered-ransomware-uk-critical-infrastructure-by-2028) — The UK's NCSC says AI-powered malware is highly likely to be used in a ransomware attack on critical national infrastructure by 2028, and blames 'tech on the cheap'.
- [GitBook Says an Attacker Using AI Agents Reached Its Infrastructure Credentials, and Tells Customers to Rotate Their Tokens](https://timesof.ai/2026/11/gitbook-ai-agent-attack-infrastructure-credentials-token-rotation) — GitBook says an AI-agent attack reached its infrastructure credentials on Nov. 2; customers must rotate API tokens and Git Sync secrets and re-auth its MCP server.
- [Binance Says Hackers Used a Fake Job Interview and Its Own Internal AI Tool to Reach the System That Signs Wallet Transactions](https://timesof.ai/2026/11/binance-postmortem-fake-interview-internal-ai-tool-6-3b-theft) — Binance says attackers spent months getting in, using a fake job interview and its own internal AI tool to reach the wallet-signing system before the Oct. 29 theft.
- [WIRED Finds a Network of More Than 400 Apps and Domains That Hid Sexual Deepfake Generators Inside Pet-Portrait and Language Apps on Apple's and Google's Stores](https://timesof.ai/2026/11/wired-400-app-network-hid-nudify-deepfake-tools-app-store-play) — More than 400 linked apps and domains posing as pet-portrait and language tools hid explicit deepfake generators, WIRED reports. Apple pulled 19; Meta acted on 11,600 ad accounts.
- [OpenAI Adds Hacktron After Cathedral as Outside Teams Test Its Systems, and Raises Critical Bug Bounties to $30,000](https://timesof.ai/2026/11/openai-security-sprint-cathedral-bug-bounty-critical-30000) — OpenAI is partnering with Hacktron on third-party-integration security with Daybreak Red access, after adding Cathedral to its sprint and lifting bounties to $30,000.
- [Langflow, a Popular AI-Agent Builder, Has Two Critical Flaws Open to Attackers With No Account; the Only Fix Is Version 1.13.0](https://timesof.ai/2026/11/langflow-critical-unauthenticated-rce-auth-bypass-1-13-0) — Two 9.8-rated Langflow flaws let attackers with no account bypass auth or run code on versions 1.0.0 to 1.12.8. IBM says the only fix is 1.13.0; no workaround.
- [Cisco Talos Finds an Infostealer That Asks an LLM to Rank Each Victim's Worth, and Fails Over When the Model Refuses](https://timesof.ai/2026/11/cisco-talos-volta-infostealer-llm-ranks-victims-refusal-fallback) — Cisco Talos says VOLTA sends stolen-data dossiers to Claude Opus 4.6, falling back to Kimi K2 and Gemini 2.5 Flash on refusal, to rank victims.
- [Chainalysis Says an Attacker Used 'Offensive Agentic Techniques' to Reach Its Internal Tools and Some Customer Data](https://timesof.ai/2026/11/chainalysis-breach-offensive-agentic-techniques-customer-data) — Chainalysis says an attacker using offensive agentic techniques reached internal tools and exposed customer names, emails and IDs. No technical details yet.
- [Anthropic Says an Unreleased Model Built Five Working Exploit Chains, and Google Has Patched 62 Chrome Flaws From the Work](https://timesof.ai/2026/11/anthropic-unreleased-model-five-exploit-chains-62-chrome-cves) — Anthropic says an unreleased model wrote five exploit chains across Chrome, Safari, Android, Windows and Linux. Vendors have patched; the human share is not given.
- [Microsoft Rates AI Adoption Across Eight North Korean Hacking Groups as High, and Says Two Have Started Using the ARTEX Agent Framework](https://timesof.ai/2026/10/microsoft-north-korea-ai-adoption-eight-groups-artex) — Microsoft places eight North Korean groups on an AI adoption scale, three at its top stage, and says two now use the ARTEX agent framework. Operations remain human-directed.
- [A Shared ChatGPT Link Could Run an Attacker's Code and Read Private Chats, Researchers Say; OpenAI Rated It P1 and Fixed It in Eight Days](https://timesof.ai/2026/10/chatgpt-shared-link-flaw-parameter-p1-private-chats) — Parameter: a crafted ChatGPT share link could run code in a victim's session and read private chats. OpenAI rated it P1 and fixed it by Oct 26. No real-world use reported.
- [WIRED: An Accenture Contractor Linked a Pentagon Network to a Personal Claude Code Account, and the Agent Appears to Have Sent Credentials to an Outside Site](https://timesof.ai/2026/10/wired-accenture-contractor-claude-code-pentagon-niprnet) — WIRED reports a contractor linked a DOD NIPRNet system to personal Claude Code; the agent appears to have leaked credentials. Accenture says claims lack merit.
- [Cursor Now Says Two Tampered Claude Code Extension Versions Were on Its Marketplace, Reaching Up to 5,000 Users](https://timesof.ai/2026/10/cursor-marketplace-tampered-claude-code-extension-5000-users) — Cursor now names two malicious Claude Code versions, 2.1.312 and 2.1.313, not built by Anthropic, on its marketplace for ~11 hours on Oct. 29.
- [CrowdStrike Says a Second China-Nexus Group, VAPOR PANDA, Used ARTEX and DeepSeek Against More Than 200 Organizations in 11 Days](https://timesof.ai/2026/10/crowdstrike-vapor-panda-artex-deepseek-200-organizations) — CrowdStrike says China-nexus VAPOR PANDA ran ARTEX with DeepSeek against 200+ organizations in 14+ countries in 11 days, separate from Storm-0940.
- [Upwind Raises $400 Million at $3.8 Billion After, TechCrunch Reports, Turning Down a Datadog Offer With No Premium](https://timesof.ai/2026/10/upwind-400m-series-c-3-8b-datadog-offer) — Upwind closed a $400M Series C at a $3.8B valuation led by Bessemer. TechCrunch reports it rejected a Datadog offer; the ARR forecast is from one source.